The EU AI Act has entered a decisive phase. Its general application date was 2 August 2026, including new transparency requirements, subject to specific exceptions and transitional rules. Supervision and enforcement fall within the respective responsibilities of the European AI Office and national competent authorities, while certain high-risk requirements follow later application dates.
However, EU AI Act compliance is not simply about publishing an internal policy or approving a list of AI tools. Businesses must understand where artificial intelligence is being used, what role they play in each system and which risks and responsibilities arise from their use cases.
As AI spreads across departments, SaaS platforms and external providers, this requires visibility, clear ownership and practical controls. This is where AI Governance becomes essential.
What is the EU AI Act?
The EU AI Act, formally Regulation (EU) 2024/1689, establishes a common legal framework for developing, providing and using artificial intelligence in the European Union.
It applies to public and private organizations operating within the EU, as well as certain organizations outside it when they place AI systems or general-purpose AI models on the European market or when the output produced by their systems is used in the EU.
The regulation follows a risk-based approach:
- Certain practices considered an unacceptable risk are prohibited, such as using AI to infer emotions in workplaces or educational institutions, except where intended for medical or safety reasons
- High-risk systems are subject to stricter requirements
- Some interactive and generative systems must meet transparency obligations
- Minimal-risk applications can generally continue to be used without additional requirements under the AI Act
Each organization’s responsibilities depend heavily on its specific role. Under this regulation, a clear distinction is made between providers that develop or market AI systems, deployers that use them under their authority, and importers and distributors involved in making them available in the European market.
The European Commission’s official AI Act guidance explains these roles and risk categories in greater detail.
What changed for EU AI Act compliance in August 2026?
Although some obligations had already entered into application, 2 August 2026 marked the general application date of the EU AI Act.
From this date:
- Transparency obligations under Article 50 apply to certain interactive and generative AI systems
- The European AI Office and national authorities can supervise and enforce most provisions
- Providers must inform people when they interact directly with certain AI systems
- Providers of AI systems generating synthetic audio, images, video or text must ensure that covered outputs are marked in a machine-readable format and can be detected as artificially generated or manipulated, subject to the applicable exceptions
- Deployers must disclose certain deepfakes, biometric or emotion-recognition uses, and AI-generated texts concerning matters of public interest
These transparency rules do not mean that every piece of AI-assisted business content must be labelled. For AI-generated text published to inform the public on matters of public interest, an exemption from disclosure can apply where the text undergoes substantive human review or editorial control and a person or organisation holds editorial responsibility. A spelling or grammar check alone is insufficient. This exemption does not automatically extend to deepfakes or other transparency obligations.
The Commission’s Article 50 guidelines explain the applicable requirements and exceptions. Its Code of Practice on Transparency of AI-generated Content provides a voluntary framework for demonstrating compliance with certain marking and labelling obligations.
Implementation remains gradual. Providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the technical marking and detection requirements of Article 50(2). This transitional deadline does not postpone the other transparency obligations.
Following the AI Omnibus amendments that entered into force in July 2026, requirements for high-risk use cases listed in Annex III, including certain applications in employment, education and essential services, apply from 2 December 2027. Requirements for high-risk systems covered by Article 6(1), involving certain regulated products, apply from 2 August 2028. The updated dates are available in the European Commission’s official AI Act timeline.
What does the EU AI Act require from businesses?
There is no universal EU AI Act compliance checklist that applies identically to every company. Responsibilities depend on:
- The intended purpose of the AI system
- Its risk classification
- How and where it is used
- The organization’s role
- Whether the system has been modified or repurposed
A business using a third-party AI platform will generally act as a deployer, while the technology vendor will normally be the provider. However, a business that develops or commissions an AI system and places it on the market or puts it into service under its own name may itself be a provider.
Article 25 also establishes specific circumstances in which provider responsibilities transfer to another party: rebranding a high-risk system, substantially modifying it while it remains high-risk, or changing the intended purpose of an existing system so that it becomes high-risk. Each situation requires an assessment of the system, its intended purpose and the company’s actual role.
Organizations should therefore begin by identifying their AI systems and business use cases. This assessment should include not only tools acquired specifically as AI solutions, but also AI features embedded in SaaS platforms, enterprise applications, automated workflows and services delivered by external partners.
Depending on the system and the company’s role, preparation may involve:
- Creating an inventory of AI systems and use cases
- Identifying providers, deployers and other parties involved
- Assessing the applicable level of risk
- Reviewing vendor documentation and safeguards
- Defining human oversight and transparency measures
- Establishing responsibilities with suppliers and partners
- Maintaining records for internal and regulatory reviews
- Providing appropriate AI literacy
The AI literacy obligation has applied since 2 February 2025. Following the amendments to Article 4, providers and deployers must take measures to support the development of AI literacy among their staff and other people operating AI systems on their behalf, taking their knowledge, experience and context of use into account. They are not required to guarantee a specific level of AI literacy for every individual. Separate training and competence requirements for human oversight of high-risk systems must also be considered where applicable.
The regulation does not automatically transfer the same obligations to every supplier. Nevertheless, EU AI Act compliance requires coordination across the AI value chain so that each party can access the information and documentation needed to fulfil its responsibilities.
Why a written AI policy is not enough
An internal policy can establish which tools employees may use and what information they must not share. However, it cannot by itself prevent someone from using a personal account, uploading confidential information or connecting an unauthorized AI application to corporate systems.
Samsung faced this problem in 2023 after discovering that an employee had uploaded sensitive source code to ChatGPT. The company subsequently restricted the use of ChatGPT and similar tools on corporate devices while it worked on creating a more secure environment for generative AI. Reuters reported on the incident and Samsung’s response.
The case demonstrates that corporate information can be exposed without a conventional cyberattack. Employees may simply be trying to complete their work more efficiently, but using an unapproved channel can still create security, confidentiality and regulatory risks.
This challenge is becoming more complex as AI is incorporated into everyday applications and autonomous agents gain access to business systems. Organizations need more than a list of approved tools: they need visibility into which models are being used, what information they process and what actions they are authorized to perform.
How AI Governance supports EU AI Act compliance
AI Governance is the framework through which an organization manages the responsible adoption and operation of artificial intelligence. It brings together people, policies, processes and technical controls to align AI usage with regulatory requirements, security standards and business objectives.
An effective AI governance framework can help companies:
- Maintain visibility over AI systems and use cases
- Assign clear ownership and accountability
- Classify and monitor AI-related risks
- Establish approval processes for new initiatives
- Apply data protection and security policies
- Define appropriate human oversight
- Control access to models, agents and corporate systems
- Preserve traceability for internal reviews and audits
- Support responsible AI adoption across the organization
AI Governance does not automatically guarantee compliance with every provision of the EU AI Act. Legal obligations must still be evaluated according to each organization and use case. However, it provides the operational foundation needed to identify exposure, implement proportionate AI risk controls and demonstrate how risks are being managed.
How Code10 operationalizes AI Governance
Code10 is already helping businesses develop AI Governance models adapted to their use cases, technology landscape and priorities.
Our approach combines a governance framework with a technical platform that centralizes access to AI models, applies roles, permissions and guardrails, protects corporate information and provides visibility into how AI is used across the organization.
This enables companies to move beyond isolated policies and establish practical controls for managing models, users, agents and data. It also supports greater traceability, accountability and regulatory readiness without unnecessarily limiting access to AI or slowing down innovation.
Every organization starts from a different level of adoption and exposure. Code10 helps businesses assess their current AI ecosystem, identify control gaps and build a scalable foundation for secure and responsible use of artificial intelligence.
Disclaimer: This content is provided for informational purposes and does not constitute legal advice.
