EU AI Act: what changes for businesses

The European AI Act came into full force in 2026 after a phased transition period. For many businesses, the obligations remain unclear. Here are the essential points and priority actions to take.

The regulation takes a risk-based approach. Prohibited AI systems (subliminal manipulation, social scoring) are ruled out immediately. High-risk systems — AI in recruitment, credit, security, healthcare, critical infrastructure — face the heaviest obligations. Limited or minimal risk applications benefit from lighter requirements.

For high-risk systems, obligations cover six areas: complete technical documentation, training data traceability, human oversight, robustness and accuracy, risk management, and transparency toward users. These systems must be registered in the EU AI Act database before deployment.

Sanctions are dissuasive. A prohibited system infringement can reach €35 million or 7% of global turnover. For a non-compliant high-risk system: up to €15 million or 3% of turnover. National data protection authorities (such as France's CNIL) are the enforcement bodies.

First audit procedures were launched in early 2026 across several member states. They target primarily AI systems in HR, credit and surveillance sectors. Companies that have not yet mapped their AI systems are in a weak position.

Three immediate actions: (1) map all your AI systems in production and in project, (2) assess their risk level according to the AI Act taxonomy, (3) appoint an AI Officer (an emerging role, comparable to the GDPR DPO) to drive compliance.

The AI Act is not only a constraint. It is also a competitive advantage for companies that comply proactively: their AI systems carry an implicit trust label, easily valued with clients, partners and investors. Compliance is the new differentiator.