EU AI Act: How to Prepare for New Obligations and Avoid Penalties

The European Union is once again leading the way in digital regulation. Following GDPR, we now have the EU AI Act, the world's first comprehensive legal framework for artificial intelligence. And what's crucial for us? As of August 2, 2026, most of its provisions have come into effect, including key transparency rules and full enforcement powers for the European Commission and national authorities. This means one thing: those who have procrastinated must now act. The penalties for non-compliance are astronomical.

What is the EU AI Act and why is it crucial now?

The EU AI Act was approved in 2024 and is being progressively implemented. Its goal is to ensure that AI systems in the EU are safe, transparent, ethical, and respect fundamental rights. The Act is based on a risk-based approach, meaning the level of regulation depends on the potential risk posed by the AI system. For companies, this means an obligation to actively assess the risk category of their AI tools and adjust internal processes accordingly. Prohibitions on unacceptable risk practices came into effect on February 2, 2025. Subsequently, obligations for providers of general-purpose AI (GPAI) models became applicable on August 2, 2025. The current date, September 28, 2026, falls within the period when key parts are already applicable, and supervisory authorities have full powers to enforce them.

Risk Categories: Where does your AI stand?

The AI Act categorizes AI systems into four levels, which determine the extent of obligations:

• Unacceptable Risk: These systems are completely prohibited. Examples include AI for social scoring, manipulative techniques influencing behavior, or certain forms of real-time remote biometric identification in public spaces. If your company uses such systems, you must cease using them immediately.
• High-Risk: These systems have the potential to cause significant harm to health, safety, or fundamental rights. They are subject to the strictest requirements, including conformity assessments, risk management, human oversight, and technical documentation. Examples include AI in critical infrastructure, education (e.g., student assessment), employment (e.g., CV screening), financial services (credit scoring), or biometric identification systems. Most common marketing activities do not fall into this category, but exceptions may include AI systems for recruitment or highly personalized offers with significant impact on an individual's life. Obligations for high-risk systems (Annex III) will apply from December 2, 2027, and for systems integrated into products (Annex I) from August 2, 2028.
• Limited-Risk: This category includes systems that require transparency so users are aware they are interacting with AI. Typical examples are chatbots or generative AI that creates content. Users must be informed that they are communicating with a machine or that the content was AI-generated. These transparency rules (Article 50) have been in effect since August 2, 2026.
• Minimal-Risk: The vast majority of AI systems, such as spam filters or AI for games, fall into this category and are not subject to any specific obligations.

Practical Obligations for Businesses

Regardless of whether you are a provider of an AI system or merely a deployer, your company has obligations. Key areas include:

• Risk Management: Establish and maintain a system for identifying, analyzing, and mitigating risks throughout the entire lifecycle of the AI system. This is not a one-time audit but a continuous process.
• Human Oversight: Ensure that humans can effectively oversee AI systems, understand their limitations, and intervene or stop the system if necessary.
• Data Quality: Training, validation, and testing datasets must be relevant, sufficiently representative, and as error-free as possible to minimize the risk of discrimination.
• Transparency (Article 50): If your company uses generative AI to create content (text, images, videos) that could be mistaken for human-made, you must clearly label it as AI-generated. This also applies to interactions with chatbots, where it must be evident that the user is communicating with AI. For synthetic media like deepfakes, even stricter labeling rules apply.
• Technical Documentation: Maintain detailed documentation on the AI system's functioning, purpose, and compliance with the Act's requirements.

Case Study: When AI runs into trouble

A European recruitment company deployed an AI system to score job applicants based on video interviews. The system evaluated candidates based on speech cadence and facial expressions. Following complaints of unfair treatment, an investigation was launched, and the system was classified as high-risk. The company had to revise the tool to include human oversight and document the model's decision-making process, as required by the AI Act. This example clearly demonstrates that even seemingly innocuous applications can have far-reaching impacts and require careful scrutiny.

Consequences of Inaction: Fines and Reputation

The penalties for non-compliance with the EU AI Act are among the strictest in digital regulation, surpassing even GDPR.

• Up to €35 million or 7% of global annual turnover (whichever is higher) for violating the prohibition of unacceptable AI practices.
• Up to €15 million or 3% of global annual turnover for non-compliance with other obligations (e.g., for high-risk systems or Article 50 transparency).
• Up to €7.5 million or 1% of global annual turnover for providing incorrect, incomplete, or misleading information.

In addition to financial sanctions, reputational damage and the forced withdrawal of non-compliant AI systems from the market are also risks. Reduced fine limits apply to small and medium-sized enterprises.

How to Prepare: Audit and Action Plan

A proactive approach is crucial. Don't be caught off guard; start preparing as soon as possible. I recommend the following steps:

EU AI Act Readiness Checklist:

1. Inventory of AI Systems: Create a comprehensive list of all AI systems (including third-party ones) your company develops, procures, or uses. Include their purpose, functions, and geographical reach.
2. Risk Classification: For each system, determine its risk category (unacceptable, high, limited, minimal) according to the EU AI Act definitions. Pay attention to Annex III for high-risk systems.
3. Prohibition Assessment: Verify if any of your AI functions fall into the unacceptable risk category. If so, these systems must be immediately decommissioned or fundamentally redesigned.
4. Internal Guidelines and Processes: For high-risk and limited-risk systems, implement formal risk management processes, data quality controls, human oversight mechanisms, and technical documentation frameworks.
5. Content Transparency: For all AI-generated marketing materials that could be mistaken for human creation, implement clear and consistent labeling. For chatbots, ensure users know they are interacting with AI.
6. Team Training: Ensure your employees, especially marketing specialists and developers, understand the requirements of the AI Act and internal guidelines.
7. Continuous Monitoring: Risk management is not a one-off event. It must be an ongoing process that updates with the evolution of AI systems and new risks.

When a general guide is no longer enough?

It's clear that implementing the EU AI Act is not a trivial matter. For many companies, especially those working with complex AI systems or operating in high-risk sectors (such as HR, finance, or healthcare), general advice is insufficient. In such situations, where in-depth analysis, auditing of existing systems, setting up specific risk management processes, or legal consultation is needed, engaging an experienced partner makes sense. At one-o-one.cz, we help companies with comprehensive AI governance and compliance solutions, so they can focus on innovation with the assurance that they comply with applicable legislation.

Conclusion

The EU AI Act is a reality, and its impact on businesses will be significant. It's not just another regulation but an opportunity to build trust in AI and strengthen your brand through an ethical and responsible approach. Proactive investment in compliance will pay off not only by avoiding fines but also by building trust with customers and partners. Ignoring these rules could have serious financial and reputational consequences. It's time to act.