The EU AI Act reaches a major enforcement date on 2 August 2026. The official timeline says most of the Act’s rules come into force that day, and enforcement starts at national and EU level. Rules on transparency begin to apply, as do the rules for the AI uses the Act lists as high risk. For companies that use AI with customers or in decisions about people, that date is an operating deadline.
Its text covers companies that bring AI systems to the EU market and companies that use AI systems in the EU. It also covers companies outside the EU when what their AI system produces is used in the Union.
A customer chatbot, a credit-scoring tool and a system that screens job applicants carry different levels of risk. Customer-facing AI can create a duty to tell people they are dealing with an AI system. AI that helps decide on credit or employment sits close to the Act’s high-risk list, which includes employment and access to essential services. Such systems can affect loans, jobs, promotion, assessment or termination.
The penalties make weak oversight expensive. The highest fines, for AI practices the Act bans outright, can reach €35 million or 7% of total worldwide annual turnover. Other breaches can still reach €15 million or 3% of turnover. Systems nobody has written down can create that risk before the company has agreed who owns them.
That makes the first task a list. A useful one shows where each AI system is used, what it does, who owns it and whether it affects a customer, worker, applicant, borrower or other person. It also records what evidence exists if a regulator asks. Legal teams can explain the rules, but they cannot see every AI tool inside customer service, HR, credit, marketing, product, procurement and operations. A policy document without that list gives false comfort.
Over half of organisations lack an organised record of their AI systems, according to a Cloud Security Alliance research note. They cannot classify systems they have not listed, and they cannot prove oversight of tools that came in through vendors, pilots, local teams or quiet product updates.
