EU AI Act

The EU AI Act regulates the development and use of artificial intelligence across all organisations with operations inside the European Union.

If your organisation operates in or sells into the EU, the EU AI Act applies to you. It applies a risk-based framework, meaning obligations depend on how an AI system is used rather than the technology itself. Following the Digital Omnibus simplification package, several key deadlines have changed.

This article sets out the structure of the Act, what has changed, and what businesses should be doing to prepare.

The Structure of the AI Act

The Act divides AI systems into four risk tiers. Classification depends on the use case a system is deployed for, or, in some cases, on its role as a safety component within a product that is already regulated.

1. Prohibited practices

   A defined list of practices banned outright, including social scoring, manipulative or exploitative systems, and most real-time biometric categorisation. Following the Digital Omnibus, this list now also includes AI systems that generate non-consensual intimate imagery or child sexual abuse material. These provisions have applied since February 2025.

2. High-risk systems

   Systems used within eight defined domains, including employment, education, essential services and law enforcement, or embedded as safety components in regulated products such as medical devices or machinery. These carry obligations relating to conformity assessment, technical documentation and human oversight.

3. Transparency obligations (limited risk)

   Systems such as chatbots, deepfake generators, and emotion recognition tools, where the obligation is to inform the person interacting with or exposed to the system. These obligations are set out in Article 50

    

4. Minimal risk

   All other AI systems. No mandatory obligations apply, though voluntary codes of conduct are encouraged.

General-purpose AI models are subject to a separate set of obligations under Articles 51 to 55, covering technical documentation, copyright compliance and, for the most capable models, systemic risk assessment. These provisions have applied since August 2025.

What Changed on 29 June 2026

On 29 June 2026, the Council of the EU gave final approval to the AI Act Digital Omnibus package, following the European Parliament's endorsement on 16 June 2026. The revision was made because the technical standards required to implement the high-risk obligations were not going to be ready in time for the original deadline.

The revised dates are as follows.

• 2 August 2026. Article 50 transparency obligations apply, including AI-interaction disclosure, biometric and emotion-recognition notices, and deepfake labelling. Watermarking obligations under Article 50(2) apply immediately to systems placed on the market from this date.

• 2 December 2026. Watermarking obligations take effect for systems already on the market before 2 August 2026. The new prohibition on AI-generated non-consensual intimate imagery and CSAM also takes effect.

• 2 August 2027. Deadline for Member States to establish national AI regulatory sandboxes.

• 2 December 2027. Stand-alone high-risk obligations under Annex III apply.

• 2 August 2028. High-risk obligations apply to AI systems embedded in already-regulated products under Annex I.

These changes affect the high-risk timeline only. They do not amend the prohibited practices already in force, the GPAI obligations in force since August 2025, or, with the single exception of watermarking, the Article 50 transparency obligations.

Multilingual Compliance Requirements

Businesses operating across more than one EU member state should note that AI Act compliance carries a language dimension that is easy to underestimate.

• Instructions for use. Under Article 13, instructions for use for high-risk systems must be provided in a form that the intended deployer can understand.
• Transparency notices. Under Article 50, a disclosure must function as a disclosure for the person receiving it. A notice that is accurate in the source language but unclear or inaccurate in a translated version does not meet this standard.
• Technical documentation. Technical files supporting conformity assessment may need to be produced or made available in the language of the relevant national competent authority.
• Verification, not just translation. Producing a translated version of a compliance document is not the same as confirming it is correct. Where a document may be relied upon by a regulator, a court, or an affected individual, the translated version should be checked and signed off by a qualified reviewer, with that verification recorded.

Suggested Readiness Checklist

Use this as a starting point for an internal review.

• Identified every AI system in use, including internally built and procured tools
• Classified each system against the four risk tiers, with reasoning documented
• Confirmed which Article 50 transparency obligations apply, and whether they will be ready by 2 August 2026
• Established human oversight procedures for systems that may fall within the high-risk tier
• Reviewed data protection and security controls alongside AI Act obligations
• Identified every language in which a transparency notice, disclosure or technical document must appear
• Assigned a named, accountable person to verify each language version, not only the source-language version
• Retained evidence of that verification, separate from the translated document itself

How Guildhawk Can Help

Guildhawk provides verification services for multilingual, high-stakes AI content used by regulated organisations, backed by ISO 27001 and ISO 9001 certification and 25 years of experience in the field.

Speak with our compliance team about verifying your AI Act documentation across all required languages.