EU AI Act: questions businesses should clarify now

Legal position of this article: 7 October 2026. Regulation (EU) 2026/1744 amended the original Act. Application is phased; saying “everything applies since August 2026” would be too broad.

Prohibitions and general provisions began applying in February 2025; general-purpose model rules followed in August 2025. Article 50 transparency rules generally apply from 2 August 2026.

For certain systems generating synthetic content that were placed on the market before 2 August 2026, Article 111(4) provides a transition until 2 December 2026 for the provider obligation under Article 50(2). This is not a general postponement of all transparency duties.

Chapter III sections 1–3, except Article 6(5), apply from 2 December 2027 to systems under Article 6(2)/Annex III and from 2 August 2028 to systems under Article 6(1)/Annex I. Classification and other transitional rules require assessment for the individual system.

An inventory is a practical working foundation, not an identical legally required technical file for every application. Include AI features in existing office, CRM and support software.

Fictional purpose statement: A tool drafts customer-service answers from approved product documents. A service employee checks the draft before sending it. This says more than “We use a chatbot”.

• Product, provider, version and operating status
• Specific purpose and intended limits
• User roles and affected groups
• Input data, source systems and resulting outputs
• Human review or automatic processing
• Business and technical ownership

A business using an off-the-shelf tool may be a deployer. A business developing and offering a system under its own name may be a provider. Changes to purpose or substantial modifications can affect the allocation of roles; the product label alone does not answer this.

Check prohibitions, possible high-risk classification and relevant transparency obligations separately. Not every writing assistant is a high-risk system; a sensitive selection process does not become harmless merely because a person formally clicks “Approve”.

Record the reasoning and unresolved questions. Privacy, information security and other applicable laws continue to matter. Decisions about employment, education or important services particularly call for qualified case-specific assessment.

Record which information may be entered, who has access and whether a provider stores inputs or uses them for training. Internal sources need traceable versions, validity and permissions.

A workable control rule names the reviewer, timing, available evidence and the ability to correct or stop an output. This is organisational preparation; specific statutory oversight obligations depend on the system and role.

Article 50 distinguishes provider and deployer duties, including disclosure of certain AI interactions, technical marking of synthetic content and disclosure of certain deepfakes. Not every internal text correction requires a public label. Check the relevant paragraph and its exceptions rather than assuming a universal labeling requirement.

Under the amended Article 4, providers and deployers must take measures supporting the development of AI literacy among their staff and others working on their behalf. Prior knowledge, experience, the context of use and affected groups matter. No specific individual level has to be guaranteed.

The Commission and Member States support these efforts. A course certificate is neither universally prescribed nor sufficient evidence of compliance by itself. The following records are practical aids to traceability, not one identical statutory form for every business.

• Affected roles and the tools actually used
• Learning content covering data, limitations, sources and human review
• Measures delivered, dates and feedback
• A contact person and escalation paths
• Reasons for updating measures, such as new tools or different purposes

Collect provider documents, contracts, data-processing information, purpose statements and reasoned classifications where responsible people can find them. Record changes and unresolved points. A general guide does not replace assessment of the specific system.

During operation, record errors, complaints, feedback and system changes. If the purpose, affected groups or way of using the system changes, reassess the role and risk classification rather than continuing with the old classification unchanged.

Start with a manageable use case and clear ownership. Uncertain roles, possible prohibited practices or high-risk classification require legally qualified clarification before proceeding. The complementary orientation page explains the starting questions; this magazine article develops practical documentation.