August 2, 2026 is the date that marks a before and after for any European company using artificial intelligence in its software: the bulk of the AI Act (Regulation (EU) 2024/1689) becomes applicable, including the obligations for high-risk systems under Annex III and the transparency obligations. If your company has a customer service chatbot, a scoring system, an AI-powered CV filter or any automation built on language models, this regulation affects you.
In this guide we explain exactly what the AI Act requires, what obligations you have depending on your use case, and how to prepare your software to comply without slowing down innovation. It is the natural continuation of what we covered in how to build an AI agent and AI agents for business, now from the compliance angle.
What the AI Act is and why it matters now
The AI Act is the world’s first comprehensive artificial intelligence regulation. It was published in July 2024, entered into force on August 1, 2024, and applies in stages. It does not regulate the technology itself, but its uses: it classifies AI systems according to the risk they pose to health, safety and fundamental rights, and assigns obligations proportional to that risk.
It affects any company that markets, deploys or uses AI systems in the European Union, regardless of where it is established. A Madrid startup using the API of an American model is within the scope of application just as much as the model’s provider.
Application timeline: where we stand in 2026
| Date | What becomes applicable |
|---|---|
| February 2, 2025 | Prohibition of unacceptable-risk practices and the AI literacy obligation (Art. 4) |
| August 2, 2025 | Obligations for general-purpose AI models (GPAI), governance and penalties |
| August 2, 2026 | General application: high-risk systems under Annex III and transparency obligations (Art. 50) |
| August 2, 2027 | High-risk AI embedded in regulated products (Annex I) and GPAI models placed on the market before August 2025 |
One important nuance: at the end of 2025 the European Commission proposed, as part of the “Digital Omnibus” package, delaying part of the high-risk obligations. Until that proposal is formally adopted, the timeline in force is the one in the table. Our advice is not to plan your compliance counting on a postponement: the transparency obligations and the prohibitions are already in force, and adapting a system after the fact is always more expensive than designing it well from the start.
The four risk levels
1. Unacceptable risk (prohibited since February 2025). Subliminal manipulation, social scoring in the style of social credit, emotion recognition in the workplace and education, indiscriminate scraping of facial images for recognition databases. If your software does any of this, there is no obligation to comply with: it has to be removed.
2. High risk. Annex III systems: recruitment, credit assessment, access to essential services, education, critical infrastructure, biometrics. Full obligations: risk management system, data governance, technical documentation, record-keeping (logs), human oversight, robustness and cybersecurity, conformity assessment and registration in the European database.
3. Limited risk (transparency). Chatbots, synthetic content generation, deepfakes. The main obligation is to inform: the user must know they are interacting with an AI, and artificially generated content must be marked as such.
4. Minimal risk. Spam filters, product recommenders, predictive maintenance. No specific obligations, although voluntary codes of conduct are recommended.
What this means if you use AI in your software (real cases)
Most of the companies we work with do not train models: they integrate existing models via API. The AI Act distinguishes between the provider (who develops or markets the system) and the deployer (who uses it under its own authority). Your obligations depend on your role and your use case:
Customer service chatbot
Limited risk. You must clearly inform users that they are talking to an AI (unless it is obvious from context), have a reasonable escalation mechanism to a human, and train the team operating it. If you built the chatbot on top of a third-party LLM, as we explain in how to build an AI agent for customer service, the model provider has its own GPAI obligations, but transparency towards your customer is your responsibility.
CV filtering or candidate assessment
High risk (Annex III, point 4). Here the obligations are serious: effective human oversight (the AI cannot reject candidates without review), operational logs, representative and unbiased training data, and information for candidates. If you buy this functionality from a SaaS vendor, you still have obligations as a deployer: use the system according to the instructions, guarantee human oversight and retain the logs.
Credit or insurance scoring
High risk. Same obligations as the previous case. In addition, the customer affected by a decision has the right to an explanation of the system’s logic.
Content generation (marketing, reports, images)
Limited risk. Synthetic content must be identifiable as such (machine-readable marking where technically feasible). For internal use without publication, the obligations are minimal.
Internal process automation with LLMs
Minimal risk in general, unless the process affects decisions about people (payroll no, promotions yes). The cross-cutting obligation that has been in force since February 2025 is AI literacy: your team must understand the capabilities and limits of the systems they use.
Compliance checklist for 2026
- Inventory: list all AI systems in use, including third-party SaaS with AI features (CRM with scoring, ATS with candidate ranking…). It is the step almost nobody has done and the one that brings the most surprises.
- Classification: assign each system its risk level. Most will fall under minimal or limited; identify the few high-risk ones.
- Roles: determine whether you are the provider or the deployer of each system. Watch out for fine-tuning and white-labelling: marketing a high-risk system under your own brand turns you into a provider.
- Transparency: check that your chatbots identify themselves as AI and that generated content is marked where applicable.
- Human oversight: in systems that affect people, document who reviews what and with what real capacity to intervene.
- Documentation and logs: enable event logging in your AI systems and document design decisions. For high risk it is mandatory; for everything else, it is your best defence.
- Training: comply with Article 4 through practical team training (what the AI they use can and cannot do, how to spot errors and hallucinations).
- Vendor contracts: ask your AI vendors for their conformity documentation. Serious GPAI providers (OpenAI, Anthropic, Google) publish AI Act-specific documentation.
Penalties: what is at stake
- Up to €35M or 7% of global turnover for prohibited practices.
- Up to €15M or 3% for breaching high-risk system or transparency obligations.
- Up to €7.5M or 1% for supplying incorrect information to the authorities.
In Spain the market surveillance authority is AESIA (the Spanish Agency for the Supervision of Artificial Intelligence), and there is a regulatory sandbox for testing high-risk systems in a controlled environment before bringing them to market.
Compliance by design: the advantage of building well from the start
The most common mistake we see is treating the AI Act as a legal formality that gets resolved with a document. In practice, compliance is decided in the software architecture:
- Traceability: logging prompts, responses and model decisions from day one costs little; retrofitting it onto a system in production is a project in itself.
- Human-in-the-loop: designing flows so that the AI proposes and a person decides (in the cases that require it) is a product decision, not a patch.
- Continuous evaluation: quality and bias tests on the model’s outputs (evals) are the technical evidence that your system does what you say it does.
- Model decoupling: if your architecture allows you to switch model providers, you can react if a provider fails to meet its GPAI obligations.
At Soamee we build AI agents and systems for business with these principles built in from the design stage. If you are integrating AI into your product or automating processes and want to do it in compliance with the AI Act without slowing down development, let’s talk.
Conclusion
The AI Act does not prohibit using AI in your company: it regulates how to use it responsibly. For the vast majority of use cases (chatbots, content generation, internal automation) the obligations are manageable: transparency, training and documented common sense. High-risk systems demand more, but they are an identifiable minority once you have a well-made inventory.
August 2026 is not the time to start thinking about it: it is the date by which you should already be compliant. The good news is that the practices the regulation requires (traceability, oversight, evaluation) are the same ones that make an AI system work well in production.