The EU AI Act for a normal company

Since 2 August 2026 most of the EU AI Act applies. For the large group of companies that simply use AI, in a chatbot on the website, in generated images for a campaign or in an assistant on every desk, the question is simpler: which duties are ours, and from when.

This is where things stand after this summer's amendments. It is an overview, not legal advice.

What has applied since 2025

The act entered into force on 1 August 2024 and arrives in stages. Since 2 February 2025 eight practices have been prohibited outright. Among them are harmful manipulation and deception, exploiting people's vulnerabilities, social scoring, emotion recognition at work and in education, untargeted scraping of faces for recognition databases, and biometric categorisation that deduces protected characteristics. A ninth prohibition, on systems that generate sexual content without consent or child sexual abuse material, applies from 2 December 2026. Few ordinary companies come near these. Emotion recognition in a call centre or an interview tool would.

The same date brought the duty of AI literacy. It applies to providers and to every company that uses an AI system at work. The omnibus softened the wording this summer: companies must now take measures to support the development of AI literacy, and the text says they do not have to guarantee a specific level for any individual. The duty itself remains.

Since 2 August 2025 the providers of general purpose AI models carry their own duties: technical documentation, information for the companies that build on their models, a policy to comply with EU copyright law and a public summary of the content used for training. These fall on the model makers, not on their customers. A company that fine tunes a model becomes the provider of a new model only in exceptional cases. The Commission's indicative threshold is a modification that uses more than a third of the compute of the original training.

What applies since August

The transparency rules arrived with the rest of the act on 2 August 2026, and they are the ones most companies meet. People must be told when they are interacting with a machine, such as a chatbot. Providers of generative AI must mark what their systems produce in a machine readable way, so it can be detected as generated. Deployers must label deepfakes: images, audio or video that resemble real people, objects, places or events and would falsely appear authentic. Text published to inform the public on matters of public interest must be disclosed too, unless a person has reviewed it and someone carries editorial responsibility.

The Commission published a voluntary code of practice on marking and labelling on 10 June 2026, with a set of EU icons for labels. By the end of July about 190 organisations had signed it. Providers of generative systems that were on the market before 2 August 2026 have until 2 December 2026 to add the marking.

Enforcement started on the same day, by national authorities and the Commission's AI Office. Fines reach 35 million euros or 7 percent of worldwide turnover for prohibited practices, and 15 million euros or 3 percent for breaches by model providers.

What the omnibus moved

The largest change of the year is Regulation (EU) 2026/1744, the digital omnibus on AI. The Commission proposed it on 19 November 2025, Parliament and the member states reached a political agreement on 7 May 2026, and it entered into force on 27 July 2026.

It moves the rules for high risk systems. Systems used in the sensitive areas listed in Annex III, such as CV sorting, credit scoring, education, biometrics and migration, now face their obligations from 2 December 2027 instead of 2 August 2026. High risk AI built into products that EU product law already regulates follows on 2 August 2028.

It also extends relief from small companies to small mid caps, defined as companies with fewer than 750 employees and a turnover of up to 150 million euros. They may use the simplified technical documentation and a proportionate quality management system.

For a company that uses AI rather than builds it, the delay changes little. The literacy duty and the transparency duties apply now. The extra time matters for the narrower group whose systems decide about people: who is hired and who gets credit.

Swiss companies selling into the EU

The act is EU law, but its reach follows the market. It applies to providers that place AI systems or general purpose models on the EU market, whether they are established in the Union or in a third country, and to providers and deployers in third countries whose systems produce output that is used in the Union. A provider of a high risk system from outside the EU must appoint an authorised representative there, in writing, before it sells.

In practice, a Swiss company with a chatbot on the German version of its website, or a campaign with generated images aimed at buyers in France, should treat the transparency duties as its own.

At home, Switzerland goes its own way. There is no AI act. On 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI convention and to change the law by sector where possible, and a consultation draft is due by the end of 2026. Until then the data protection act applies directly to AI, and the FDPIC expects much of the same: people have a right to know whether they are speaking or writing with a machine, and manipulated faces, images or voices of identifiable people must always be clearly marked.

A short checklist

List every AI system in use: who provides it, who uses it, what it decides and which markets its output reaches.

Check it against the prohibitions, with emotion recognition of staff or applicants first.

Say when people talk to a machine: in the chat window, on the phone, in the email an agent wrote.

Label generated images and video that look real, and keep the originals and the prompts behind them.

Train the people who use AI, write down what they learned, and repeat it when the tools change.

Mark the systems that decide about people, in hiring, credit or education, and use the time until December 2027 to prepare them.

Ask your providers in writing how they meet their own duties: marking, documentation, copyright policy. Then name one person who owns the list.

Where people stay in charge

At its core the act is a rule about responsibility. A machine may draft, sort and propose, while a named person answers for what goes out. That is a good rule for reasons that have nothing to do with fines: judgement and accountability are what a client relies on, and they do not automate.

Our products are built along the same line. Twin gives each role only the part of the company brain it needs, with approvals by role and every step logged. Reel keeps every image and clip in a media library with every version and the recipe behind it, and a person picks every image that is used, so a question about origin can be answered from the record. Eigna, built by our partner Eigna Labs, is a private model that runs in a company's own cloud or on its own servers, designed for the GDPR and the EU AI Act.

The dates will keep moving. A company that knows which AI it uses, and who answers for it, can move with them.