EU AI Act 2026: What is changing now for AI users

The world's first AI law is here

Correction note dated 23 September 2026: for incorrect, incomplete or misleading information supplied to public authorities, Art. 99(5) specifies up to €7.5 million or 1% of worldwide annual turnover. A higher percentage was previously stated here. In addition, the article now cites Art. 26(6) as the reference for the retention of logs and describes consent with the VoiceBot in the same way as the VoiceBot article.

The EU AI Act is the world's first comprehensive AI law. Risk classes, transparency obligations and deadlines: what companies need to know and implement now.

On 1 August 2024 Regulation (EU) 2024/1689 came into force, better known as the EU AI Act. With it, the European Union has created the world's first comprehensive law regulating artificial intelligence. After more than three years of negotiations between the European Parliament, the Council and the Commission, the result is a set of rules covering the entire life cycle of AI systems: from development and deployment through to use by end users.

The AI Act takes a risk-based approach. Not all AI is treated the same. Instead, AI systems are classified according to their potential risk to society. The higher the risk, the stricter the requirements. For many applications (including most chatbots and knowledge bases), this means moderate obligations that can easily be met with good architecture.

It is important to understand that the AI Act does not only affect AI developers. Obligations also apply to deployers (companies that use AI systems) and importers (who bring AI products from third countries into the EU). If you operate an AI chatbot on your website, you are a deployer, and are therefore covered.

The good news: a phased introduction was deliberately chosen by the legislator. Not all rules apply immediately. Depending on the risk category, the obligations have applied since August 2026 or apply from December 2027 or from August 2028. Those who start now have a head start.

The four risk classes

The core of the AI Act is the classification into four risk classes. Every AI system is assigned to one of these categories, and the category determines which obligations apply.

1. Unacceptable risk (prohibited)

Certain AI applications are completely prohibited in the EU because they are considered incompatible with fundamental European values. These include:

• Social scoring by public authorities: the assessment of citizens based on their social behaviour
• Real-time remote biometric identification in public spaces (with narrowly defined exceptions for law enforcement)
• Emotion recognition in the workplace and in educational institutions
• Manipulative AI, which uses subliminal techniques to influence people's behaviour to their detriment
• Exploitation of vulnerabilities: AI that deliberately exploits weaknesses due to age, disability or social situation

These prohibitions have applied since 2 February 2025. They are already in force.

2. High risk

High-risk AI systems are subject to the strictest requirements. This concerns applications in safety-critical areas or areas relevant to fundamental rights:

• Recruitment and staff evaluation: AI that filters applications or evaluates employee performance
• Creditworthiness and insurance: automated scoring systems
• Education: AI-assisted exam grading or admission control
• Critical infrastructure: energy supply, water supply, transport
• Law enforcement: risk assessment, evidence analysis
• Migration: asylum procedures, border control

For high-risk AI, the AI Act requires, among other things: risk management systems, data quality requirements, technical documentation, record-keeping obligations, transparency towards users, human oversight and evidence of accuracy and robustness (Art. 8-15 AI Act).

3. Limited risk (transparency obligation)

This category covers most chatbots, VoiceBots and generative AI systems. The central obligation is that users must know that they are interacting with an AI. This also includes systems that generate text, images, audio or video. They must be labelled as AI-generated.

4. Minimal risk

The vast majority of AI applications fall into this category: spam filters, AI-powered recommendations in online shops, spell checkers, translation tools. For these, there are no special requirements, only voluntary codes of conduct are recommended.

Transparency obligation: labelling chatbots and VoiceBots

Article 50 of the AI Act is the most relevant provision for most companies. It governs the transparency obligations for AI systems with limited risk and therefore directly affects anyone with a chatbot or VoiceBot in operation.

The core rule is clearly worded: providers of AI systems that interact directly with natural persons must ensure that the persons concerned are informed that they are interacting with an AI system (Art. 50(1)). The exception: where this is obvious from the circumstances and the context.

In practice, this means:

For chatbots:

• At first contact, a clear notice must appear stating that the user is communicating with an AI, not with a human
• The notice must be given before the interaction, not hidden in the terms and conditions
• A simple sentence is enough: “You are communicating with an AI assistant” or “This chat is operated by an artificial intelligence”
• The labelling must be in a language that the target audience can understand

For VoiceBots:

• At the start of the conversation, the VoiceBot must identify itself as an AI, ideally in the first sentence
• This is particularly important for telephone VoiceBots, as the risk of them being mistaken for a human conversation partner is higher
• A recommended wording is: “Hello, you are speaking with the AI assistant of [company name]. How can I help you?”
• For IVR systems (Interactive Voice Response) with an AI component, the notice should be integrated into the greeting

In addition, Art. 50(2) requires that content generated or manipulated by AI (so-called “deep fakes”) be labelled in a machine-readable way. This mainly concerns generated text, images and audio. For companies that use AI-generated marketing copy or images, this means: metadata must indicate the AI origin.

The transparency obligations have applied since 2 August 2026. Therefore, review your chatbot and VoiceBot implementations and adapt them where necessary.

GPAI: rules for foundation models

A separate chapter of the AI Act is devoted to General Purpose AI (GPAI), i.e. foundation models such as those offered by OpenAI, Mistral AI, Anthropic or Meta. These models are not trained for a specific purpose but can be used for many different tasks. That is precisely what makes regulating them particularly complex.

Since August 2025, all GPAI models have been subject to the following basic obligations (Art. 53):

• Technical documentation: providers must draw up comprehensive technical documentation and keep it up to date, including information on training and testing procedures
• Information for downstream providers: anyone who provides a GPAI model must make sufficient information and documentation available to downstream providers (who integrate the model into their products)
• Copyright compliance: providers must implement a policy to comply with EU copyright law and, in particular, respect opt-out mechanisms in accordance with Art. 4(3) of the DSM Directive (2019/790)
• Summary of training data: a sufficiently detailed summary of the data used for training must be made publicly available. The EU AI Office has developed a template for this

For GPAI models with systemic risk (defined as models whose cumulative training compute exceeds 10^25 FLOPS), additional, stricter obligations apply (Art. 55):

• Model evaluation in accordance with standardised protocols and benchmarks
• Assessment and mitigation of systemic risks, including adversarial testing (red teaming)
• Reporting of serious incidents to the EU AI Office
• Ensuring an adequate level of cybersecurity

For companies that use GPAI models (rather than develop them), the decisive question is: What obligations do I have as a deployer? The answer: the GPAI obligations are aimed primarily at the model providers (i.e. Mistral, OpenAI, Anthropic, etc.). As a company that integrates a ready-made model via an API, you benefit from the model provider fulfilling its obligations. Your own obligations are limited to correct use, in particular the transparency obligation towards your end users.

The deadlines at a glance

Updated on 23 August 2026: Amending Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026, sets the deadlines for high-risk AI systems at 2 December 2027 (Art. 6(2), Annex III) and 2 August 2028 (Art. 6(1), Annex I). The transparency obligations under Art. 50 have applied since 2 August 2026. The list below reflects this status.

The AI Act does not take effect all at once but in several stages. This phased approach gives companies time to prepare, but the first deadline has already passed:

• 2 February 2025: prohibition of unacceptable AI practices (social scoring, real-time remote biometric identification, manipulative AI). Already in force.
• 2 August 2025: obligations for GPAI models (transparency, documentation, copyright compliance) and designation of the national authorities. The AI Act's governance rules come into force.
• 2 August 2026: transparency obligations for chatbots, VoiceBots and generative AI are enforceable. Penalties can be imposed.
• 2 December 2027: high-risk AI systems under Art. 6(2) and Annex III must meet all requirements.
• 2 August 2028: transition periods end for certain high-risk AI systems, in particular those that act as safety components of regulated products (Annex I, e.g. medical devices, machinery, toys).

The penalties are substantial and are modelled on the GDPR:

• Violation of prohibited practices: up to €35 million or 7% of worldwide annual turnover (Art. 99(3))
• Violation of high-risk requirements and transparency obligations: up to €15 million or 3% of turnover (Art. 99(4))
• Incorrect, incomplete or misleading information supplied to public authorities: up to €7.5 million or 1% of worldwide annual turnover (Art. 99(5))

Adjusted, lower caps apply to SMEs and start-ups. Nevertheless, the fines are steep enough to get the attention of medium-sized businesses too. Why the AI Act does not answer where your data is processed, despite these obligations, is described in the article The EU AI Act is here. And it still does not tell you where your data goes.

In Germany, the national implementation act makes the Federal Network Agency (Bundesnetzagentur) the central supervisory authority for AI. The Federal Council (Bundesrat) approved it on 10 July 2026.

What Nexoria customers need to know

If you use Nexoria as your AI platform, the compliance situation is straightforward. The key question is: which risk class do your applications fall into? For the typical Nexoria use cases (chatbot, VoiceBot, knowledge base, document analysis, process automation), the following applies: Limited risk or minimal risk. None of these applications falls into the high-risk category.

The relevant obligation is therefore the transparency obligation under Art. 50. And this is where Nexoria customers are already well positioned:

• Chatbot labelling: Nexoria chatbots indicate at first contact that the user is communicating with an AI. This is built into the standard widget configuration and is active, without the operator having to write any additional code.
• VoiceBot identification: Nexoria VoiceBots identify themselves as an AI system at the start of every conversation. By default, the greeting message includes a notice about the AI nature of the conversation.
• Consent management: with the VoiceBot, a keypress consent procedure asks whether the call may be recorded and transcribed. If the caller declines or does not make a choice, the call is conducted without recording.
• Audit logs: every interaction (whether chat, call, document access or search query) is logged without gaps. These records are tamper-proof and support the logging obligations of the AI Act (Art. 26(6), retention of logs for high-risk AI).
• Human oversight: with the live operator feature, human staff can step into chatbot conversations at any time and take over the AI conversation. This fulfils the principle of human oversight (Art. 14).

What Nexoria customers themselves should ensure:

• Check whether you use AI systems in a high-risk area (e.g. personnel selection). If so, stricter requirements apply. Get in touch with us.
• Document internally which AI systems you use, for what purpose and who is responsible. A simple overview is enough as a starting point.
• Train your employees who work with AI systems in the basics of the AI Act, in particular regarding the transparency obligation.