The EU AI Act is already partly applicable. This guide explains the rules in force in 2026, transparency duties, prohibited practices, AI literacy and the postponed high-risk timetable.
Vassilev & Chisuse Law Firm · 2026-10-11 · Legal review: 12 October 2026
The EU Artificial Intelligence Act is no longer only a future compliance project. Several parts of Regulation (EU) 2024/1689 already apply, and from 2 August 2026 the Regulation entered its main application phase, including important transparency rules and enforcement powers. At the same time, the 2026 Digital Omnibus on AI postponed significant parts of the high-risk AI regime.
Businesses should therefore avoid two opposite mistakes: assuming that the entire AI Act already applies in full, or assuming that nothing matters until the high-risk rules take effect. The correct approach is to identify the organisation's role, the AI systems and models it uses or supplies, and the provisions that are already applicable to those activities.
Since 2 February 2025, the main rules on prohibited AI practices and AI literacy have applied. Organisations using or providing AI systems must therefore already consider whether a planned use falls within a prohibited category and must take measures to ensure a sufficient level of AI literacy among staff and other persons dealing with AI systems on their behalf. Regulation (EU) 2026/1744 introduced specific additional Article 5 provisions whose application begins on 2 December 2026, so the current prohibition analysis must use the amended timetable.
Since 2 August 2025, the governance framework and obligations for providers of general-purpose AI models have also applied. The AI Office has a central role in supervising general-purpose AI models at EU level.
From 2 August 2026, the AI Act entered a broader enforcement phase. National authorities and the European Commission's AI Office began exercising the enforcement powers allocated to them under the Regulation, and the transparency obligations in Article 50 became applicable.
This date does not mean that every high-risk AI obligation became applicable. Regulation (EU) 2026/1744 amended the original timetable and postponed major high-risk requirements, so businesses must distinguish current obligations from later phases.
Providers of AI systems intended to interact directly with individuals must generally design them so that people are informed that they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person in the circumstances.
For businesses using conversational assistants, automated customer support or similar interactive tools, this means the user journey and interface should be reviewed to ensure that the required information is clear, timely and technically reliable.
Article 50 introduces transparency requirements for certain AI-generated or manipulated content. Providers of relevant AI systems must support machine-readable marking and detection of artificially generated or manipulated outputs, subject to the conditions and exceptions in the Regulation.
Deployers also have disclosure duties in specified situations, including the use of deepfakes and certain AI-generated or manipulated text published to inform the public on matters of public interest where the statutory conditions are met. The exact duty depends on whether the business is acting as a provider or deployer and on the type and use of the content.
For systems placed on the market before 2 August 2026, a limited transitional period applies to specific marking and detection obligations, with compliance required from 2 December 2026 in the cases identified by the Commission's current guidance.
The AI Act prohibits defined categories of AI use that the EU legislature considers incompatible with fundamental rights and acceptable risk. The list includes specific forms of manipulative or exploitative practices, certain social scoring, particular biometric categorisation and identification practices, and other expressly prohibited uses.
The prohibitions are technical and fact-specific. A business should not classify a system as prohibited only by looking at its marketing label. The purpose, functionality, data used, affected persons and actual deployment context must be analysed against the text of Article 5 and applicable guidance.
Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy among staff and other persons dealing with the operation and use of AI systems on their behalf. The appropriate level depends on technical knowledge, experience, education, training, the context in which the systems are used and the persons affected by their use.
A generic annual presentation will not necessarily address this obligation where teams make materially different decisions with AI. Training for developers, procurement teams, human resources, customer-service staff and management may need different content because their risks and responsibilities differ.
No. Regulation (EU) 2026/1744 changed the implementation timetable. High-risk use cases listed in Annex III are subject to the postponed application date of 2 December 2027, while high-risk AI systems that are safety components of products or are themselves products covered by the legislation listed in Annex I have a longer transition to 2 August 2028.
This postponement should not be treated as permission to ignore high-risk systems. Businesses developing or deploying systems likely to fall within those categories should use the additional time to classify systems, determine their role in the supply chain, assess data and documentation, establish human oversight and prepare governance and conformity processes.
Obligations under the AI Act depend heavily on the legal role. A provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, subject to the statutory exceptions.
A company that purchases third-party software is often a deployer, but modifications, rebranding or changes in intended purpose can alter the analysis. Contracts with AI vendors should therefore allocate responsibilities without assuming that contractual terminology can override the roles defined by the Regulation.
Compliance with the AI Act does not replace the General Data Protection Regulation, cybersecurity requirements, consumer law, employment law or sector-specific regulation. A single AI project can be subject to several regimes at the same time.
For example, an AI system processing personal data may require a lawful basis, transparency, data minimisation and, in some cases, a data protection impact assessment under the GDPR. Systems supporting essential or important entities may also need to be considered within the organisation's cybersecurity risk framework. See VC Law's Data Protection practice and our NIS2 guide for Bulgaria.
A practical starting point is an inventory of AI systems and models that the organisation develops, supplies, procures or uses. Each system should be mapped to a business owner, vendor, purpose, affected persons, data sources and the organisation's legal role.
The business can then identify prohibited uses, AI literacy needs, transparency requirements already in force, general-purpose AI obligations where relevant and systems that are likely to fall within the later high-risk regime. Procurement and vendor contracts should also be reviewed so that the organisation can obtain the technical information and cooperation needed to meet its own legal duties.
Governance should be proportionate to actual risk. The goal is not to create paperwork around every automated feature, but to ensure that decisions about AI are traceable, legally classified and supported by appropriate controls.
Vassilev & Chisuse Law Firm advises businesses on AI Act classification, governance, transparency, vendor contracts, data protection and sector-specific regulatory issues. We can assist with AI inventories, role and risk assessments, internal policies and contract reviews, and with preparing for high-risk obligations that will apply in later phases.
This article reflects the EU legal framework reviewed as of 12 October 2026 and is provided for general information only. It does not constitute individual legal advice. The applicable obligations depend on the specific AI system or model, the organisation's role, the intended purpose, the deployment context and other applicable EU and national legislation.