EU AI Act — what applies and when (2026 Omnibus)

Prohibited AI practices Art. 5from 2025-02-02

Bans placing on the market or using AI for subliminal/manipulative or deceptive techniques causing significant harm, exploiting vulnerabilities (age, disability, social/economic situation), social scoring, predictive criminal risk profiling of individuals, untargeted facial-image scraping, emotion recognition in workplaces and schools (with safety/medical exceptions), certain biometric categorisation and real-time remote biometric identification. From 2 Dec 2026 the Omnibus adds prohibitions on nudification apps and synthetic CSAM.

Evidence commonly relevant: AI system inventory with use-case classification; Prohibited-practice screening record for each system; Emotion-recognition / biometric use decisions documented

AI literacy of staff Art. 4 (as replaced by Reg. 2026/1744)from 2025-02-02

Providers and deployers must take measures to support the development of AI literacy of staff and other persons operating or using AI systems on their behalf, considering their technical knowledge, the context of use and the people affected. The Omnibus text states this does not require guaranteeing any specific literacy level for any individual.

Evidence commonly relevant: Training plan and completion records; Role-based AI literacy curriculum; Attendance/assessment logs

High-risk: risk management system Art. 9from 2027-12-02

Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk management system across the system lifecycle, identifying and mitigating reasonably foreseeable risks to health, safety and fundamental rights, including testing.

Evidence commonly relevant: Risk register per high-risk system; Test plans and results; Residual-risk acceptance sign-off

High-risk: data and data governance Art. 10from 2027-12-02

Training, validation and testing datasets for high-risk systems must meet quality criteria: appropriate governance practices, relevance, representativeness, error-freeness as far as possible, statistical properties for the people affected, and examination for possible biases.

Evidence commonly relevant: Dataset datasheets / provenance records; Bias examination reports; Data quality checks

High-risk: technical documentation Art. 11 and Annex IVfrom 2027-12-02

Technical documentation must be drawn up before a high-risk system is placed on the market or put into service and kept up to date, demonstrating compliance with the Section 2 requirements and giving authorities the information needed to assess it.

Evidence commonly relevant: Annex IV technical file; Version history; Conformity assessment records

High-risk: record-keeping (logging) Art. 12from 2027-12-02

High-risk systems must technically allow automatic recording of events (logs) over their lifetime to ensure traceability appropriate to the intended purpose.

Evidence commonly relevant: Logging design specification; Sample logs; Retention configuration

High-risk: transparency and instructions for use Art. 13from 2027-12-02

High-risk systems must be designed so deployers can interpret and use the output appropriately, and must be accompanied by instructions for use covering provider identity, characteristics, capabilities, limitations, performance, human-oversight measures and expected lifetime.

Evidence commonly relevant: Instructions for use document; Model/system cards; Known-limitation statements

High-risk: human oversight by design Art. 14from 2027-12-02

High-risk systems must be designed, including with human-machine interface tools, so that natural persons can effectively oversee them during use, understand capabilities and limitations, avoid automation bias, and be able to override, interrupt or stop the system.

Evidence commonly relevant: Oversight design specification; Override / stop mechanism evidence; Operator guidance

High-risk: accuracy, robustness and cybersecurity Art. 15from 2027-12-02

High-risk systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle; accuracy levels and metrics must be declared in the instructions for use.

Evidence commonly relevant: Accuracy metrics and test reports; Robustness/adversarial testing; Security assessment

High-risk deployer: use per instructions and assign human oversight Art. 26(1)-(2), (4)from 2027-12-02

Deployers must take technical and organisational measures to use high-risk systems in accordance with the provider's instructions, assign human oversight to competent, trained and authorised persons with the necessary support, and, where they control input data, ensure it is relevant and sufficiently representative.

Evidence commonly relevant: Named oversight owners per system; Operating procedures aligned to instructions for use; Input-data quality checks

High-risk deployer: monitoring, incident reporting and log retention Art. 26(5)-(6)from 2027-12-02

Deployers must monitor operation per the instructions, inform the provider/distributor and market surveillance authority and suspend use where the system may present a risk, immediately report serious incidents, and keep automatically generated logs under their control for at least six months (unless other law sets a different period).

Evidence commonly relevant: Monitoring reports; Incident log and escalation records; Log retention policy (>= 6 months)

High-risk deployer: inform workers before workplace use Art. 26(7)from 2027-12-02

Before putting a high-risk AI system into service or using it at the workplace, deployers who are employers must inform workers' representatives and the affected workers that they will be subject to the system.

Evidence commonly relevant: Worker notification records; Works-council / representative consultation minutes

High-risk deployer: inform natural persons subject to decisions Art. 26(11)from 2027-12-02

Deployers of Annex III high-risk systems that make or help make decisions about natural persons must inform those persons that they are subject to the use of the high-risk AI system (in addition to any Art. 50 transparency duties).

Evidence commonly relevant: Candidate/customer notices; Privacy notice updates

Fundamental rights impact assessment (FRIA) Art. 27from 2027-12-02

Before first use of an Annex III high-risk system, deployers that are public bodies or private entities providing public services, and deployers using systems for creditworthiness/credit scoring or life and health insurance risk pricing (Annex III 5(b)-(c)), must assess the impact on fundamental rights (processes, period and frequency of use, affected persons, risks, oversight measures, mitigation) and notify the market surveillance authority.

Evidence commonly relevant: Completed FRIA; Authority notification; DPIA cross-reference

Transparency: disclose interaction with an AI system Art. 50(1)from 2026-08-02

Providers must design AI systems that interact directly with people so those people are informed they are interacting with AI, unless obvious to a reasonably well-informed person in context (law-enforcement exceptions apply).

Evidence commonly relevant: UI disclosure screenshots; Design specification for disclosure

Transparency: machine-readable marking of synthetic content Art. 50(2); Omnibus transitional clausefrom 2026-08-02

Providers of AI systems (including GPAI systems) that generate synthetic audio, image, video or text must ensure outputs are marked in a machine-readable format and detectable as artificially generated, using effective, interoperable and robust techniques as far as technically feasible. Systems placed on the market before 2 August 2026 have until 2 December 2026 to comply.

Evidence commonly relevant: Watermarking / provenance implementation evidence; Detectability test results

Transparency: notice for emotion recognition and biometric categorisation Art. 50(3)from 2026-08-02

Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them and process personal data in line with GDPR and related law (law-enforcement exceptions apply). Note workplace and education emotion recognition is separately prohibited by Art. 5.

Evidence commonly relevant: Notice text and placement; DPIA for biometric processing

Transparency: deepfake and AI-generated public-interest text disclosure Art. 50(4)from 2026-08-02

Deployers of systems generating or manipulating image, audio or video constituting a deep fake must disclose that the content is artificially generated or manipulated; deployers publishing AI-generated text to inform the public on matters of public interest must disclose it unless human review/editorial responsibility applies.

Evidence commonly relevant: Labelling policy; Examples of labelled outputs

General-purpose AI model provider obligations Art. 53 (and Art. 55 for systemic-risk models)from 2025-08-02

Providers of GPAI models must maintain technical documentation (Annex XI), provide information and documentation to downstream AI-system providers (Annex XII), adopt a copyright-compliance policy and publish a summary of training content; models with systemic risk face additional evaluation, risk-mitigation, incident-reporting and cybersecurity duties.

Evidence commonly relevant: Annex XI/XII documentation; Copyright policy; Training-content summary

Right not to be subject to solely automated decisions Art. 22from 2018-05-25

Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless it is necessary for a contract, authorised by law, or based on explicit consent; in the contract/consent cases the controller must provide safeguards including human intervention, the right to express a view and to contest the decision. Such decisions may not rely on special-category data without a specific basis.

Evidence commonly relevant: Lawful-basis analysis for automated decisions; Human-review workflow; Contest/appeal records

Data protection impact assessment Art. 35from 2018-05-25

Before processing likely to result in high risk, especially using new technologies, the controller must carry out a DPIA; it is specifically required for systematic and extensive evaluation based on automated processing/profiling with significant effects, large-scale special-category data, and large-scale public monitoring. The DPO must be consulted where designated.

Evidence commonly relevant: Completed DPIA; DPO consultation record; Prior consultation with authority if residual high risk

Transparency about automated decision-making logic Art. 13(2)(f), Art. 14(2)(g)from 2018-05-25

When collecting personal data, controllers must inform individuals of the existence of automated decision-making including profiling under Art. 22 and, at least in those cases, give meaningful information about the logic involved and the significance and envisaged consequences for the individual.

Evidence commonly relevant: Privacy notice with ADM section; Plain-language logic explanation