EU AI Act

What is the EU AI Act?

The EU AI Act is a European Union law on artificial intelligence. It sorts AI uses by risk. A short list of practices is banned outright. Some uses count as high-risk and carry heavy duties. Chatbots and AI-generated content carry transparency duties.

The law assigns duties by role. A provider develops an AI system, or has it developed, and puts it on the market under its own name. A deployer uses an AI system under its own authority in a professional setting, per Article 3 of the Act. Your AI vendor is often the provider. When you switch on its AI features for your team or your customers, you may be a deployer.

In 2026 the EU passed the AI Omnibus, Regulation (EU) 2026/1744, which moved several dates. It was published in the Official Journal on July 24, 2026. As of October 2026, the main dates are:

1. February 2, 2025: the bans on prohibited practices and the AI literacy duty apply.
2. August 2, 2025: rules for general-purpose AI models apply, along with penalties.
3. August 2, 2026: most transparency rules apply, such as telling people when they are dealing with an AI system.
4. December 2, 2026: AI systems placed on the market before August 2, 2026 must mark AI-generated content in a machine-readable way, and a new ban on AI that creates sexual abuse material or non-consensual intimate images applies.
5. August 2, 2027: general-purpose AI models released before August 2, 2025 must comply.
6. December 2, 2027: high-risk rules apply to stand-alone uses listed in Annex III, moved from August 2, 2026.
7. August 2, 2028: high-risk rules apply to AI built into regulated products under Annex I, moved from August 2, 2027.

Sources for these dates: Regulation (EU) 2026/1744, the Commission's AI Act timeline and Article 111 of the Act. The Omnibus also softened the AI literacy duty: companies must now support AI literacy among their staff rather than ensure a set level of it.

What it looks like in a vendor's terms

AI Act language often shows up in a vendor's AI terms or acceptable use policy. A typical clause reads like this:

Customer will not use the AI Features for any practice prohibited by the EU AI Act or for any high-risk use unless agreed in writing. Customer is responsible for meeting its obligations as a deployer, including telling end users when they interact with AI. Provider will make available information reasonably needed for Customer to meet those obligations.

• Prohibited and high-risk uses: the vendor rules out uses it does not want to support.
• Deployer obligations: the vendor puts your own duties, such as disclosure to users, on you.
• Information: what the vendor promises to give you so you can comply.

A real change we caught

Venpo flagged that Anthropic will let AI approve a claim without a human, but not deny one. From November 12, 2026, Anthropic's Usage Policy no longer requires a person to review a wholly favorable AI recommendation in four listed cases, while denials still need that review. Human oversight is central to how the AI Act treats high-risk uses, so this kind of change is worth reading closely.

Why it matters to you

High-risk is closer than it sounds. Employment uses count as high-risk, including recruiting and selecting candidates, evaluating performance and deciding promotions or terminations, per Annex III of the Act. An HR or hiring tool with AI features can land you there.

Fines are large. The ceilings are 35 million euros or 7% of worldwide annual turnover for prohibited practices and 15 million euros or 3% for most other obligations, including transparency, per Article 99 of the Act.

Your customers will ask. EU customers may want to know which AI providers sit behind your features and how you meet the transparency rules. That depends on what your own vendors tell you. See AI subprocessor.

What to check

• Which of your vendors' AI features you use, and whether any touch hiring, credit or other decisions about people.
• Whether the vendor's AI terms call you a deployer and list duties it expects you to meet.
• Whether the vendor says how it labels AI-generated content and discloses AI chat to users.
• Whether AI features are switched on by default. See AI features enabled by default.
• Whether the vendor trains its models on your data, a separate question from the AI Act.

How Venpo helps

Venpo watches your vendors' AI terms, acceptable use policies, privacy policies and subprocessor lists and emails you a plain-English alert when AI language changes. The Fine Print Scan answers, for each vendor, whether it trains AI on your data.