Updated on 27 October 2026. The AI Act, or Regulation (EU) 2024/1689, is the European regulation that governs artificial intelligence according to a risk-based logic. Under its Article 2(1), it applies to providers that place an AI system on the market or put it into service in the Union, to deployers established or located in the Union, and to providers and deployers in a third country where the output of their system is used in the Union.
The postponement of high-risk rules is not a general pause. We recommend that every company that uses AI be able to show, starting now, three things: documented AI literacy measures, an identified role for each system together with the transparency obligations that follow from it, and the absence of prohibited practices.
Our reading, as of 27 October 2026: for a company that uses AI, Regulation (EU) 2026/1744 mainly postpones the high-risk rules, to 2 December 2027 and 2 August 2028. Systems placed on the market or put into service before those dates benefit from a grace period, except systems intended to be used by public authorities, which must be compliant by 2 August 2030 at the latest. For a private operator, this grace period has no end date as long as the design remains unchanged. The regulation keeps the general date of 2 August 2026, adds two prohibitions on 2 December 2026, and gives providers of generative systems placed on the market before 2 August 2026 until 2 December 2026 to mark their outputs. Article 4 is softened, not removed: providers and deployers must still take AI literacy measures.
Who this is for. Executives, HR leaders, compliance officers and managers. You will know what applies today, who owes what, what you risk and which evidence to keep. Out of scope: the specific obligations of providers of general-purpose AI models.
What did Regulation (EU) 2026/1744 change in the AI Act?
Regulation (EU) 2026/1744, known as the "Digital Omnibus on AI", amended 36 articles of Regulation (EU) 2024/1689, inserted 6, amended 2 annexes and added one; for a company that uses AI, its main effect remains the postponement of the high-risk rules. Adopted by the Council on 29 June 2026 and signed on 8 July 2026, it has been in force since 27 July 2026.
How many articles changed? Our count
On 22 October 2026, we compared by script the
original version of Regulation (EU) 2024/1689 with its
consolidated version of 27 July 2026: split by article and annex (126 units in the original text), typographic normalisation, comparison, then cross-checking against the markers of amended passages in the consolidated text. Result: 36 articles amended, 6 inserted (4a, 60a and 75a to 75d), annexes I and VIII amended, annex XIV added, no unit deleted; the count matches that of Article 1 of the amending regulation. A quick reading speaks of a few dates moved. The count shows something else: a revision of 36 articles.
Two limits: the count says where the text changed, not what the change means; and the consolidated text is "meant purely as a documentation tool", only the Official Journal is authentic.
| Provision | What changes for a company | Useful date |
|---|
| Article 4, AI literacy | Replaced: "support the development" instead of "ensure" a sufficient level | 27 July 2026 |
| Article 4a, inserted | Option, not an obligation, to process special categories of personal data exceptionally to detect and correct bias, under conditions; also open to deployers | In force since 27 July 2026 |
| Article 5, prohibited practices | Two prohibitions added | 2 December 2026 |
| Article 27, paragraphs 4 and 5 | Fundamental rights impact assessment (deployer of a credit scoring system, in particular): the AI Office questionnaire template already existed; what is new is the possible cross-references to the GDPR impact assessment | 2 December 2027, with the Annex III high-risk rules |
| Article 50, paragraph 7, and Article 111, paragraph 4 | Codes of practice on marking; marking deadline for generative systems placed on the market before 2 August 2026 | Paragraph 7: 2 August 2026; Article 111, paragraph 4: 2 December 2026 |
| Article 99, penalties | Paragraph 1 rewritten: administrative fines named, "any infringement"; the lower cap extended to small mid-cap enterprises; obligations of Article 25, paragraphs 2 and 4, added to the list in paragraph 4 | Under national law |
| Articles 75a to 75d, inserted | Powers of the AI Office over certain systems, including fines | Enforcement from 2 August 2026, according to the Commission |
| Articles 113 and 111, paragraph 2 | High-risk rules postponed; systems already on the market or in service: covered only in case of significant changes in design from that date; public authorities: 2 August 2030 at the latest | 2 December 2027 and 2 August 2028; 2 August 2030 |
What has Article 4 said since 27 July 2026?
Article 4 still requires providers and deployers to take measures; they must now support the development of AI literacy, no longer ensure a sufficient level of it. Our reading: an obligation of means, not of result.
AI literacy (maîtrise de l'IA in the French text of the regulation) means, according to Article 3, point 56, in essence, the skills, knowledge and understanding that allow providers, deployers and affected persons to deploy AI systems in an informed manner and to become aware of the opportunities and risks of AI and of the harm it can cause.
| | Original version, applicable since 2 February 2025 | Version in force since 27 July 2026 |
|---|
| The obligation | "take measures to ensure, to their best extent, a sufficient level of AI literacy" | "take measures to support the development of AI literacy" |
| Individual level | Not specified | "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." |
| People and criteria | Staff and other persons acting on the company's behalf; knowledge, experience, training, context, affected persons | Unchanged |
| Public authorities | No dedicated paragraph | The Commission and the Member States "support and facilitate" efforts, in particular by SMEs, and the Commission publishes practical examples; the AI Board adopts recommendations |
Recital (8) of Regulation (EU) 2026/1744 explains this: a strict obligation "would not be suitable for all types of providers and deployers", whereas AI literacy "should be a strategic priority".
The Commission sets out its reading in its FAQ "AI Literacy – Questions & Answers", updated on 20 October 2026: no one-size-fits-all solution and no mandatory training; in many cases, relying solely on instructions for use might be ineffective. No certificate is needed, an internal record of training and other initiatives may be kept, and no "AI officer" is required.
What applies today under the AI Act, and what is coming?
As of 27 October 2026, the general date of application, 2 August 2026, has passed; the high-risk rules and the other deadlines in the table are still to come.
| Date | What applies | What it changes for a deployer | Status at 27 October 2026 |
|---|
| 2 February 2025 | Chapters I and II: Article 4, original prohibitions | Take AI literacy measures; no prohibited practice | Applied |
| 2 August 2025 | Notably Chapter XII, including Article 99 | Infringements subject to each Member State's penalty regime | Applied |
| 2 August 2026 | General date; Article 50; national enforcement | Flag deepfakes and texts on matters of public interest; inform people about emotion recognition | Applied |
| 2 December 2026 | Two new prohibitions; end of the marking period of Article 111, paragraph 4 | Use no system to generate the newly prohibited content | Upcoming |
| 2 December 2027 | Annex III high-risk rules | Article 26: instructions for use, human oversight by trained persons; reservation of Article 111, paragraph 2 | Upcoming |
| 2 August 2028 | Annex I high-risk rules | Article 26, same reservation | Upcoming |
| 2 August 2030 | High-risk systems intended for public authorities, even if already in service | Compliance by that date at the latest | Upcoming |
The date that should matter is the provider's, not yours. According to recital (39) of Regulation (EU) 2026/1744, which is not binding, the decisive factor for the grace period should be the date of first placing on the market or putting into service of the type and model.
A significant change in design brings the system under the rules, without the operative provisions defining it. According to recital (177) of the original regulation (not binding, predating the amendment of Article 111, paragraph 2, and speaking of changes "in their design or intended purpose"), it would be a substantial modification within the meaning of Article 3, point 23: one not foreseen in the initial conformity assessment that affects the system's compliance or modifies the intended purpose assessed.
With the high-risk rules, changing how a tool is used can make you its provider. In our reading, Article 111, paragraph 2, covers design only; a change of intended purpose falls under Article 25, paragraph 1, point (c).
For Article 50, the Commission published guidelines on 20 July 2026; the code of practice on transparency, assessed as adequate on 8 July 2026, is voluntary to adhere to and does not amount to conclusive evidence of compliance. The guidelines on high-risk systems remain a draft, with the final version announced by the end of 2026.
Provider or deployer: who owes what?
The provider develops or has developed an AI system and places it on the market or puts it into service under its own name or trademark; the deployer uses it under its own authority, except for personal non-professional activity; a company can be both, depending on the system. A company that uses AI therefore becomes a provider if it puts into service under its own name a system it has developed or had developed, a chatbot for example. The role is therefore decided system by system, not once for the whole company.
With the high-risk rules, the role can change along the way. Article 25, paragraph 1, provides for three cases, from 2 December 2027 (Annex III) or 2 August 2028 (Annex I), subject to the reservation of Article 111, paragraph 2: putting your name or trademark on a high-risk system already on the market or in service (point (a)); substantially modifying it (point (b)); changing the intended purpose of a system not classified as high-risk so that it becomes high-risk (point (c)), in our reading by reassigning it to candidate screening.
Where do your use cases fall among the risk levels?
Classify each use according to whether it is prohibited by Article 5, listed in Annex III and therefore high-risk under Article 6, paragraph 2, or subject to Article 50. The Commission presents four levels, which its French page calls "unacceptable risk", "high risk", "transparency risk" and "minimal or no risk"; the regulation says "high-risk". For minimal or no risk, it writes that the AI Act introduces no rules; yet Article 4 applies to every provider and every deployer.
Three headings of Annex III affect companies: recruitment, including the screening of applications (point 4); credit scoring of individuals, excluding fraud detection (point 5(b)); and education and vocational training, including the assessment of learning outcomes, "in educational and vocational training institutions" (point 3); in our reading, the text does not expressly cover internal employee training. Article 6, paragraph 3, provides for a derogation for a system that poses no significant risk of harm, which never applies where natural persons are profiled.
To the original prohibitions, which include social scoring and the inference of emotions in the workplace, is added on 2 December 2026 the generation of realistic intimate content of an identifiable person without their consent, or child sexual abuse content, prohibited for the deployer who uses the system for that purpose. The regulation inserts two points, (ba) and (bb); the Commission presents them as a ninth prohibition.
| Use | What governs it | Who owes what | Date |
|---|
| CV screening | In principle high-risk, Annex III, point 4; in our reading, automated screening amounts to profiling, which rules out the derogation | Deployer, Article 26: use in line with the instructions, human oversight by trained persons | 2 December 2027, reservation of Article 111, paragraph 2 |
| Credit scoring | High-risk, Annex III, point 5(b) | Deployer: Article 26 and the fundamental rights impact assessment of Article 27 | 2 December 2027, same reservation |
| Chatbot | Article 50, paragraph 1; the Commission cites chatbots as an example | Provider: design the system to inform people that they are interacting with an AI | 2 August 2026 |
| Generated marketing visuals or texts | Article 50, paragraph 2; paragraph 4 only for visuals that constitute a deepfake; in our reading, not for ordinary marketing text | Provider: machine-readable marking; deployer: deepfake flagged | 2 August 2026; marking: 2 December 2026 for systems placed on the market before 2 August 2026 |
| Emotion recognition or biometric categorisation, outside prohibited uses | Article 50, paragraph 3 | Deployer: inform the people exposed | 2 August 2026 |
| Spam filter | "Minimal or no risk", the Commission's example | Provider and deployer: Article 4 only | 2 February 2025 |
| Recommendation engine | "Minimal or no risk" in the Commission's sense, in our reading | Provider and deployer: Article 4 only | 2 February 2025 |
| Social scoring | Prohibited practice | Prohibited | 2 February 2025 |
Risks and countermeasures: what penalties does the AI Act provide for?
Article 99 sets three tiers, "whichever is higher": EUR 35 million or 7% of total worldwide annual turnover for prohibited practices; EUR 15 million or 3% notably for Article 26 on deployers and for Article 50; EUR 7.5 million or 1% for incorrect, incomplete or misleading information supplied on request to authorities or notified bodies. The lower of the two amounts applies to SMEs and, now, at the last two tiers, to small mid-cap enterprises.
Article 4 is on none of these lists: before national authorities, it has no fine ceiling of its own. But Article 99, paragraph 1, leaves it to the Member States to lay down the rules on penalties "applicable to any infringement of this Regulation by operators". The Commission writes that national market surveillance authorities could impose penalties and other enforcement measures for an infringement of Article 4, on the basis of national laws and in a proportionate manner.
One exception, in our reading: Article 75c, paragraph 4, allows the EUR 15 million or 3% tier to be applied to the infringement of "any applicable provision of this Regulation, including those not listed in Article 99(4)", where we read Article 4, which it does not name. This power of the AI Office applies only to operators under its exclusive competence: essentially, systems based on a general-purpose AI model by the same provider, very large online platforms and search engines; a deployer falls within it only if it is also the provider or belongs to the same undertaking.
The Commission's FAQ nevertheless places enforcement of Article 4 with the national authorities, not with the AI Office, without mentioning this power: we do not know how it reconciles the two.
On the French side, the two texts below are not law in force. The DGE's outline (page of September 2025) assigns, among other things, recruitment to the CNIL and credit scoring to the ACPR, for the operators within its remit. The text adopted by the Senate at first reading on 18 February 2026, before the omnibus was adopted (29 June 2026), makes the CNIL one of the competent authorities, its restricted committee imposing penalties, and entrusts the DGCCRF with part of the prohibitions and with transparency, and the ACPR with credit scoring within its remit. Sent to the National Assembly (No. 2518), this bill has been neither definitively adopted nor promulgated, according to the official sources we read.
The strongest objection: with no ceiling of its own before national authorities, Article 4 would be nothing to fear. It is right on the letter of Article 99. It overlooks the national regime for any infringement, Article 75c as we read it, and the Commission's warning: a penalty could be more likely where there is evidence of an incident due to a lack of training and support.
It also overlooks private enforcement. The Commission's FAQ describes the case of a person who considers themselves harmed by an organisation's breach of Article 4 and sues for damages; it adds that, in case of harm, the provider of an AI system can be sued under national law, and that the AI Act creates neither a criminal offence nor a right to compensation.
The measures that follow rule out no penalty. They are what you will be able to present to an authority or a court.
Where to start? A six-step roadmap
We recommend six steps, in this order; none waits for the French authorities to be designated.
- Take inventory of AI systems, including those built into your software or adopted by teams on their own, noting at this stage, for each Annex III tool, the date of first placing on the market of its type and model: it is this date that should decide the grace period. A panorama of the generative AI tools on the market helps you recognise what is already in circulation.
- Check for prohibited practices, including the two new ones of 2 December 2026.
- Classify each system by role and by regime: Annex III high-risk, Article 50 transparency, or neither.
- Put AI literacy measures in place by profile, according to knowledge, context and the persons affected. For uses that affect people, plan for human oversight; adding a human in the loop of an AI agent shows how to do it.
- Document in an internal register, without a certificate, as the Commission accepts.
- Follow the texts: review the inventory on 2 December 2026, when the high-risk guidelines are adopted, and then when the French law is promulgated.
Organisation and governance: who to train, and who pays?
Train first those whose role touches a specific obligation in the text, service providers included. The following table, our own proposal, links each profile to an obligation.
| Profile | Obligation to link the measure to | What the measure must cover |
|---|
| Executives | Role as provider or deployer of each system; prohibitions applicable on 2 December 2026 | Decide the role system by system; rule out any prohibited use |
| Marketing and communications | Article 50, paragraph 4: deepfakes; texts published to inform the public on matters of public interest, unless under editorial control | Recognise these two cases; in our reading, ordinary marketing text is not covered |
| HR and recruiters | Candidate screening, in principle high-risk (Annex III, point 4); Article 4 today; Article 26 to prepare | Read the tool's instructions; review and challenge a shortlist |
| Technical teams | Article 50, paragraph 2: machine-readable marking of generated content, if the company is a provider | Marking of outputs; system documentation |
| Service providers and subcontractors | "Other persons" under Article 4 according to the Commission's FAQ: subcontractor, service provider, client | In general, depending on the system and its risk: skills appropriate to the task, as for employees |
In practice. A register line for an SME, a case built for the example, whose recruiters use a screening tool bought from a vendor.
| Field | Content |
|---|
| System | Candidate screening tool; the SME's role: deployer; classification: high-risk in principle, Annex III, point 4 |
| Obligation concerned | Article 4 today; preparing the human oversight of Article 26 |
| Audience | The recruiters, and the outside firm that uses the tool on the SME's behalf |
| Measure | Dated workshop: read the tool's instructions, review a shortlist, know how to challenge it and record the decision |
| Owner | The person who leads recruitment |
| Evidence kept | Workshop material, attendance list, date of first placing on the market of the tool's type and model, obtained from the vendor |
Who pays for upskilling?
In France, Article L. 6321-1 of the Labour Code requires the employer to ensure that employees can adapt to their jobs and to maintain their ability to hold a job, having regard in particular to changes in technology; the training provided for these purposes falls, where applicable, under the skills development plan. We cite it from the
digital labour code (page updated on 26 October 2025, consulted on 27 October 2026); the version in force is on
Légifrance.
According to the
France compétences report on the use of vocational training funds (2025 edition, published in February 2026), this plan can, under certain conditions, be financed with public and pooled funds, and the pooled funds that the skills operators (OPCO) allocate to it are concentrated on companies with fewer than 50 employees. Check the conditions for coverage with your OPCO.
On the AI Act side, Article 4, paragraph 2, provides for support from public authorities and practical examples; Article 62, paragraph 1, point (b), requires Member States to organise awareness-raising and training activities on the application of the regulation, tailored to the needs of SMEs and deployers. In our reading, neither of these texts provides for covering your company's training costs.
What does compliance look like in three typical companies?
In all three cases, everything starts from the company's role for each system; Article 4 already applies, and the date depends on the regime. Scenarios built for the example, with no real company.
An accounting firm deploys a generative assistant for its letters and automated data-entry software; in our reading, none of these uses falls under Annex III. It must today apply Article 4 to its staff and to the service providers who use these tools on its behalf. Next action: a register of measures, by profile.
An SME that screens its applications with AI deploys a system that is in principle high-risk (Annex III, point 4), in our reading without derogation, since this screening amounts to profiling. If the first placing on the market or putting into service of the tool's type and model, and not its adoption, falls on or after 2 December 2027, Article 26 will apply; if it is earlier, it should apply only after a significant change in design from that date. For a tool that is updated continuously, the limit of that change is not defined in the texts we read; our judgement call: prepare human oversight without waiting. Next action: obtain this date from the vendor, and train recruiters to review and challenge a shortlist.
An online shop offers a chatbot and a recommendation engine. If the chatbot is bought from a vendor, that vendor, as provider, is responsible for informing users; if it is developed for the shop and put into service under its name, the shop is the provider. In our reading, the recommendation engine calls only for Article 4. Next action: state in the contract who is the provider, and test the disclosure from the first interaction.
Key takeaways
- The high-risk rules are postponed to 2 December 2027 (Annex III) and 2 August 2028 (Annex I): this is the main postponement for a company that uses AI. From those dates, reassigning a tool to a high-risk use makes you its provider.
- A high-risk system already marketed has a grace period with no end date as long as its design remains unchanged (except public authorities, 2 August 2030 at the latest): a later significant change in its design brings it under the rules. According to a recital, the date that counts should be that of its type and model.
- Article 4 is softened, not removed: every provider and every deployer takes AI literacy measures, which an internal register can record.
- Prohibitions and transparency have their own dates: original prohibitions since 2 February 2025, Article 50 since 2 August 2026, except a marking period to 2 December 2026 for generative systems placed on the market before 2 August 2026; new prohibitions on 2 December 2026.
- Article 4 has no fine ceiling of its own, but Member States set the regime for any infringement; no French law sets it yet, according to the official sources we read.
Take action
- Before 2 December 2026: check the new prohibitions and the marking of outputs by your suppliers of generative tools placed on the market before 2 August 2026.
- This quarter: take inventory of your AI systems, name your role for each, put AI literacy measures in place by profile and open their register.
- If you put a system into service under your name: design it to inform people that they are interacting with an AI and, if it generates content, mark its outputs (Article 50, paragraphs 1 and 2), since 2 August 2026.
- Before 2 December 2027: for each Annex III system, obtain from the vendor the date of first placing on the market of its type and model, and prepare the human oversight of Article 26 without waiting.
- When the French law is promulgated: check the national penalty regime and the authority competent for your uses.
Starting rule. No ceiling of its own does not mean no risk. Start with the inventory: the role, the regime and the register follow from it.
What changed in this version. The first version of this guide, published before the Official Journal of 24 July 2026, made Article 4 a promotion mission for the Member States; the text leaves it with providers and deployers. We also corrected the calendar, the roles and the "recommended literacy" for minimal risk, and removed two statistics without a primary source and the phrase "generally in fundable schemes".
This article provides information; it does not replace legal advice.
How this article was produced: research, writing and review assisted by AI (Claude, Anthropic), from the official texts and the other sources listed at the end of the article; the comparison of the two versions of the regulation was done by script, and every figure, date or article cited points to one of these sources. This is an English translation of the French article; quotations from legislation follow the English text of the Official Journal where it exists, which prevails in case of difference.
Sources
- European Commission (Shaping Europe's digital future), « AI Act (European approach to artificial intelligence : regulatory framework) », 19 October 2026.
- European Union (EUR-Lex, Publications Office), « Consolidated text of Regulation (EU) 2024/1689 as of 27.07.2026 (CELEX 02024R1689-20260727), documentation tool with no legal effect », 27 July 2026.
- European Commission (Shaping Europe's digital future), « Législation sur l'IA : cadre réglementaire de l'IA (French page) », consulted on 27 October 2026.
- European Union (Official Journal of the European Union, L series), « Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) », 24 July 2026.
- European Union (Official Journal of the European Union, L series), « Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (original version, OJ L, 2024/1689, 12.7.2024) », 12 July 2024.
- Council of the European Union, « Council note 11301/26, "Voting result": adoption of the legislative act (Digital Omnibus on AI), 4188th Council meeting, 29 June 2026, Luxembourg », 29 June 2026.
- European Commission (Shaping Europe's digital future), « AI Omnibus enters into force », 27 July 2026.
- European Commission (AI Office, Shaping Europe's digital future), « AI Literacy - Questions & Answers », 20 October 2026.
- European Commission (Shaping Europe's digital future), « Guidelines on transparency obligations for providers and deployers of AI systems », 20 July 2026.
- European Commission (Shaping Europe's digital future), « Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated Content », 9 July 2026.
- European Commission (Shaping Europe's digital future), « Code of Practice on Transparency of AI-generated Content », 19 October 2026.
- European Commission (Shaping Europe's digital future), « Enforcement of the AI Act », 20 October 2026.
- Hunton Andrews Kurth (law firm), « European Commission Publishes Q&A on AI Literacy », 27 May 2025.
- European Commission (Shaping Europe's digital future), « Draft Commission guidelines on the classification of high-risk AI systems », 19 May 2026.
- European Commission (Shaping Europe's digital future), « Targeted consultation on the draft guidelines for the classification of high-risk artificial intelligence systems », 19 May 2026.
- European Commission (Shaping Europe's digital future), « Guidelines for providers and deployers of AI high-risk systems », 19 October 2026.
- Direction générale des Entreprises (French Ministry of the Economy), « Les autorités compétentes pour la mise en œuvre du règlement européen sur l'intelligence artificielle », 9 September 2025.
- Assemblée nationale, « Projet de loi n° 2518 (17e législature) : dossier législatif », consulted on 27 October 2026.
- Sénat, « Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne (n° 118, 2025-2026) : dossier législatif », 4 September 2026.
- Sénat, « Texte adopté n° 63 (2025-2026) : projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne, adopté par le Sénat le 18 février 2026 », 18 February 2026.
- Ministère du Travail (code du travail numérique), « Article L6321-1 du code du travail (code du travail numérique) », 26 October 2025.
- France compétences, « Le soutien au plan de développement des compétences des entreprises (Rapport sur l'usage des fonds de la formation professionnelle et du conseil en évolution professionnelle, édition 2025) », February 2026.
