AI Act
There are two kinds of reporting about the AI Act. One says everything has been postponed. The other says you risk fines in the millions. Both are only half right.
This page sets out what applies now if you run a company of roughly ten to fifty people that uses AI or builds something with it.
The AI Act is Regulation (EU) 2024/1689 and entered into force on 1 August 2024. Its rules apply in phases.
On 24 July 2026 the Digital Omnibus on AI appeared in the Official Journal as Regulation (EU) 2026/1744, in force since 27 July 2026. That amendment postpones the heavy obligations for high-risk systems. The postponement is law in force, no longer a proposal.
What it did not postpone: the prohibited practices, the AI literacy requirement, the rules for general-purpose AI models, and the transparency obligations that have applied since 2 August 2026.
The dates at a glance
The first three have applied for a while. Transparency is the point that arrived in August 2026 and that raises the most questions.
Employees working with AI have to understand what they are using and what the risks are. There is no prescribed course and no certificate. What counts is being able to show it: who was trained, on what, and when. Enforcement on this point has been possible since August 2026.
A short list of applications that are simply not allowed, including emotion recognition in the workplace and scoring people on social behaviour. For most companies this doesn't come up, but it is worth checking whether a supplier has something like it built into a product. The highest fines sit here: up to 35 million euro or 7 percent of worldwide annual turnover. From 2 December 2026 a further prohibition applies to nudify applications and to AI-generated child sexual abuse material.
Obligations for the providers of the models themselves, such as OpenAI, Anthropic and Google. If you use their models, those obligations sit with them and not with you.
This is the part that is new now. In brief:
Fines up to 15 million euro or 3 percent of worldwide annual turnover
What is often misrepresented: it does not say you have to put a label under every AI-written text. The full explanation is in Do you have to say you used AI?
The obligations for high-risk systems. Think of AI in recruitment, in education, in lending and in critical infrastructure.
Stand-alone high-risk systems (annex III), moved from 2 August 2026.
High-risk AI embedded in regulated products (annex I).
Systems already in use before 2 August 2026 keep their original deadline.
If you don't fall into this category, the postponement isn't about you and nothing changes for you.
None of these points takes a project of months. Point one does take most companies the most effort.
Know which AI is being used in your company and what for.
Make sure the people using it know what they are doing, and record that.
Check where your chatbot, your generated imagery and your publications stand against the transparency rules.
Sort out the data processing agreements with your AI suppliers, because as soon as personal data goes in, the GDPR applies too.
Point one is where most companies come unstuck, not because it is hard but because it is accurate today and no longer accurate in three months. That is what Seeing which AI tools your people actually use is about.
An empty register is easier to finish than a blank page. This template gives you the columns.
AI register template
The fields you need to record your AI systems, as a spreadsheet with one filled-in example row. You get it straight away.
Question not listed? Email hello@noxtrack.com.
This is an explanation, not legal advice.
