The EU AI Act became applicable on 2 August 2026, and the argument about whether it would arrive on time is over. What the Act asks of a business from here depends on which duty you look at. Six days before that date, on 27 July, the amending regulation known as the AI Omnibus entered into force and moved the heaviest obligations years into the future. We wrote about the approaching deadline in The EU AI Act deadline that touches UK firms. What has changed since is that the dates are fixed and the enforcement machinery is running.
What binds a business today, and what moved
The rules that arrived on 2 August are the transparency duties, and they are the ones most businesses will meet. A person dealing with a chatbot has to be told they are dealing with a machine. Providers of generative AI have to make AI-generated output identifiable, and deepfakes and text published to inform the public on matters of public interest have to be labelled clearly and visibly. From the same date the European AI Office and the authorities in each member state took over implementation, supervision and enforcement.
The Omnibus moved the rules for high-risk systems. Anything standing alone in a sensitive area, meaning biometrics, critical infrastructure, education, employment, migration, asylum and border control, now applies from 2 December 2027. Anything built into a regulated product, from lifts to toys, follows on 2 August 2028. The Omnibus also added a ninth prohibited practice, covering systems that generate non-consensual sexually explicit material or child sexual abuse material, which bites from December 2026. Earlier stages already stand, with the bans and the AI literacy duty live since February 2025 and the rules on general-purpose models since August 2025.
Why a British business is still caught
The Act reaches providers and deployers established outside the Union where the output of the system is used inside it. A Manchester company whose website chatbot answers a customer in Dublin is inside that test, and so is a business generating marketing copy for a European market. Leaving the EU removed the automatic application of its law to your trade, and it did not remove the effect of selling into a market that regulates the tools you sell with.
The exposure is set out in Article 99. Breach the prohibitions and the ceiling is 35 million euros or seven percent of total worldwide annual turnover. Breach most other duties, transparency among them, and the ceiling is 15 million euros or three percent. Give a regulator misleading information and it is 7.5 million euros or one percent. Small and medium enterprises, including start-ups, face whichever of the amount and the percentage is lower, which softens the figure without removing the duty.
What it puts on a law firm's desk
Your firm sits on both sides of this. As a business you deploy AI in client-facing chat, in marketing copy and, before long, in recruitment sifting. The transparency duties apply to your own use wherever your output reaches the Union, and the recruitment question arrives in December 2027 rather than going away. Write down where AI touches anyone outside your office, add a line of disclosure where a person meets a machine, and label generated material.
The larger point is commercial. Your SME clients read the same headlines about delay and take from them that nothing is due, which is wrong on transparency and on the prohibitions. An employment client running automated sifting has fifteen months to build a compliance file that takes months to assemble honestly. A manufacturer with AI in a product has two years and a conformity assessment ahead of it. Those are instructions waiting to be taken, and they go to whichever adviser raises the subject first. For a client established in the Union the message hardens, because the Act binds it directly and the extra time buys the conformity file rather than relief on transparency.
Put two dates in the diary and tell your clients to do the same. December 2027 for anything touching employment, credit, education or biometrics. August 2028 for AI inside a regulated product. Then work backwards, because the paperwork the Act demands, being risk assessment, data quality, logging, documentation and human oversight, is built over quarters rather than assembled in the last fortnight.
The application timeline, the amendments made by the AI Omnibus and the transparency duties are set out by the European Commission on its regulatory framework for AI page, which is free to read and links to the final text of the amending regulation.
If EU trade touches your firm or your clients, working out what the Act asks and in what order is the sort of work we do before anyone spends: talk it through with us.