Since August 2, 2026 the transparency obligations of the AI Act (Regulation (EU) 2024/1689) apply: a chatbot has to disclose that it is an AI, and synthetic content has to be marked. The high-risk obligations, which were due to start on the same day, have been pushed back: the Digital Omnibus package, adopted in July 2026, moves them to December 2, 2027 for Annex III systems. If your company has a customer service chatbot, a scoring system, an AI-powered CV filter or any automation built on language models, this regulation affects you.
In this guide we explain exactly what the AI Act requires, what obligations you have depending on your use case, and how to prepare your software to comply without slowing down innovation. It is the natural continuation of what we covered in how to build an AI agent and AI agents for business, now from the compliance angle.
What the AI Act is and why it matters now
The AI Act is the world’s first comprehensive artificial intelligence regulation. It was published in July 2024, entered into force on August 1, 2024, and applies in stages. It does not regulate the technology itself, but its uses: it classifies AI systems according to the risk they pose to health, safety and fundamental rights, and assigns obligations proportional to that risk.
It affects any company that markets, deploys or uses AI systems in the European Union, regardless of where it is established. A Madrid startup using the API of an American model is within the scope of application just as much as the model’s provider.
Application timeline: where we stand in 2026
| Date | What becomes applicable |
|---|---|
| February 2, 2025 | Prohibition of unacceptable-risk practices and AI literacy (Art. 4) |
| August 2, 2025 | Obligations for general-purpose AI models (GPAI), governance and penalties |
| August 2, 2026 | Transparency obligations (Art. 50): chatbots, synthetic content, deepfakes |
| December 2, 2026 | End of the transition period for machine-readable marking in generative systems already on the market |
| August 2, 2027 | General-purpose AI (GPAI) models placed on the market before August 2025 |
| December 2, 2027 | High-risk systems under Annex III (employment, credit, education, essential services…) |
| August 2, 2028 | High-risk AI embedded in regulated products (Annex I) |
Update (October 2026). When we published this guide, the high-risk delay was a Commission proposal. It no longer is: the Digital Omnibus on AI was adopted in July 2026 and moved Annex III from August 2026 to December 2027, and Annex I from August 2027 to August 2028. The obligations themselves are unchanged; only the dates moved. The Article 50 transparency rules, which already apply, and the prohibitions stayed where they were. The Omnibus also softened Article 4: a company has to take measures so its staff understand the AI they use, but it is no longer required to guarantee a specific level of knowledge.
The four risk levels
1. Unacceptable risk (prohibited since February 2025). Subliminal manipulation, social scoring in the style of social credit, emotion recognition in the workplace and education, indiscriminate scraping of facial images for recognition databases. If your software does any of this, there is no obligation to comply with: it has to be removed.
2. High risk (Annex III from December 2027). Annex III systems: recruitment, credit assessment, access to essential services, education, critical infrastructure, biometrics. Full obligations: risk management system, data governance, technical documentation, record-keeping (logs), human oversight, robustness and cybersecurity, conformity assessment and registration in the European database.
3. Limited risk (transparency). Chatbots, synthetic content generation, deepfakes. The main obligation is to inform: the user must know they are interacting with an AI, and artificially generated content must be marked as such.
4. Minimal risk. Spam filters, product recommenders, predictive maintenance. No specific obligations, although voluntary codes of conduct are recommended.
What this means if you use AI in your software (real cases)
Most of the companies we work with do not train models: they integrate existing models via API. The AI Act distinguishes between the provider (who develops or markets the system) and the deployer (who uses it under its own authority). Your obligations depend on your role and your use case:
Customer service chatbot
Limited risk. You must clearly inform users that they are talking to an AI (unless it is obvious from context), have a reasonable escalation mechanism to a human, and train the team operating it. If you built the chatbot on top of a third-party LLM, as we explain in how to build an AI agent for customer service, the model provider has its own GPAI obligations, but transparency towards your customer is your responsibility.
CV filtering or candidate assessment
High risk (Annex III, point 4). Here the obligations are serious: effective human oversight (the AI cannot reject candidates without review), operational logs, representative and unbiased training data, and information for candidates. If you buy this functionality from a SaaS vendor, you still have obligations as a deployer: use the system according to the instructions, guarantee human oversight and retain the logs.
Credit or insurance scoring
High risk. Same obligations as the previous case. In addition, the customer affected by a decision has the right to an explanation of the system’s logic.
Content generation (marketing, reports, images)
Limited risk. Synthetic content must be identifiable as such (machine-readable marking where technically feasible). For internal use without publication, the obligations are minimal.
Internal process automation with LLMs
Minimal risk in general, unless the process affects decisions about people (payroll no, promotions yes). The cross-cutting obligation that has been in force since February 2025 is AI literacy: you have to take measures so your team understands the capabilities and limits of the systems they use.
Compliance checklist
- Inventory: list all AI systems in use, including third-party SaaS with AI features (CRM with scoring, ATS with candidate ranking…). It is the step almost nobody has done and the one that brings the most surprises.
- Classification: assign each system its risk level. Most will fall under minimal or limited; identify the few high-risk ones.
- Roles: determine whether you are the provider or the deployer of each system. Watch out for fine-tuning and white-labelling: marketing a high-risk system under your own brand turns you into a provider.
- Transparency: check that your chatbots identify themselves as AI and that generated content is marked where applicable.
- Human oversight: in systems that affect people, document who reviews what and with what real capacity to intervene. If people approve 99% of what the system proposes, measure whether they are actually reviewing it.
- Documentation and logs: enable event logging in your AI systems and document design decisions. For high risk it is mandatory; for everything else, it is your best defence.
- Training: comply with Article 4 through practical team training (what the AI they use can and cannot do, how to spot errors and hallucinations).
- Vendor contracts: ask your AI vendors for their conformity documentation. Serious GPAI providers (OpenAI, Anthropic, Google) publish AI Act-specific documentation.
Penalties: what is at stake
- Up to €35M or 7% of global turnover for prohibited practices.
- Up to €15M or 3% for breaching high-risk system or transparency obligations.
- Up to €7.5M or 1% for supplying incorrect information to the authorities.
In Spain the market surveillance authority is AESIA (the Spanish Agency for the Supervision of Artificial Intelligence), and there is a regulatory sandbox for testing high-risk systems in a controlled environment before bringing them to market.
Compliance by design: the advantage of building well from the start
The most common mistake we see is treating the AI Act as a legal formality that gets resolved with a document. In practice, compliance is decided in the software architecture:
- Traceability: logging prompts, responses and model decisions from day one costs little; retrofitting it onto a system in production is a project in itself.
- Human-in-the-loop: designing flows so that the AI proposes and a person decides (in the cases that require it) is a product decision, not a patch.
- Continuous evaluation: quality and bias tests on the model’s outputs (evals) are the technical evidence that your system does what you say it does.
- Model decoupling: if your architecture allows you to switch model providers, you can react if a provider fails to meet its GPAI obligations.
At Soamee we build AI agents and systems for business with these principles built in from the design stage, and we run responsible AI audits on systems that are already live. If you are integrating AI into your product or automating processes and want to do it in compliance with the AI Act without slowing down development, let’s talk.
Conclusion
The AI Act does not prohibit using AI in your company: it regulates how to use it responsibly. For the vast majority of use cases (chatbots, content generation, internal automation) the obligations are manageable: transparency, training and documented common sense. High-risk systems demand more, but they are an identifiable minority once you have a well-made inventory.
Transparency has applied since August 2026. For high risk there are a little over fourteen months left, which is a short deadline if you have to add traceability and human oversight to a system that is already in production. The practices the regulation requires (traceability, oversight, evaluation) are the same ones that make an AI system work well in production.