The EU AI Act for Organisations That Use AI: What Changed in July 2026, and What to Do First
Most organisations meet the EU AI Act as users of AI, not builders of it. This is what the Act asks of a deployer, what the Digital Omnibus on AI moved, and the first three things to do — for small and medium-sized businesses, and for the IT and compliance practices that support them.
You are probably a deployer
The EU AI Act (Regulation (EU) 2024/1689) sorts organisations by their role for each AI system. A provider develops a system, or has it developed, and puts it on the market under its own name. A deployer uses an AI system under its own authority in the course of its work. Most small and medium-sized businesses are deployers: they use a chatbot on their website, a CV-screening tool in recruitment, a writing or meeting assistant, a scoring model inside a lending or insurance platform.
The duties follow the system, not the organisation. The same business can be a deployer of one tool and the provider of another it built itself, with different duties for each. So the first piece of work is a list.
What already applies
Two parts of the Act have applied since 2 February 2025.
- Prohibited practices (Article 5). A short list of uses is banned outright — among them social scoring, inferring emotions in the workplace or in education, and untargeted scraping of facial images. The Digital Omnibus on AI added two more from 2 December 2026: AI that generates non-consensual intimate images of an identifiable person, and AI that generates child sexual abuse material.
- AI literacy (Article 4). Providers and deployers take measures to support the AI literacy of their staff and of anyone using AI systems on their behalf. Since 27 July 2026 the Article reads this way: measures that support the development of literacy, with no particular level that any one person must reach.
From 2 August 2026 the Act generally applies, including the transparency duties in Article 50: people must be told when they are interacting with an AI system, synthetic content must be marked, and a deployer discloses deep fakes and AI-generated text published to inform the public.
What the Digital Omnibus moved
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026. It moved the high-risk rules — which had been due on 2 August 2026 — to 2 December 2027 for the systems listed in Annex III, and to 2 August 2028 for AI in products covered by EU product-safety law. The deployer duties in Articles 26 and 27 move with them.
Is any of your AI high-risk?
A system is high-risk if it is used in one of the Annex III areas: biometrics; critical infrastructure; education and vocational training; employment and the management of workers; access to essential services and benefits, including credit scoring and life and health insurance pricing; law enforcement; migration; and justice. An Annex III system can fall outside under Article 6(3) where it poses no significant risk of harm on one of four narrow conditions — but never where it profiles people.
For a deployer of a high-risk system the main duties are: use it as the provider instructs; assign human oversight to people with the competence and authority to exercise it; monitor it and act on what you find; keep its logs for at least six months; tell workers and their representatives before using it at work; and tell the people it makes decisions about. Some deployers — bodies governed by public law, private entities providing public services, and anyone using AI for credit scoring or for life and health insurance pricing — also carry out a fundamental rights impact assessment before first use and notify the market surveillance authority of the results.
The first three things to do
- List the AI systems you use. For each: what it is for, who supplies it, your role for it, who owns it in the business and who oversees it.
- Work out which rules each one falls under, starting with the prohibited practices and the Annex III areas. Record what you decided and why — the decision is yours to make and to explain.
- Start the records the Act already asks for: who has been trained on each system, on what and when.
For IT and compliance practices
The same list, kept per client, is where an AI Act engagement starts. Each client’s register should sit with the rest of its records, and its determinations should be the client’s own, with the reasoning written down.
How Vivid Risk helps — and what it does not do
The Vivid Risk AI Act workspace keeps a register of the AI systems you use, walks through each system’s classification one article at a time and shows what your answers indicate, lists the duties for your role with the article behind each, and keeps your records, including a fundamental rights impact assessment structured to Article 27(1). It does not classify your systems for you, does not certify anything, does not carry out a conformity assessment, and does not file, register or notify anything with anyone. It is not legal advice.