The EU AI Act in 2026: what companies actually need to do

As an AI studio based in Portugal, we build AI products, so the EU AI Act is our problem as much as yours. This is how we read it, as a Portuguese company writing for other companies that are adopting AI.

If you run AI inside a European company, you saw the headline this summer: the EU delayed the AI Act. Plenty of teams read it, crossed 2 August 2026 off the calendar and moved the compliance project into next year's budget.

That was the wrong date to cross off. The delay is real, but it covers one part of the law. Other parts were already in force, one started applying on that same 2 August, and the next deadline lands on 2 December 2026.

What was actually delayed

The headline is true for high-risk AI systems. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It moved two dates.

High-risk category	Original date	New date
Stand-alone systems listed in Annex III, such as recruitment, credit scoring, education and access to essential services	2 August 2026	2 December 2027
AI built into regulated products under Annex I, such as medical devices, machinery and vehicles	2 August 2027	2 August 2028

These are the heaviest obligations in the Act: risk management, data governance, technical documentation, logging, human oversight and conformity assessment. If you build or use a stand-alone system in one of those categories, you gained 16 months. Member states also got an extra year, until 2 August 2027, to open their regulatory sandboxes.

So the people who say "it was delayed" are right about the part of the law that costs the most to comply with.

What was not

Take the support chatbot on your website. Since 2 August 2026 it has to tell people they are talking to an AI, unless that is obvious from the context. That rule comes from Article 50 of the Act, and it was not delayed.

Article 50 is the part most companies missed, because it applies to ordinary products. Its transparency duties cover four situations:

AI that talks to people. Chatbots, voice assistants and agents must disclose that they are AI.
Deepfakes. If you publish AI-generated or manipulated image, audio or video, you have to say so.
AI-written text on matters of public interest. It must be disclosed, unless a human reviewed it and someone holds editorial responsibility.
Emotion recognition and biometric categorisation. The people exposed to these systems must be informed.

Three older sets of rules also stayed in place:

Prohibited practices, since 2 February 2025. Social scoring, manipulative techniques and emotion recognition at work or in schools are banned.
AI literacy, since 2 February 2025. The Omnibus softened the wording. You no longer have to ensure a "sufficient level" of literacy, but you must take measures to support it among the staff who operate AI systems.
General-purpose AI models, since 2 August 2025. These duties fall on the companies that build the models, not on the companies that use them.

Then comes 2 December 2026. Providers of generative AI systems that were already on the market before August have until that day to add machine-readable marking to what their systems produce. On the same day, a new prohibition starts to apply to systems that generate non-consensual intimate imagery.

Breaking Article 50 can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher.

What this looks like from Portugal

From here, we see three things that a generic EU guide leaves out.

The regulator to watch is ANACOM. The government chose the communications regulator in September 2025 as market surveillance authority and single point of contact. Regulated financial firms answer to their own supervisor instead: Banco de Portugal, ASF or CMVM.

The national rules are not finished. As of late September 2026, Portugal had not published a national implementing law or its own penalty regime, and there is no AI regulatory sandbox open yet. The deadline for the sandbox is now 2 August 2027. None of this pauses your obligations, because the Act is an EU regulation and applies directly.

The fine ceilings are lower for most of us. Most Portuguese companies are SMEs. For SMEs and startups, the Act caps each fine at the lower of the two amounts instead of the higher. That is still a number no small company wants to test.

Why waiting is the expensive option

December 2027 sounds far away. It is 14 months from now, and we see three things that make it shorter than it looks for a company adopting AI.

High-risk duties reach the companies that use the system, too. If you use AI to screen CVs or score credit, you will have to assign trained people to oversee it, keep its logs and tell the people affected. Those are changes to how a team works, and they take longer than installing the tool.

The contracts are being signed now. The tools you buy this year will still be in use in December 2027. If a vendor cannot tell you today how it will meet the high-risk rules, you will be renegotiating or replacing it under deadline.

The extra time only helps if you know where you stand. Whether the delay applies to you depends on which category each of your tools falls into. You cannot answer that without a list of the AI systems you run, and that list rarely exists.

[To add: one LayerX example. For instance, how we built our own list of AI systems, or what clients already ask us about the AI Act.]

What to do before the end of the year

Start with a list. Everything else depends on it.

List every AI tool your company uses. Include the ones nobody approved: the vendor chatbot, the CV screening feature inside your HR software, the assistants your teams adopted on their own.
Check each one against three lists. The prohibited practices, the high-risk categories in Annex III, and Article 50. For most tools you are the deployer, the company using the system. You only become the provider if you put a system on the market under your own name.
Fix transparency now. These rules already apply. Check that your chatbots and voice agents tell people they are AI, and ask the vendor to fix it if they do not. Labelling the deepfakes and AI-written public-interest content you publish is your own duty.
Put three questions to your vendors in writing. Which category is the system in? Will its outputs carry machine-readable marking by 2 December 2026? What documentation will you give us for the high-risk rules?
Train your people and keep the records. The literacy duty is lighter than it was, but you still need to show what you did.
Give it an owner. One named person who keeps the list current and gets a call whenever a team adopts a new tool.

Use the extra time

The Omnibus gave companies 16 more months for the hardest part of the AI Act. It did not give them a reason to wait. The transparency rules apply today and the next deadline is 2 December 2026. The companies that will find December 2027 easy are the ones that write their list this month.

If you are bringing AI into your company and want these requirements built in from the start, talk to us at LayerX.

This article is general information, not legal advice. Check your own case with a lawyer.