EU AI Act compliance in 2026: what changed, what applies now, and what businesses should do

EU AI Act compliance became more confusing in 2026, not less. In July, the EU adopted the “Digital Omnibus on AI”, which pushed back the most demanding obligations for high-risk systems. Many headlines read that as “the AI Act is delayed”. It is not. Several obligations already apply — including transparency rules that affect almost every business with a chatbot, an AI assistant or AI-generated content aimed at EU customers.

This article summarises what changed, what applies today, and the practical steps we recommend to clients who build or use AI. It is a technical and practical overview, not legal advice — for decisions about your specific situation, speak to a qualified lawyer.

What the Digital Omnibus changed

The amending regulation, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, according to White & Case and K&L Gates. The key changes:

• Stand-alone high-risk AI systems (Annex III) — such as AI used in hiring, credit scoring, education or access to essential services — now have until 2 December 2027 (previously 2 August 2026).
• High-risk AI embedded in regulated products (Annex I) — now 2 August 2028 (previously 2 August 2027).
• AI literacy — the obligation was softened from “ensuring” a sufficient level of AI literacy among staff to “supporting” its development.
• SMEs and small mid-caps — extended relief, including simplified documentation and proportionate quality management.

What already applies — the timeline that matters

Article 50: the rule most businesses need to act on now

Article 50 is where EU AI Act compliance becomes practical for ordinary companies. In summary:

• Chatbots and AI assistants: people must be informed that they are interacting with an AI system, unless it is obvious from the context.
• AI-generated content: providers of systems that generate synthetic audio, images, video or text must mark outputs in a machine-readable way so they can be detected as AI-generated.
• Deepfakes: deployers who publish realistic AI-generated or manipulated images, audio or video of people, places or events must disclose it.
• AI-generated text on matters of public interest: must be disclosed, unless it has undergone human review and someone holds editorial responsibility.
• Emotion recognition and biometric categorisation: people exposed to these systems must be informed.

For a typical business, that means: label your website or WhatsApp assistant clearly, keep a human route available, and have a policy for AI-generated images and videos in your marketing.

Does the EU AI Act apply to companies outside the EU?

Yes, in many cases. The Act applies to providers placing AI systems on the EU market regardless of where they are established, and to providers and deployers outside the EU when the AI system’s output is used in the EU. A software company in Albania, the UK or the US that sells an AI feature to EU customers should assume it is in scope. For Albanian companies, this matters twice: many serve EU clients today, and national law is expected to align with the EU acquis as part of the accession process.

Penalties

The AI Act sets fines of up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for breaches of most other obligations — including transparency. For SMEs, the lower of the two amounts applies. The Omnibus did not remove these penalties; it moved some deadlines.

A practical EU AI Act compliance checklist

1. Make an AI inventory. List every AI system you build or use: chatbots, internal assistants, content tools, scoring or screening tools, and AI features inside SaaS products you rely on.
2. Classify each one. Is it prohibited, high-risk (Annex III), subject to transparency obligations, or minimal risk? Most business uses fall in the last two groups.
3. Fix transparency now. Add AI disclosure to chat interfaces, label AI-generated media where required, and check that generated content can be marked.
4. Check for high-risk uses. CV screening, employee monitoring, credit decisions or access to essential services need a proper plan before December 2027: risk management, data governance, logging, human oversight and documentation.
5. Build logging and human oversight into your AI systems. These are good engineering practice anyway, and they are central to high-risk requirements.
6. Support AI literacy. Short internal training on what your AI tools do, their limits and how to escalate problems.
7. Review suppliers. Ask AI vendors how they meet their provider obligations and what documentation they can give you.

How engineering choices make compliance easier

Most AI Act requirements map directly onto good system design: clear logs of every AI decision and tool call, human approval steps for consequential actions, answers grounded in approved sources, and the ability to explain what data a system used. When we build AI agents and RAG systems, these are part of the architecture from day one — which is far cheaper than retrofitting them later.

Frequently asked questions

Is the EU AI Act delayed?

Partly. High-risk obligations moved to December 2027 and August 2028. Prohibited practices, general-purpose AI rules and Article 50 transparency obligations were not delayed.

Does my website chatbot need to comply?

If EU residents use it, yes: users must be told they are talking to an AI unless that is obvious. A clear label solves most of it. See our guide to building an AI chatbot for customer service.

We only use ChatGPT or Claude internally. Are we affected?

Internal use of general-purpose tools is usually low-risk, but it still counts for AI literacy, and it becomes relevant if outputs are published or used for decisions about people.

Is AI-generated marketing content allowed?

Yes, but realistic deepfakes must be disclosed, and generative tools must mark their outputs. Keep human editorial review for published text.

Get your AI systems ready

If you are building an AI product, adding an assistant to your website or unsure whether an existing AI feature is in scope, talk to Shkulaku. We help companies design AI systems with transparency, logging and human oversight built in, and we can review an existing implementation against the technical side of EU AI Act compliance — working alongside your legal advisers.