What does the EU AI Act ask of your team in 2026?

Orientation from the official texts on EUR-Lex and the Commission's AI Act pages, read 18 Oct 2026. Not legal advice. A deployer is anyone using an AI system “under its authority”, except in a personal, non-professional activity (Article 3(4)).

• The dates (Article 113, as amended by Regulation (EU) 2026/1744). Chapters I and II, with AI literacy and the bans, from 2 Feb 2025. Most of the rest, Article 50 included, from 2 Aug 2026. Two new bans from 2 Dec 2026. High-risk duties for Annex III uses from 2 Dec 2027. Put them on your list.
• AI literacy (Article 4, as replaced in July 2026). Providers and deployers “shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf”. This “does not require” them “to guarantee any specific level of AI literacy of any individual”. The Commission: “There is no need for a certificate.” Train, and keep a record.
• Banned practices (Article 5, since 2 Feb 2025). Among them: inferring people's emotions in the workplace (except for medical or safety reasons), manipulative or deceptive techniques that cause significant harm, social scoring, and biometric categorisation to deduce race, political opinions, union membership, beliefs, sex life or sexual orientation. Check none of your uses is one.
• Say AI made it (Article 50(4), from 2 Aug 2026). Deployers disclose deep fakes they make with AI, and AI text published to inform the public on matters of public interest, unless it had human review or editorial control and someone holds editorial responsibility. Label it.
• High-risk uses at work (Annex III, point 4, and Articles 26 and 111(2), from 2 Dec 2027). AI for recruiting or selecting people, for decisions on promotion or termination, for giving out tasks by behaviour or traits, or for monitoring and evaluating staff. Deployers then use it as instructed, give oversight to people with the competence, training and authority, keep its logs at least six months where they control them, and tell workers' representatives and the workers affected before using it. A system already on the market or in use before 2 Dec 2027 is covered only once its design changes significantly; systems meant for public authorities must comply by 2 Aug 2030. Ask your adviser.

Whether and how the Act applies depends on where you are and what you do. It covers deployers in the EU, and others whose AI output is used there (Article 2). A team that builds an AI system and offers it under its own name may be a provider, with more duties. Check with your own adviser. Not legal advice.