The AI Act from the EU: What It Means for Digital Experiences

The European Union’s AI Act (Regulation (EU) 2024/1689) establishes a comprehensive, risk-based framework for developing, supplying, and using artificial intelligence (AI).

Published on 12 July 2024 and entering into force on 1 August 2024, the Act introduced obligations in stages during 2025 and 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and amended several requirements, including the application dates for high-risk AI.

For digital experience professionals, the priority is to distinguish rules that already apply—particularly prohibitions, AI literacy, general-purpose AI obligations, and transparency—from high-risk requirements with later deadlines. This article reflects the EU framework as of 23 October 2026.

Regulations with Global Impact

The AI Act can apply to organizations outside the EU, including those in the United States, that place AI systems or general-purpose AI models on the EU market. It also covers providers and deployers outside the EU where their AI systems’ outputs are used in the EU, subject to the Act’s scope and exceptions.

A physical presence in Europe is therefore not always necessary for obligations to arise. Assess your role, intended markets, and how outputs are used, rather than assuming that every overseas organization—or every AI use affecting an EU resident—automatically falls within scope.

Definition of an AI System

Article 3(1) defines an AI system by its functionality, including autonomy and inference, rather than its marketing label. The definition can be summarized as follows:

An AI system uses machine-based inference to turn inputs into outputs, such as content, predictions, recommendations, or decisions, towards explicit or implicit objectives. It operates with varying autonomy, may adapt after deployment, and can influence physical or virtual environments.

This is a summary rather than a verbatim legal definition. Evaluate whether each digital tool meets the full definition, then assess its intended purpose and your organization’s role to determine the applicable obligations.

Categorizing Risks in AI Systems

The Act’s approach is commonly explained through four risk categories. These are a useful starting point, but transparency duties and other obligations can overlap with high-risk requirements:

1. Unacceptable Risk: Specifically prohibited practices, including certain manipulative uses, social scoring, and emotion recognition in workplaces or educational institutions, subject to defined exceptions. The original prohibitions have applied since 2 February 2025.
2. High Risk: Certain uses in areas such as recruitment, education, and access to essential services, plus qualifying AI systems in regulated products. Classification depends on the statutory criteria, intended purpose, and relevant exceptions.
3. Limited Risk: Often used to describe systems subject to transparency duties, such as chatbots and certain generative AI systems. Article 50 specifies which disclosures and technical marking duties apply.
4. Minimal Risk: Many routine applications, such as ordinary spam filtering, face no additional system-specific requirements. Applicable AI literacy duties and other laws, including data protection and consumer protection rules, still need consideration.

A content drafting assistant is not automatically high-risk because it uses a powerful model. Its function and intended use matter: a tool that helps write website copy raises different questions from one that screens job applicants or assesses eligibility for public benefits.

See also: AI for Content Editors: How to Create Real Quality Content »

Obligations for Providers and Deployers

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses a system under its authority for professional purposes. An organization can hold both roles. Responsibilities include:

• High-Risk AI Systems: When the relevant requirements apply, providers must meet obligations covering risk and quality management, documentation, conformity assessment, and system performance. Deployers must follow instructions, assign competent human oversight, monitor operation, retain relevant logs, and handle risks and incidents.
• Limited-Risk AI Systems: Article 50 assigns different transparency duties to providers and deployers. Providers must enable required interaction notices and machine-readable marking; deployers must disclose deepfakes and certain AI-generated public-interest text, subject to the applicable exceptions.

For editorial teams, this means agreeing who provides each AI feature, who publishes its outputs, and who is responsible for notices and review. Using a third-party service does not remove your organization’s own deployer obligations.

General-Purpose AI and Systemic Risks

General-purpose AI (GPAI) model rules apply to model providers, rather than automatically to every organization using a model through an API or CMS. The obligations started applying on 2 August 2025 for models newly placed on the market. They include:

• Maintaining technical documentation and supplying information to downstream system providers about model capabilities and limitations, subject to applicable exemptions.
• Implementing a policy to comply with EU copyright law and publishing a sufficiently detailed summary of the content used for training.
• For models with systemic risk, conducting model evaluations and risk assessment and mitigation, reporting serious incidents, and ensuring adequate cybersecurity protections.

The voluntary GPAI Code of Practice was published on 10 July 2025 and endorsed by the Commission and AI Board on 1 August 2025 as a means of demonstrating compliance. Commission enforcement powers, including fines, apply from 2 August 2026. Providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply.

Timeline for Compliance

The 2025–2026 milestones should now be treated as operational requirements, rather than distant preparation dates. Following the July 2026 amendments, the key milestones are:

• 2 February 2025: General provisions, including AI literacy, and the original prohibited practices became applicable. Article 4, as amended in July 2026, requires measures supporting staff AI literacy without guaranteeing a specific level for each individual.
• 2 August 2025: GPAI model obligations and governance provisions became applicable, alongside requirements for Member States to designate competent authorities and establish national penalty rules.
• 2 August 2026: Most remaining provisions became applicable, including Article 50 transparency obligations and enforcement powers for applicable rules. The July 2026 amendments postponed the main high-risk requirements, so this was not a universal high-risk compliance deadline.

The next milestone is 2 December 2026: providers of generative AI systems placed on the market before 2 August 2026 must comply with Article 50(2)’s machine-readable marking requirement, and new prohibitions concerning non-consensual sexual or intimate content and child sexual abuse material apply. The main high-risk requirements apply from 2 December 2027 for Annex III systems and 2 August 2028 for qualifying Annex I product-related systems, subject to transitional provisions for existing systems.

Implications for Digital Experiences

The clearest immediate impact for many websites, apps, and CMS workflows is transparency. Since 2 August 2026, teams must assess which Article 50 duties apply to their particular systems and content:

• User Transparency: Providers must ensure that people are informed when interacting directly with AI, such as a chatbot or customer-facing agent, unless this is already obvious in context. Required notices must be clear, accessible, and provided by the first interaction.
• Content Integrity: Providers of generative AI systems must enable machine-readable marking and detectability, within the scope and technical qualifications of Article 50(2). Standard editing assistance can fall outside the marking duty. Publishers using AI must disclose deepfakes and relevant AI-generated or manipulated public-interest text. Copyright and data protection obligations also remain relevant.
• System Design: Build appropriate disclosure, provenance, review, and record-keeping into your workflows. Check whether content transformations preserve required marking and whether publishing processes support any necessary visible or audible disclosures.

The Act does not require a visible label on every AI-assisted article. For text published to inform the public on matters of public interest, the disclosure exception requires human review or editorial control and a person or organization holding editorial responsibility. Superficial spelling or grammar checks alone are insufficient. This exception concerns the publisher’s text disclosure duty; it does not remove a provider’s separate technical marking duty.

Steps to Prepare for Compliance

1. Audit Your AI Systems: Inventory your tools and use cases, assess scope and intended purpose, and identify whether you act as a provider, deployer, or both. Check prohibited uses separately from high-risk classification.
2. Update Documentation: Keep records proportionate to your obligations, including supplier information, system purposes, review procedures, and responsibility assignments. Obtain the technical and compliance information required for your role.
3. Enhance Transparency: Check interaction notices, deepfake disclosures, public-interest text review, and machine-readable marking. Distinguish the obligations already applicable from the specific 2 December 2026 transition for certain existing generative AI systems.
4. Perform Impact Assessments: Determine whether your deployment requires a fundamental rights impact assessment under Article 27 or a data protection impact assessment under the GDPR. These duties have different triggers; neither is automatically required for every AI tool.
5. Train Your Teams: Support AI literacy through training suited to people’s roles, experience, and use cases. Cover model limitations, responsible data handling, meaningful editorial review, and escalation when outputs or system behavior raise concerns.

Prioritize the rules already in application, address the remaining 2026 transition where relevant, and plan separately for future high-risk deadlines. Treat compliance as an ongoing responsibility as tools, use cases, and guidance evolve.

First published 2 October 2024, updated 23 October 2026.