The EU AI Act Explained: What Changes for Businesses and Everyday Users

The EU AI Act is the first broad law anywhere that regulates artificial intelligence by the risk it poses. Most of it now applies, but a 2026 amendment package pushed back the strictest rules. This guide sets out the EU AI Act explained in plain terms: what is already binding, what moved, and what it means if you build, buy or simply use AI.

If you followed the AI Act's progress in 2024, some of what you read is now out of date. The core structure hasn't changed, but in November 2025 the European Commission proposed a "Digital Omnibus" to simplify parts of the law, and EU lawmakers agreed a final version in May 2026. The Commission's AI Act page now reflects the amended dates. This article uses those official dates throughout.

What the AI Act is, in one paragraph

The AI Act, formally Regulation (EU) 2024/1689, sorts AI into four risk levels. According to the European Commission, practices posing unacceptable risk are banned; high-risk systems face strict obligations before they can be sold or used; systems with transparency risk must tell people what they are; and minimal-risk AI, such as spam filters or AI in video games, faces no new rules. Separate rules cover general-purpose AI models, the large models behind chat assistants.

Examples are drawn from the Commission's summary of the Act.

The timeline: what applies, and from when

The Act applies in phases. The table below follows the Commission's AI Act Service Desk timeline, which has been updated for the Digital Omnibus.

The 2027 deadline for older general-purpose models and the 2030 deadline for public-sector systems come from Article 111, which also says that other high-risk systems already in use before their rules apply are only caught if they are significantly redesigned afterwards.

What the Digital Omnibus changed

The Commission proposed the AI Omnibus on 19 November 2025 as part of a wider simplification package. Parliament and Council reached political agreement on 7 May 2026, and the amending law entered into force on 27 July 2026, days before the original August 2026 high-risk deadline. It was published as Regulation (EU) 2026/1744.

The main changes, according to the Commission's announcement and its AI Act policy page:

• Later high-risk deadlines. Annex III uses move to 2 December 2027; AI in regulated products moves to 2 August 2028.
• A new ban. AI systems that generate non-consensual sexually explicit content or child sexual abuse material, including "nudification" apps, are prohibited from December 2026.
• Relief for smaller companies. Simplified requirements for SMEs are extended to "small mid-cap" companies.
• Stronger central oversight. The EU AI Office gains wider powers, including over AI systems built on general-purpose models.
• A softer AI literacy duty. The amending law's recitals say Article 4 should now require providers and deployers to "take measures to support the development of AI literacy of their staff", with the Commission and member states helping. The duty remains; the bar is lower.
• A short grace period for content marking. Providers of generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) duty to mark AI output as machine-detectable.

Two things did not change. Transparency rules for chatbots and deepfakes still applied from August 2026, and the high-risk obligations themselves were deferred, not removed.

The Omnibus bought high-risk providers more time. It didn't make the obligations go away.

Who the law applies to, including outside Europe

The Act isn't limited to European companies. Under Article 2, it covers providers that place AI systems or general-purpose models on the EU market wherever they are based, deployers located in the EU, and providers and deployers in non-EU countries where the AI system's output is used in the EU.

That matters for India. A Bengaluru firm selling an AI hiring tool to a German employer, or an Indian IT services company building a credit-scoring model for a European bank, can fall within scope. India itself has taken a lighter approach so far: guidelines released by MeitY in November 2025 rely mainly on existing laws rather than a dedicated AI statute. Indian businesses with European clients may therefore meet the EU's requirements before any domestic equivalent.

The Act also has clear exclusions. Article 2 says it doesn't apply to AI used exclusively for military, defence or national security, to AI developed solely for scientific research, or to individuals using AI for purely personal, non-professional purposes.

What it means for businesses

The obligations depend on your role. A provider develops an AI system or model and puts it on the market under its own name. A deployer uses an AI system in a professional capacity. Many businesses are deployers of tools they buy, and some are providers of tools they build.

A practical checklist

1. List your AI. Record every AI tool you build, buy or embed, who uses it and for what. Include features inside larger software, such as AI screening in a recruitment platform.
2. Check for banned uses. Make sure nothing you use falls under the prohibited practices, such as emotion recognition of employees. These bans have applied since February 2025.
3. Flag likely high-risk uses. Hiring, worker management, credit decisions, education and access to essential services are the common ones. You have until December 2027 for Annex III systems, but documentation, data governance and human oversight take time to build.
4. Meet transparency duties now. Under Article 50, people must be told when they are talking to an AI system unless it's obvious. Deployers that publish deepfakes must disclose them, as must deployers publishing AI-generated text to inform the public on matters of public interest, unless a human has reviewed it and someone holds editorial responsibility.
5. Train your staff. The AI literacy duty applies to providers and deployers. Short, role-specific training and a written AI-use policy are a sensible baseline.
6. Ask your vendors. If you buy AI tools, ask suppliers how they classify the product under the Act and what documentation they'll give you as a deployer.

What the penalties look like

Member states set the penalties, within limits fixed by Article 99:

For SMEs and start-ups, each fine is capped at whichever of the two figures is lower. Fines for providers of general-purpose AI models are handled separately by the Commission, which has had enforcement powers since 2 August 2026.

If you build on large AI models

Providers of general-purpose AI models must meet transparency and copyright rules, and those whose models pose systemic risk must also assess and mitigate those risks. The Commission backs a voluntary Code of Practice with chapters on transparency, copyright, and safety and security; signing it gives providers a more predictable route to showing compliance. If you build an app on top of someone else's model, you're usually not the model provider, but you may be the provider of your own AI system, with its own duties.

What it means for everyday users

Most people won't read the Act, but they will notice some of its effects.

• You should know when you're talking to a bot. Since August 2026, AI systems that interact with people must make that clear unless it's obvious.
• Deepfakes should be labelled. Deployers who publish realistic AI-generated or manipulated images, audio or video must disclose it. For clearly artistic or satirical work, a lighter disclosure applies.
• AI-generated content should become easier to detect. Providers of generative AI must mark output in a machine-readable way, with the grace period for existing systems ending on 2 December 2026.
• Some uses are off-limits. Your employer or school can't use AI to infer your emotions, except for medical or safety reasons, and no one may use AI for social scoring.
• Stronger protections for decisions about you, such as job applications or loan approvals, arrive when the high-risk rules apply from December 2027.
• Personal use isn't regulated. Using a chat assistant for your own non-professional tasks doesn't make you a "deployer".

The Act sits alongside existing data protection law rather than replacing it. For how privacy rules affect you day to day, see our consumer guide to the new digital privacy acts.

What to watch next

• Guidance and standards. Much of how high-risk rules work in practice will depend on Commission guidelines and harmonised technical standards still being finalised.
• National enforcement. Each member state enforces through its own authorities, so expect differences in pace and priorities.
• 2 December 2026. The nudification ban and the end of the content-marking grace period are the next hard dates.
• Further change. The Act has been amended once already. Check the official timeline before you plan around any date.

The bottom line

The EU AI Act is no longer a future law. Its bans, its rules for large AI models and its transparency duties already apply, and enforcement started in August 2026. What the Digital Omnibus changed is the timing of the high-risk rules, which now land in December 2027 and August 2028.

For businesses, including those in India serving European customers, the sensible move is to inventory your AI now, fix anything near the banned list, meet the transparency rules and start the high-risk paperwork early. For everyday users, the practical change is more honesty: clearer labels on bots and synthetic media, and a short list of uses that are simply not allowed.

Frequently asked questions

Is the EU AI Act in force now?

Yes. It entered into force on 1 August 2024 and most of its rules have applied since 2 August 2026. The high-risk rules apply later: 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products.

Was the AI Act delayed?

Partly. The Digital Omnibus on AI, in force since 27 July 2026, postponed the high-risk obligations by about 16 months for Annex III systems and a year for product-embedded AI. Bans, general-purpose AI rules and most transparency duties were not delayed.

Does the AI Act apply to companies in India?

It can. The Act covers providers placing AI on the EU market wherever they are based, and providers and deployers outside the EU when their system's output is used in the EU. Indian firms with EU clients or users should check their position.

Do I need to label content I make with ChatGPT or similar tools?

Private, personal use is outside the Act. In a professional setting, deployers must disclose deepfakes, and must disclose AI-generated text published to inform the public on matters of public interest unless it has been human-reviewed under someone's editorial responsibility. Other national rules or platform policies may also apply.

What is the AI literacy requirement?

Article 4 requires providers and deployers to take measures on the AI literacy of their staff. After the Omnibus, the duty is framed as supporting the development of AI literacy rather than ensuring a set level, but it still applies.

Sources

1. Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex, Official Journal of the European Union, 2024.
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex, Official Journal of the European Union, 2026.
3. AI Act | Shaping Europe's digital future, European Commission, 2026.
4. Timeline for the Implementation of the EU AI Act, AI Act Service Desk, European Commission, 2026.
5. Article 111: AI systems already placed on the market or put into service and general-purpose AI models already placed on the market, AI Act Service Desk, European Commission, 2026.
6. EU agrees to simplify AI rules to boost innovation and ban 'nudification' apps to protect citizens, European Commission, 2026.
7. Questions and answers on the code of practice for General-Purpose AI, European Commission, 2026.
8. Digital Omnibus on AI, AI Act Explorer (artificialintelligenceact.eu), 2026.
9. Article 2: Scope, AI Act Explorer (artificialintelligenceact.eu), 2024.
10. Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems, AI Act Explorer (artificialintelligenceact.eu), 2024.
11. Article 99: Penalties, AI Act Explorer (artificialintelligenceact.eu), 2024.
12. MeitY Unveils India AI Governance Guidelines, S.S. Rana & Co., 2025.