As early as 2 August 2026, the Artificial Intelligence Act (Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, commonly known as the AI Act [1]) will become applicable. These are the first steps in artificial intelligence legislation in response to the still-developing technology that impacts not only economic benefits, but also environmental and social ones. Although the main body of the AI Act’s provisions will apply from 2 August 2026, the EU legislator has been gradually implementing the regulations – a portion of the provisions applied as of 2 February 2025 and 2 August 2025, and selected obligations regarding high-risk AI systems will apply from 2 August 2027.
This is the world’s first such comprehensive regulation responding to the rapid development of this technology. The law, as always, is chasing technology; the question, however, is how efficiently, effectively, and with an understanding of the specific nature of this technology it does so.
For business, however, this is not just another legal document. It is a fundamental change in the rules of the game that will affect how companies optimize costs, create innovations, and build competitive advantage, balancing economic benefits with safety and the rights of consumers or other vulnerable groups, such as children.
What technology are we talking about?
From an entrepreneur’s perspective, it is crucial to understand that the AI Act does not treat every technology in the same way. The Act divides artificial intelligence systems into four risk categories, which determine a company’s obligations:
- Unacceptable risk – strictly prohibited systems (e.g., those manipulating human behavior or used for so-called social scoring). In Article 5 of the AI Act, the legislator specifically highlights that prohibited systems include those that manipulate human behavior, exploit people’s vulnerabilities, generate non-consensual sexual deepfakes, depict child sexual exploitation, serve so-called social scoring, and build facial recognition databases through mass scraping of images from the internet.
- High risk – systems subject to strict requirements, audits, and certification (including systems used in HR for recruitment, in creditworthiness assessment, or in critical infrastructure). Under Regulation (EU) 2024/1689 (Article 6), a high-risk system is primarily understood as a system that both:
- a. Forms a safety component of products covered by EU harmonisation legislation (e.g., in vitro diagnostic medical devices) or the AI system itself is such a product; and
- b. Is subject to a third-party conformity assessment under EU harmonisation legislation in connection with the placing on the market or putting into service of that product.
- Limited risk – systems subject mainly to transparency obligations (e.g., chatbots, deepfakes – the user must know they are dealing with AI).
- Minimal risk – the majority of tools used in business (e.g., spam filters, recommendation systems), which can be used without additional legal restrictions. We are primarily talking about systems that present already existing content, where the risk of disinformation is negligibly low.
For each of these levels, a separate procedure should be prepared based on risk identification, risk assessment, and then adapting internal operations to these risks, taking into account corrective principles.
Who will the AI Act apply to?
The obligation entering into force regarding the proper labeling for providers and deployers of AI systems will apply to those who use AI systems in their business activities.
Furthermore, the scope of responsibility depends on the role fulfilled. The Act foresees different obligations for providers (those creating and selling AI systems) and deployers (those implementing ready-made solutions in enterprises). The AI Act defines a provider as a natural or legal person, as well as a public authority, agency, or other body that:
- a. Develops an AI system or a general-purpose AI model;
- b. Has an AI system or a general-purpose AI model developed;
- c. Places on the market or puts into service an AI system – whether for payment or free of charge, under its own name or trademark.
A deployer is a natural or legal person, public authority, agency, or other body that uses an AI system under its authority. The law excludes from this definition situations where the AI system is used in the course of a personal non-professional activity.
In its draft guidelines of 8 May 2026 [2], the European Commission also noted that professional activity is any activity from which a natural person regularly derives economic benefit or which is otherwise linked to conducting professional, business, or commercial activities, performing work, or providing services as a freelancer, and guidelines regarding personal and non-professional character should not be treated selectively.
What content labelling obligations should you prepare for?
Particular attention should be paid to Article 50 of Regulation (EU) 2024/1689, which introduces transparency obligations for providers and deployers of certain AI systems.
- Obligation to inform a natural person about entering into direct interaction with an AI system (unless this is obvious from the point of view of the natural person).
What does “obvious from the point of view of the natural person” mean?
The European Commission [3] in its draft guidelines to the AI Act specifies that the phrase “obvious from the point of view of a natural person” should be interpreted in the same way as we have interpreted the phrase “average consumer” for over 25 years. Thus, one might ask whether an average representative entering into direct interaction with an AI system is able to determine that they are speaking with such a system. The average recipient of AI systems includes not only people with a basic level of digital literacy, but also elderly individuals who may be victims of digital exclusion. In paragraph 42 of the draft guidelines, the European Commission lists non-obvious examples such as realistic robotic animals, realistic avatars, or chatbots on websites or helpdesks.
- Obligation to label content generated by an AI system (synthetic audio, image, video, text) – the regulation specifies that the labelling must be machine-readable and detectable as artificially generated or manipulated.
So how to do it in practice?
The European Commission recommends using multimodal ways of informing recipients of content created by AI systems, taking into account both the target group (children, qualified personnel) and potential recipients – examples:
- Textual information – a clear statement formulated in plain language that the user is interacting with an AI system (“You are interacting with an AI system”);
- Audio information – recommended when using an AI system in the form of voice interaction; the EU Commission cites as an example: “This is an artificial intelligence-based assistant”;
- Graphical information – permanent watermarks, a recognizable AI symbol. Social media services are increasingly introducing default labels – e.g., the social media platform TikTok allows selecting a permanent label “AI-generated content” in the settings when adding content.
The legislator has provided for exceptions to the labelling obligation – this refers to the use of an AI system for standard editing of content that does not materially alter the meaning and does not interfere in a material way with the input data or its semantics. An example of standard editing can be automatic spell checking and grammar correction in texts or improving photo quality.
- Obligation to inform about the fact of using and processing personal data in systems that make use of emotion recognition or biometrically categorize information (in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680).
- Obligation to disclose information that an image, audio, or video content constitutes a deepfake or has been otherwise manipulated.
- Obligation to inform that text published with the purpose of informing the public on matters of public interest was generated or manipulated.
It should be emphasized that from the above transparency obligations for providers and deployers of AI systems, the legislator has provided a number of exceptions, in particular for AI systems intended to be used lawfully by competent authorities for the purposes of detecting, preventing, and prosecuting criminal offenses. However, these exemptions apply subject to appropriate safeguards for the rights and freedoms of third parties and compliance with EU law.
The regulation also indicates that the deployer of an AI system is obliged to convey the information to the persons concerned in a clear and prominent manner, at the latest at the time of the first interaction or first use. The information provided must simultaneously meet applicable accessibility requirements. This means that the manner of their presentation should enable all users to effectively familiarize themselves with them.
Effective, meaning what? In practice, “effective” familiarization with information means that the message cannot be merely a formality hidden in multi-page terms and conditions or empty declarations. It must actually reach the recipient and be fully understandable to them, which includes in particular:
- The message must be understandable to the recipient. This involves using simple, accessible language (so-called plain language), free from excessive technological or legal jargon, so that the purpose and nature of the AI system are clear to the average recipient—that is, the person to whom the message is directed.
- The absence of architectural and digital barriers is necessary, which stems from other regulations. Adapting the format to the needs of people with various disabilities, in accordance with the requirements of the European Accessibility Act (EAA). This requires, among other things, compatibility with screen readers, ensuring appropriate contrast, or the ability to enlarge text. This should also have been included in your terms and conditions for a long time.
- Remember proper exposure and timing. Presenting information in an easily noticeable place (e.g., a clear pop-up message, a visible label), precisely at the moment when the user is about to make a decision to interact with the system, and not after the fact.
- It is worth remembering the multimodality of the message. This means ensuring, to the extent technically possible, access to information in various forms (textual, visual, or audio), which guarantees that diverse social groups will be able to fully interpret the message. This is a requirement that connects with the aforementioned understandability.
And what are the penalties for non-compliance?
Failure to comply with the new regulations carries huge financial risks. Depending on the severity of the violation and the size of the company, fines can range from EUR 7.5 million up to EUR 35 million or from 1% to 7% of the total worldwide annual turnover of the enterprise for the preceding financial year (whichever amount is higher).
What does the legislator consider a deepfake?
The AI Act considers a deepfake to be audio content, images, or video materials that have been generated or manipulated with the use of an AI system, which deceptively resemble existing persons, objects, places, or events. It is important to note that the content could be mistakenly perceived by the recipient of the material as authentic. We do not focus on the intention of the creator, but on the potential perception by society. This also includes authentic content that has been modified using artificial intelligence. The European Commission in its draft guidelines specified that content does not have to be based exclusively on real events or persons; it is enough that it is realistic and could exist in reality.
On the other hand, we will not consider as a deepfake content that depicts an unrealistic character or phenomenon, e.g., defying the laws of nature or biology – these are not subject to the labelling obligation under Article 50 of the AI Act. In the case of artistic or satirical content, the labelling obligation is subject to a more lenient regime – information should be provided in a manner that does not interfere with the enjoyment or consumption of the work.
So what to do next?
Although the key date is August 2026, the EU legislator has phased the implementation of the rules to give the market time to adapt. However, it is worth noting that some of them are already in force:
- 2 February 2025 – An absolute ban on the use of artificial intelligence systems presenting an unacceptable risk entered into force.
- 2 August 2025 – Rules regarding general-purpose artificial intelligence systems (so-called GPAI models – e.g., large language models) and provisions establishing supervisory authorities will start to apply.
- 2 August 2026 – The application date for the main body of the AI Act provisions. From this point on, full requirements will apply to, among others, high-risk systems (those listed in Annex III of the regulation).
- 2 August 2027 – The final package of regulations will come into force, covering high-risk AI systems that are safety components of products already subject to other EU certification (e.g., medical devices, machinery).
- 2 December 2027 – The application date for obligations and requirements regarding high-risk AI systems classified under Article 6(2) and Annex III (so-called standalone high-risk AI), in particular systems used in areas of critical infrastructure, biometrics, or education and vocational training.
For businesses, this means that compliance preparations (conformity with the AI Act) should begin immediately – starting from an inventory of tools used in organizations to the implementation of internal policies on the use of artificial intelligence.
With the start of the application of the AI Act provisions coming into force on 2 August 2026, entities using artificial intelligence should verify whether the way these systems are used complies with the new transparency requirements and whether appropriate procedures ensuring compliance with the regulation have been implemented.
Have questions – write to us: office@ajlaw.pl
[1] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (https://sip.lex.pl/#/act/72359064/447635748?directHit=true&directHitQuery=ai%20act&searchPit=2026-07-28 (accessed: 2026-07-28 13:23))
[2] European Commission, Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act, point 16 (link: https://digital-strategy.ec.europa.eu/en/library/draft-guidelines-implementation-transparency-obligations-certain-ai-systems-under-article-50-ai-act, accessed: 2026-07-28 13:56)
[3] European Commission, Guidelines on the implementation of the transparency obligations […], points 40-42