EU AI Act: what it requires and how to prepare
The EU AI Act (EU 2024/1689) regulates AI systems by their risk, on a staggered timeline. Moreover, from 2 August 2026, the transparency obligations (Art. 50) apply, on top of governance and the penalty regime, which have applied since August 2025. So if your company uses or develops AI, the AI Act affects you. Atalaya GRC also helps you have your AI inventoried and classified in time.
No commitment. We’ll walk you through the platform with a real case.
- Reference
- Reg. (EU) 2024/1689
- Applies from
- 2 Aug 2026 · high-risk 2 Dec 2027
- Who
- Providers and deployers of AI systems
- If you don’t comply
- Up to €35M or 7% of turnover
What is the EU AI Act?
It’s the first European framework regulating AI by risk level (unacceptable, high, limited, minimal). The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies progressively. For example, prohibited practices and staff training have applied since February 2025, while the rules for general-purpose models (GPAI) have applied since August 2025.
What changed in the AI Act in August 2026?
On 2 August 2026, the AI Act transparency obligations (Art. 50) became applicable; governance and the penalty regime had already applied since 2 August 2025. However, there is an update (2026): the Digital Omnibus (Regulation (EU) 2026/1744) package —published in the EU Official Journal in July 2026 and in force since 27 July— postpones the high-risk obligations. As a result, Annex III (use-based) moves to December 2027 and Annex I (AI in regulated products) to August 2028. In addition, systems already on the market before 2 August 2026 have until 2 December 2026 to meet the Art. 50(2) marking duty. But transparency applies from August 2026, and governance has applied since August 2025. In short: “high risk” gains time, the basics don’t.
What does the AI Act require?
Therefore, these are the four fronts the AI Act asks you to cover:
AI literacy
Firstly, you must take measures to support your staff’s AI literacy (Art. 4, already enforceable; since Regulation (EU) 2026/1744 no specific level has to be guaranteed).
Inventory and classification
Then, you need to know which AI systems you use or develop and their risk level.
Transparency
You also have to tell people when AI generates content or an interaction.
High risk under the AI Act (Annex III)
Finally, risk management, technical documentation, human oversight, registration and impact assessment (with the new December 2027 deadline).
What happens if you don’t comply?
The AI Act penalty regime is among the strictest: up to €35 million or 7% of total worldwide annual turnover for the most serious breaches, whichever is higher. In Spain, moreover, the authority is the AESIA (based in A Coruña).
A timeline that’s already running
Prohibited practices and training have applied since February 2025, and general-purpose models (GPAI) and governance since August 2025. Transparency has applied since August 2026, and finally most high-risk Annex III obligations from December 2027. Each milestone has its date, so it pays to get ahead: here is the full EU AI Act timeline, date by date.
Atalaya GRC
How Atalaya GRC helps
Atalaya GRC gets you ready for the AI Act:
- An inventory of your AI systems (including the “shadow AI” your teams use), connected to the rest of your compliance.
- Risk classification and, in addition, the associated governance documentation.
- The regulatory clock tracks the timeline milestones so none catch you out.
- Everything connected: your AI therefore sits within the same compliance system, with no loose spreadsheets.
Want to see it with your own AI systems?
Request a demoBy sector: Banking and fintech Insurers
FAQ
Frequently asked questions
What has applied since August 2026?
The transparency obligations (Art. 50). Governance and the penalty regime have applied since August 2025, and AI literacy (Art. 4) since February 2025.
Wasn’t the AI Act postponed?
Partly: the Digital Omnibus (Regulation (EU) 2026/1744), published in the EU Official Journal in July 2026 and in force since 27 July, postpones the high-risk obligations —Annex III to December 2027 and Annex I to August 2028— but general transparency still applies from August 2026, and governance has applied since August 2025.
Does it affect me if I only use AI and don’t develop it?
Yes: as a deployer you have your own obligations, including staff training and compliant use.
Where do I start?
With an inventory of your AI systems and their classification by risk level.
Atalaya GRC
How Atalaya GRC helps with the EU AI Act
It also gives you an inventory of your AI systems classified by risk level (including GPAI and generative AI), with the obligations that apply to you, supporting documentation and the next key deadlines (2 December 2026 and 2 December 2027).
