What actually happened
Correction note dated 23 August 2026: this article of 2 July 2026 was written on the basis of the situation at that time and described the transparency obligations under Art. 50 and the decision of the Federal Council (Bundesrat) as still pending. Both are now outdated. Amending Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The transparency obligations under Art. 50 have applied since 2 August 2026. The Federal Council (Bundesrat) approved the national implementation act on 10 July 2026. The text below has been corrected accordingly.
Few European laws in recent years have generated as many headlines as the EU AI Act, and few have caused as much confusion. So first, the facts: on 29 June 2026, the Council of the EU gave final approval to the so-called Digital Omnibus, after the European Parliament had already approved it on 16 June. Amending Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. It postpones a substantial part of the AI Act.
Specifically: the obligations for high-risk AI systems, which would originally have applied from 2 August 2026, now only take effect from 2 December 2027. For AI embedded in regulated products, not until August 2028. For SMEs, this mainly affects AI in HR: systems that filter applications, suggest promotions or evaluate employee performance, and systems for assessing creditworthiness.
What many overlook in the headlines: by no means everything was postponed. The transparency obligations of Article 50 have applied unchanged since 2 August 2026. And two blocks of obligations already apply today: the prohibition of certain AI practices and the obligation to ensure AI literacy within the company (since February 2025), as well as the transparency rules for the large AI foundation models (since August 2025).
What has applied to you since 2 August
If your company uses AI (even if it is only ChatGPT or a Copilot in everyday office work), you are a “deployer” within the meaning of the Regulation. Since 2 August 2026, this specifically means:
- Anyone who publishes AI-generated images, videos or audio that appear real must disclose that they have been artificially generated, even without any intention to deceive.
- Anyone who publishes AI-generated text to inform the public on matters of public interest must label it. Exception: the text has been reviewed by a human and someone bears editorial responsibility. Internal use (emails, presentations, minutes) does not require labelling.
- Anyone who uses emotion recognition or biometric categorisation must inform the people affected.
- Making sure chatbots identify themselves as AI, by contrast, is the provider's obligation, not yours. This obligation must be built into the product.
Since that same day, this has also been enforceable: violations of the transparency obligations can cost up to €15 million or 3 per cent of worldwide annual turnover. For small and medium-sized enterprises, at least, the lower of the two amounts applies as the cap. And Germany? The Federal Council (Bundesrat) approved the national implementation act, which makes the Federal Network Agency (Bundesnetzagentur) the central supervisory authority, on 10 July 2026 at its 1067th session. The European obligations applied regardless. Anyone waiting for German supervision before getting started is waiting for the wrong signal.
The gap nobody talks about
Now for the real point. It is tempting to assume that, with an AI Act-compliant provider, the data question is settled too. That assumption falls short, because the AI Act does not answer the data question.
The AI Act governs how AI systems are built, documented and labelled. It does not govern where your data is processed, who can access it and in which jurisdiction it is held. Article 2 of the Regulation makes this explicitly clear: the General Data Protection Regulation remains unaffected. Data flows to third countries, server locations, access by foreign authorities: all of this remains purely a GDPR matter. An AI system can be fully compliant with the AI Act and still process your customer data on US servers, train on it and be required to make it accessible to US authorities.
Because the AI Act does not change this either: the American CLOUD Act obliges US providers to grant authorities access to data under their control, regardless of whether the server is in Frankfurt or in Virginia. What matters, therefore, is which law the provider is subject to, not just where its data centre is located. Why this dependency affects not just AI but your entire digital workplace is explained in our article Why Europe needs sovereign AI and a sovereign Office. Here, the focus is on what you can check in concrete terms.
The AI Act still provides one tool
There is one thing you should make use of: since August 2025, providers of large AI models have had to publish a public summary of their training data, using a mandatory EU template that explicitly includes a remarkable question: was this model trained on data from user interactions? These documents must be displayed prominently on the provider's website and updated every six months.
Read them. They state, signed by the provider itself, whether your inputs from yesterday feed tomorrow's model. Depending on the service, plan and settings, inputs may be used for training. That is a separate data processing operation which requires its own legal basis and which you can exclude contractually if you ask for it.
Seven questions for every AI provider
Because the AI Act does not answer the data question for you, you have to ask it yourself. Seven questions that every provider should be able to answer precisely. Evasion is also an answer:
- First: In which country do the production systems run, and in which country the backups?
- Second: Is there a genuine EU-only option in which not a single processing step leaves the EU?
- Third: Are my inputs and documents used to train your models, and where is this contractually excluded?
- Fourth: Who are your subprocessors, and in which countries are they based?
- Fifth: From which jurisdictions can your support and engineering staff access customer data?
- Sixth: Are you, or is any group company, subject to the CLOUD Act, and how do you address this technically, not just contractually?
- Seventh: Which transfer mechanism covers every single cross-border data flow, and when was it last reviewed?
With US providers, the jurisdiction already answers some of these questions: a US group cannot contractually exclude the CLOUD Act.
Our answer: transparency needs no footnotes
At Nexoria, we used these seven questions as a blueprint. Files, databases and the knowledge index of the core platform are stored on servers in Germany; semantic search is also processed there. AI answer generation is performed by Mistral AI in France. The data transmitted by Nexoria to Mistral AI is not used for model training. This exclusion is agreed in the data processing agreement between Nexoria and Mistral AI. The statement refers to the Nexoria configuration and the contract with Mistral AI; it is not a general statement about all of Mistral AI's offerings. ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these connections. When connected, shared content is transmitted to the respective provider. Its terms, processing locations and settings apply. Other service providers and optional integrations are listed under Security with a separate description for each.
That is the standard the AI Act does not set, but one you can set. The Regulation brings order to the question of how AI is built and labelled. The question of who you entrust your data to is still one that nobody answers for you. Nor is it a legal question. It is a business one. And it arises now.