EU AI Act: what it is, who it applies to and key dates

What is the EU AI Act?

The AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. It sets uniform rules for AI systems across the EU.

It is risk-based. Some practices are prohibited, such as manipulation that exploits people's vulnerabilities or social scoring. High-risk systems, such as AI for hiring and employee evaluation, carry detailed obligations. Systems people talk to or that generate content have transparency duties. Everything else, which covers most business use, has no extra requirements beyond AI literacy.

In 2026 the rules were amended by Regulation (EU) 2026/1744, known as the Digital Omnibus on AI. It was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It postponed the high-risk deadlines and softened Article 4: instead of ensuring staff AI literacy, companies must take measures to support its development.

When does the AI Act apply? All key dates

1 August 2024: the regulation enters into force. 2 February 2025: prohibited practices (Article 5) and AI literacy (Article 4). 2 August 2025: obligations for general-purpose AI model providers, governance and penalties.

2 August 2026: general application, including the Article 50 transparency duties, and the European Commission can enforce the obligations of general-purpose AI model providers. 2 December 2026: a new prohibition on systems generating non-consensual intimate imagery and child sexual abuse material, added by the Digital Omnibus, and the end of the transition period for machine-readable marking by systems placed on the market before 2 August 2026.

2 December 2027: high-risk systems in Annex III, including biometrics, critical infrastructure, education, employment and access to services. This was originally 2 August 2026. 2 August 2028: AI systems built into products covered by EU product safety law, such as toys or lifts (Annex I).

Does the AI Act apply in Poland?

Yes. An EU regulation applies directly in every member state without being transposed into national law. Member states only need to designate supervisory authorities and set penalty rules.

In Poland this is done by the Act of 3 July 2026 on artificial intelligence systems (Journal of Laws 2026, item 1003), published on 27 July 2026. It entered into force on 11 August 2026. The provisions on inspections, proceedings before the authority, settlements on reduced sanctions and administrative fines (chapters 3-5 and 8), as well as on the authority's opinions and explanations (Articles 8-18) and amendments to other acts (chapter 9), enter into force on 28 October 2026.

The market surveillance authority is the Commission for the Development and Safety of Artificial Intelligence (KRiBSI). The act also sets up a regulatory sandbox. Micro, small and medium enterprises take part free of charge (Article 93(1)).

The KRiBSI chair is appointed by the Sejm with the consent of the Senate (Article 28). According to the Ministry of Digital Affairs, the chair is to be appointed within two months of the act entering into force and the full commission within three months, that is in autumn 2026. Whether those dates will hold is not known yet. Until then the authority is still being set up.

Who does the AI Act apply to?

Providers, meaning companies that develop an AI system or model and place it on the market under their own name. Deployers, meaning companies that use AI in their business. Also importers and distributors. It covers non-EU companies too if their system is used in the EU.

A typical company is a deployer. That leaves three things to check: staff AI literacy (Article 4), transparency duties if you run an AI chat for customers or publish AI-generated content (Article 50), and deployer obligations for high-risk systems (Article 26) if, for example, you use AI to screen job candidates.

The AI Act does not cover purely personal use, military purposes or scientific research before market placement. It does not replace the GDPR: when AI processes personal data, both apply side by side. How to turn this into team rules is covered in AI use policy for companies.

AI Act Article 50: how to label AI-generated content

Article 50 applies from 2 August 2026. It splits duties between providers and deployers.

A provider must design the system so people know they are interacting with AI, unless it is obvious. A provider of a system generating text, images, audio or video must mark outputs in a machine-readable way, for example with a watermark or metadata. Systems placed on the market before 2 August 2026 have until 2 December 2026 to do so.

A deployer, usually your company, must clearly disclose deepfakes, meaning images, audio or video resembling real people, places or events. It must also disclose that text on matters of public interest was AI-generated, unless it went through human editorial review by someone who takes responsibility for it. For artistic and satirical works, a disclosure that does not spoil the work is enough. How to spot deepfakes is covered in how to spot a deepfake.

The European Commission has published a voluntary Code of Practice on Transparency of AI-generated Content and a set of EU icons for labelling. According to the Commission, about 190 organisations had signed the code by the end of July 2026. The code is voluntary; the Article 50 duties are not.

What are the penalties under the AI Act?

Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most other obligations including Article 50, and up to EUR 7.5 million or 1% for supplying incorrect information to authorities. The higher amount applies, and for SMEs the lower one. When setting a fine, the authority considers among other things the gravity and duration of the infringement, cooperation with the authority and the size of the company (Article 99(7)).

In Poland fines are imposed by KRiBSI under Chapter XII of the AI Act. The Polish act's provisions on fines apply from 28 October 2026.

What should a company do now?

1. List where you use AI, including where nobody reported it. What is shadow AI will help. 2. Mark each tool that might be high-risk (hiring, employee evaluation, customer scoring). 3. Train the team and record who completed the training.

4. If you have an AI chat on your website, make sure customers know they are talking to AI. You can check for free which third-party services, including chat widgets, your site loads. 5. If you publish AI images or video, introduce labelling. 6. Get AI hiring tools ready for 2 December 2027.