The EU AI Act in 2026: what must your organisation have in place?

The AI Act timeline after the Digital Omnibus

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. In 2026 that timeline was changed by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on 27 July 2026. The key dates now:

A delay is not a cancellation. The substance of the high-risk requirements largely stays the same; you only get more time.

Are you a provider or a deployer?

The AI Act places most duties on the provider: the party that develops an AI system and places it on the market. Most organisations are deployers: they use an AI system under their own authority, for their own work.

Note that you can become a provider without noticing. For example, if you put an AI system into service under your own name, or modify a system so that it becomes a high-risk application. If you build AI automations yourself on an open-weight model, have your role assessed.

What must you have in place as a deployer now?

1. No prohibited practices. Think of emotion recognition at work or in education, social scoring and manipulative techniques. Check that none of your tools does this, not even as a side feature.
2. AI literacy. Article 4 asks you to support the AI literacy of staff who work with AI. The Digital Omnibus softened this from an obligation to achieve a level into a duty to support, but the duty remains. In practice: training, an AI policy and guidance on what may and may not go into a model.
3. Transparency. If customers or citizens talk to a chatbot, they must know it is AI. If you publish AI-generated text on matters of public interest, or images that look real, you generally have to disclose that.
4. An AI register. Not mandatory for every deployer, but indispensable: which AI systems do you use, for what, with which data and at which risk level? Without that overview you cannot answer any of the other questions.
5. Preparing for high risk. Do you use AI in recruitment, staff evaluation, access to education or credit scoring? From December 2027 this brings duties including human oversight, logging, keeping logs and informing the people concerned. Public bodies and certain other parties must then also carry out a fundamental rights impact assessment.

The AI Act comes on top of the GDPR, not instead of it

Many questions about AI at work are not AI Act questions but GDPR questions. May an employee put customer data into a chatbot? Do you have a data processing agreement? Is a DPIA needed? Those questions apply already, regardless of the risk level the AI Act assigns to an application. See Is ChatGPT GDPR-compliant? and Shadow AI.

What helps: AI you can account for

The common thread in the AI Act is accountability: knowing which AI runs, who uses it, and being able to show what happened. That is hard when AI is scattered across personal accounts and separate SaaS tools. It becomes easier when AI runs in one place that you manage yourself.

With private AI from werqly, the models run on a node of your own, and werqly AI Control records per prompt, model and automation who did what and when. You set the retention period yourself, and export the audit log to your SIEM. Model provenance is transparent: only open-weight models such as Llama, Mistral and Qwen. And you record the policy on how much insight the organisation has into use, so the DPO and works council can inspect it.