Key takeaways
ORI’s 30-second summary
- Transparency duties apply from August 2026: users must know when they talk to an AI and when content is AI-generated.
- The Digital Omnibus pushes most high-risk obligations back — to December 2027 for standalone systems and August 2028 for AI inside regulated products.
- The Act applies to companies that use AI through third-party tools, not only to those that build models.
- Start with an inventory of every AI feature, classify its risk, and build disclosure and human oversight into the product.
If your product has a chatbot, writes text for users, summarises documents or makes recommendations with a model behind it, the EU AI Act very likely applies to you — even if your company is based outside Europe and even if the AI comes from a third-party API.
2026 has been a confusing year for the regulation. Some obligations started in August, while others were pushed back by the so-called Digital Omnibus. This guide sets out what applies now, what has moved, and what product teams should do next.
This article is a practical overview for product and engineering teams, not legal advice. Confirm how the rules apply to your specific product with qualified counsel.
A risk-based law in one paragraph
The Act sorts AI systems by potential harm. A small set of practices is banned outright. High-risk systems — used for things like recruitment, credit scoring, education, critical infrastructure or medical devices — carry heavy obligations around risk management, data governance, documentation and human oversight. Limited-risk systems, such as chatbots and generative tools, mainly carry transparency duties. Everything else is largely unrestricted.
What applies from August 2026
From 2 August 2026, transparency obligations apply. In practice, that means:
- People must be told when they are interacting with an AI system, unless it is obvious from the context.
- AI-generated or manipulated images, audio, video and text published to inform the public must be identifiable as such.
- Deepfakes must be clearly disclosed.
These duties fall on deployers as well as providers. A company that adds a third-party chatbot to its website cannot assume the vendor has handled compliance.
What the Digital Omnibus changed
In May 2026, EU institutions reached a political agreement to delay the high-risk rules, and the European Parliament approved it in June. Under the agreed timeline:
- Standalone high-risk systems (the Annex III list) move from August 2026 to 2 December 2027.
- High-risk AI built into regulated products (Annex I) moves from August 2027 to 2 August 2028.
- A new prohibition covers apps that generate non-consensual intimate imagery.
The delay is breathing room, not an exemption. Building documentation, testing and oversight into a product late is far more expensive than designing for it now.
Five steps for product teams
1. Inventory every AI feature
List each place a model influences what users see or what decisions are made — including vendor tools, plugins and internal workflows. Record the provider, the model, the data it receives and who is affected.
2. Classify the risk
Map each feature to the Act's categories. Most marketing sites and SaaS assistants are limited-risk. Anything that screens candidates, scores people or affects access to essential services needs a closer look.
3. Design disclosure into the interface
Label assistants as AI, mark generated content, and make it easy to reach a human. Good disclosure is clear and calm, not a wall of legal text.
4. Keep a human in the loop where it matters
For consequential decisions, make sure a person can review, override and explain the outcome — and that your logs show who did what.
5. Log, evaluate and document
Keep records of model versions, prompts, evaluation results and incidents. This is good engineering practice anyway, and it becomes the backbone of any future conformity assessment.
What happens if you ignore it
The most serious breaches can draw fines of up to €35 million or 7% of global annual turnover. Just as important for most businesses is the commercial risk: enterprise buyers are already asking AI-compliance questions in procurement, and a clear answer wins deals.
The bottom line
For most digital products the near-term work is manageable: know where you use AI, tell users clearly, and keep good records. Teams that treat these as product requirements rather than paperwork will be ready long before the high-risk deadlines arrive.