The EU AI Act in 2026

What every company using AI software needs to know now

27.02.2026

Artificial intelligence, Consulting, Validation / Regulatory Affairs

You are reading Part 1 of our series of articles on the EU AI Act

Part 1 – The EU AI Act in 2026: What every company using AI software needs to know now
Part 2 – The EU AI Act by industry: What sets medtech, automotive, finance, and administration apart (coming soon)

The EU AI Act (Regulation 2024/1689) is the world’s first comprehensive AI law. It will take effect in stages. The first prohibitions took effect in February 2025, followed by the rules for general-purpose AI models in August 2025. The requirements for high-risk AI systems will take effect in August 2026. This affects far more than just tech companies. The AI Act covers all companies that develop, use, or import AI systems, regardless of industry or company size.

Does your company use AI in quality assurance, customer interaction, diagnostics, or production? If so, a key question arises: When do which rules apply to you?

Four risk levels – and the question: Where do you stand?

The AI Act distinguishes between four risk levels and takes a risk-based approach. The highest level includes prohibited AI practices, such as social scoring and biometric mass surveillance, which will be banned in February 2025. The high-risk AI category forms the core of the regulation and is below this level. Strict obligations apply here to risk management, data quality, transparency, and human oversight. Systems with limited risk, such as chatbots, are subject to labeling requirements. AI with minimal risk, such as spam filters, will remain largely unregulated.

The key point is that high-risk AI is prevalent in almost every industry.

In medical technology, AI-based diagnostic software automatically falls under the category of high-risk as soon as it is subject to CE marking.
In the automotive sector, this applies to safety-critical driver assistance systems.
Financial service providers must classify credit scoring and credit ratings for individuals as high risk.
In public administration, AI-supported decisions on social benefits or migration are considered high risk.
In industry, AI safety components in machines are affected.

However, many companies are unaware of which category their AI applications fall into and, consequently, what obligations they have.

What is at stake

The implementation plan is ambitious. High-risk obligations will take effect in August 2026. The EU has established clear enforcement mechanisms, such as national market surveillance authorities and a European AI Office. Violations are punishable by fines of up to €35 million or seven percent of a company’s global annual turnover.

However, financial penalties are only one aspect of the risk. More serious consequences include the loss of market confidence and competitiveness. Those who start too late have less leeway for corrections and risk delays in launching new products to market.

The obligations apply equally to all industries: Risk management, data governance, transparency, human oversight, technical documentation, and a functioning quality management system are mandatory for high-risk AI. The AI Act is not a paper tiger. It will be enforced.

Three steps to get started

The path to AI Act compliance begins with three basic, industry-agnostic steps:

Classification. Identify all AI systems in your company and assign them to the risk levels of the AI Act. It does not matter if you develop AI systems internally or use them as finished products. Both providers and deployers are regulated.
Inventory. Check which existing processes, such as risk management, QMS, and documentation, already cover the requirements of the AI Act. Many companies in regulated industries have suitable starting points.
Roadmap. Define a timeline with clear responsibilities and milestones by August 2026.

Note that classification is not always clear-cut, especially at the boundaries between risk levels, where there is room for interpretation. An early technical assessment prevents unnecessary detours later on.

Sources

Regulation (EU) 2024/1689 – Full text – Official legal text in the Official Journal of the EU
European Commission – AI Act: Regulatory Framework – Official overview page of the Commission on the AI Act with deadlines and implementation status
European Commission – Standardization of the AI Act – Official information page on harmonized standards (CEN/CENELEC) and their role in AI Act compliance
ISO/IEC 42001:2023 – AI Management Systems – Official ISO page on the world’s first standard for AI management systems

The EU AI Act in 2026

Four risk levels – and the question: Where do you stand?

Four risk levels – and the question: Where do you stand?

What is at stake

Three steps to get started

Looking Ahead

FAQ

Sources

Get in touch with us!