The EU AI Act: what already applies to companies and startups, and what is delayed to 2027

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) applies in phases. In 2026 it already requires any company using AI to train its staff, avoid prohibited practices and, since 2 August 2026, disclose when people are talking to a chatbot or seeing AI-generated content. The most demanding obligations, for high-risk systems such as credit scoring, have been delayed to 2 December 2027.

At a glance

• Since February 2025: prohibited practices and AI literacy obligation.
• Since August 2025: obligations for general-purpose AI models and the penalty regime.
• Since 2 August 2026: transparency (chatbots, deepfakes, generated content).
• Delayed by the Digital Omnibus: Annex III high-risk (for example, assessing people’s creditworthiness) to 2 December 2027; Annex I to 2 August 2028.

What the AI Act is

It is the world’s first general law on artificial intelligence. It classifies AI systems by risk level, with more obligations the higher the risk:

1. Unacceptable risk: banned (for example, social scoring or manipulation exploiting vulnerabilities).
2. High risk: allowed with strict requirements on data, documentation, human oversight and registration.
3. Limited risk: transparency obligations.
4. Minimal risk: no specific obligations beyond AI literacy.

It entered into force on 1 August 2024 and applies in stages.

The timeline after the Digital Omnibus

In June 2026 the European Union adopted the Digital Omnibus, which pushed back part of the timeline. This is how it stands:

What it means for banks, fintechs and financial startups

• Credit scoring and insurance: assessing the creditworthiness of individuals or pricing life and health insurance with AI are high-risk Annex III use cases. There is more time, until December 2027, but the requirements (data quality, technical documentation, human oversight) take time: start now.
• Customer service chatbots: since August 2026, customers must know they are talking to an AI.
• Generated content: synthetic images, audio or video that look real must be labelled as such.
• Training: staff using AI must have sufficient AI literacy. This obligation already applies.

Who supervises it in Spain

The Spanish Agency for the Supervision of Artificial Intelligence (AESIA), based in A Coruña, is the reference authority, alongside sector supervisors (for example, the Bank of Spain or the CNMV in their areas). Fines for prohibited practices can reach €35 million or 7% of global turnover.

Starter checklist

1. Build an inventory of the AI systems your company uses (including vendors’).
2. Classify each one by risk level.
3. Check that none falls under prohibited practices.
4. Roll out and document AI training for your team.
5. Add transparency notices to chatbots and generated content.
6. If you have high-risk use cases, prepare a plan to comply before December 2027.

Frequently asked questions

Does the AI Act affect a small startup?

Yes, if it develops or uses AI in the EU. Obligations depend on the system’s risk, not company size, although there are support measures for SMEs such as regulatory sandboxes.

Does using ChatGPT or Claude at work create obligations?

As a user, mainly team AI literacy and transparency if you publish generated content or use it to serve customers.

What did the Digital Omnibus change?

It delayed the high-risk obligations. Prohibitions, AI literacy, general-purpose model rules and transparency keep their timeline.

Applied AI in payments, trading and analysis was one of the themes of DEXT FORCE 2025 (DF25 recap). It returns in 2027: join the waitlist.

This article is for information only and is not legal advice.