For companies that use AI rather than build it: what has applied since 2 February 2025 (bans, AI literacy) and what is coming in 2026.
If you have heard of the “AI Act” and mentally ticked “that is for big companies that build models”, that is half true. The EU Artificial Intelligence Regulation (Regulation (EU) 2024/1689) talks about several roles, and your company, if it uses an AI assistant, a CV-screening tool or a chatbot on its website, is normally a deployer: the party using an AI system under its own authority. For deployers the rules are lighter than for developers, but not zero.
This article is written on 5 February 2026 and is not legal advice. The rules apply in stages and amendments are being discussed; for your specific situation, check with a lawyer.
The timeline in brief
The Regulation entered into force on 1 August 2024 and applies in stages, as the European Commission sets out:
- 2 February 2025: the bans on certain practices (Article 5) and the AI literacy obligation (Article 4) apply.
- 2 August 2025: the rules for general-purpose models and governance apply.
- 2 August 2026: in principle the rest of the Regulation applies, including the transparency obligations (Article 50) and the rules for high-risk systems under Annex III.
- 2 August 2027: the date set for high-risk systems embedded in regulated products (Annex I).
On 19 November 2025 the Commission presented a proposal (known as the “Digital Omnibus”) that would change some of these dates, especially for high-risk systems. At the date of this article it is a proposal going through the legislative process, not adopted law; the dates in the Regulation remain those above until any amendment is made.
What already applies: the prohibitions
Since 2 February 2025 certain practices are banned, whatever the size of the company. They include manipulative techniques that cause harm, exploiting people’s vulnerabilities (age, disability, social situation), “social scoring”, untargeted scraping of facial images from the internet to build face-recognition databases, and emotion recognition in the workplace or in schools, with exceptions for medical or safety reasons.
For a typical small business the list is unlikely to affect you. One case to check: a tool that “analyses the emotional state” of staff or candidates through a camera or voice. In February 2025 the Commission published guidelines on these practices (not binding; the final interpretation belongs to the EU Court of Justice), and a serious vendor should be able to explain why its product does not fall under the bans.
Fines for prohibited practices are the highest in the Regulation. For SMEs, under Article 99, the lower of the percentage of turnover and the fixed amount applies. You will find the exact amounts in the text of the Regulation.
What already applies: AI literacy
Article 4 requires providers and deployers to take measures so that their staff, and other people working with AI systems on their behalf, have a sufficient level of AI literacy, taking into account their experience, training and the context of use. It has been in force since 2 February 2025.
What the Commission says in its Q&A, in short:
- no certificate is needed and there is no standard mandatory training;
- no specific measures are prescribed; a risk-based approach is recommended, depending on the company’s role and the systems used;
- simply handing over a product’s instructions for use is not enough;
- you may keep internal records of training.
In practice, for a small company this means simple things: a short internal session on what an AI assistant can and cannot do, what data must not be entered, how to check an answer and who to report a problem to. Note who took part and when.
What is coming for AI users
For deployers, two areas are worth watching in 2026.
Transparency (Article 50)
The Regulation requires people to be told when they interact directly with an AI system, for example a chatbot on a website, unless it is obvious from the context. There are also rules for artificially generated or altered content (images, audio and video that look real). The obligations apply, in principle, from 2 August 2026. If you put an assistant in front of customers, say clearly that it is an AI assistant and offer a route to a person.
High-risk systems (Article 26)
Annex III systems include, among others, those used for recruitment and candidate selection or for decisions about employees. If you use one, as a deployer you have obligations such as using it according to instructions, human oversight by competent people, keeping the logs the system generates and informing employees. The exact timetable depends on what happens to the “Digital Omnibus” proposal, so follow the official sources.
What you can do now, at little cost
- List the AI tools used in the company, including those staff use on their own accounts.
- Alongside the list, check whether any of them does emotion recognition, scoring of people or candidate selection.
- Set a short internal rule: what data is not entered, who approves new tools.
- Run a short training session and keep a record.
- If you have a public chatbot, prepare the message that says it is AI.
- Ask suppliers for documentation and confirmation that the product meets the Regulation for their role.
There is no need to panic: for most small businesses that use AI as an office assistant, the concrete obligations today are AI literacy and avoiding prohibited practices, and transparency arrives in the summer.
If you would like to talk about getting your AI tools in order, ME Digital provides AI implementation with documentation and clear usage rules; write to us through the contact form. For how the law applies to your case, consult a lawyer.