AI Act: The 2026 Compliance Guide for Businesses

Key Takeaways

1Training is already mandatory. Since February 2, 2025, any organization using AI systems must ensure a sufficient level of AI proficiency among its staff.

2Transparency applies from August 2, 2026. A conversational assistant must indicate that it is an AI, and certain generated content must be labeled as such.

3High-risk requirements are not yet fully enforceable. The obligations for systems listed in Annex III will apply starting December 2, 2027, following the Digital Omnibus.

4HR, creditworthiness, and education are sensitive areas. Recruitment, promotion, termination, individual creditworthiness, admission, assessment, or monitoring of exams fall under the high-risk uses of Annex III.

5Access controls are a priority. According to IBM, 92% of companies affected by AI incidents had insufficient access controls, based on a study conducted by the Ponemon Institute involving 602 companies.

Why it matters : AI is transforming compliance into ongoing management of uses, data, and responsibilities, provided that choices are documented before deployment.

At Oracle, ChatGPT Enterprise and Codex have reached 80% adoption in three months, but the gains in coding have not yet accelerated delivery to customers. This gap summarizes the challenge for businesses: AI is spreading rapidly, while controls, costs, access, and responsibilities remain to be organized. This guide helps compliance teams distinguish between effective uses, tools to frame, applicable rules, pitfalls to avoid, and a concrete plan to get started.

What AI Really Changes for Business Compliance

AI shifts compliance from one-time control to ongoing management. The same tool can be used for writing, summarizing, coding, searching internal documents, or acting within business software. Therefore, the first task is not to choose a model, but to understand where it intervenes, what data it reads, and who validates its outputs. Low-risk uses, such as writing or summarizing, remain subject to general obligations of training and transparency.

Feedback from businesses shows that adoption alone is not enough. Oracle achieved 80% adoption of ChatGPT Enterprise and Codex in three months, but management indicates that testing, validation, deployment, and versioning remain bottlenecks. At Thomson Reuters, the group reports that 87% of employees use AI daily in five key areas. According to Kirsty Roth, 91% of professionals believe their organization is not fully realizing the value of AI, as detailed in our article on untapped value.

Compliance is also becoming a matter of costs and internal responsibility. EY reports that an AI router has reduced its token consumption by 60% since April, and 98% of the 534 decision-makers surveyed in its EY US AI Pulse are revising their approach in light of costs. PwC notes that no single position clearly stands out as responsible for managing and securing AI. The right model therefore combines compliance, IT, cybersecurity, business, procurement, and legal.

Compliance team reviewing AI access clauses in a French office

AI compliance starts with actual uses, data, and access.

Effective Uses Today

Not all AI uses carry the same level of risk. The right arbitration involves separating quick wins, processes to frame, and exploratory uses.

Map of AI uses for compliance officers

Uses classified by maturity, with expected gain and risk in case of error.

Ready-to-Use Applications

Internal writing and summarization. Writing, summarization, and rephrasing assistants are the first uses to be framed by a simple charter: no sensitive data in unapproved tools, systematic human proofreading, and clear mention when generated content needs to be flagged. The AI Act does not classify them as high-risk by nature but imposes training and transparency when conditions are met.

Internal document search. Augmented search within internal documents speeds up legal, commercial, or support responses, but it exposes poorly configured access rights. In our analysis on data exposed to AI tools, the starting point is the same: begin with the data actually accessible by the account, extension, or connector, not just the list of authorized tools.

Software development assistance. Code assistants can produce quickly, but they shift control to review, testing, security, and version management. Oracle's experience shows that code generation does not automatically accelerate delivery to customers. To remain compliant, the company must track the tools used, prohibit secrets in prompts, and maintain human technical validation.

Fraud detection. Fraud detection is not cited as a high-risk system in the reference facts, unlike certain credit decisions. However, it remains exposed to GDPR, data security, and operational errors. Deployment must document the purpose, limit access, retain useful traces, and avoid having an algorithmic alert become an automatic sanction.

Uses to Manage

Assisted customer support. Assisted support works when AI proposes and humans validate sensitive responses. At Thomson Reuters, in support and sales, approved AI services provide answers in seconds where hours were previously needed to gather information. Compliance must impose a controlled documentation base, traceability of responses, and an escalation mechanism when AI is uncertain.

Application sorting. Recruitment, selection, promotion, dismissal, task allocation, evaluation, and monitoring of employees are included in the high-risk systems of Annex III. The corresponding obligations will apply from December 2, 2027, but teams must already prepare a register, criteria, human control, information, and consultation with the CSE, and coordination with GDPR.

Credit scoring. Assessing the creditworthiness of individuals, excluding fraud detection, is a high-risk use. GDPR already applies when the decision is based solely on automated processing producing legal or significant effects. The system must therefore provide documented criteria, real human intervention, and legal oversight before any industrialization.

Agents connected to internal tools. An agent that reads files, acts within a CRM, or triggers actions must be treated as an actor within the information system. Our analysis on governing AI agents in business recommends governing action rights, accessible data, and responsible individuals, rather than just the model. Sensitive actions must remain validatable and reversible.

Emerging Uses

AI materials list. The AI materials list aims to detail the data, versions, third-party components, and elements of a system. It remains little adopted but addresses a frequent blind spot: when an AI makes a mistake, many organizations cannot explain which version was functioning or which components were involved. It is a useful tool for preparing audits, incidents, and supplier relations.

Targeted formal verification. Formal verification does not prove everything about an AI, but it can demonstrate certain critical invariants regarding code, protocols, or model properties. It mainly concerns sensitive uses, where simple tests are insufficient. Our analysis on formal verification shows why this approach is of interest for critical systems.

Tools to Know

There is no universal ranking: the right choices depend on the data processed, action rights, and level of risk.

AI governance and compliance platforms. These are used to inventory uses, qualify risks, document controls, and prepare evidence. Naaia announced a €6 million raise with Ventech to strengthen its AI compliance platform. Requirements: usage register, risk classification, exportable evidence, action plan tracking.
Approved enterprise assistants. These include conversational assistants, coding tools, and search functions integrated into an already governed cloud or office infrastructure. OpenAI and Oracle announced that Oracle customers could use their Universal Credits to access OpenAI and Codex models via OCI. Requirements: clear contract, data location and access, disabling unvalidated uses, logs.
Content and output safeguards. These filter dangerous, sensitive, or non-compliant content before dissemination or action. These tools do not replace human review but reduce the volume of arbitrations and standardize rules across applications. Requirements: configurable rules, regular testing, alerts, retention of filtering decisions.
Identity and access tools for AI agents. They assign a unique identity to agents, with rights, identifiers, and the ability to act on behalf of an employee. PwC notes a lack of clarity on responsibility, while experts recommend applying the same identity controls to agents as for human users. Requirements: identity per agent, least privilege, strong authentication, rights review.
AI logging and audit solutions. They record prompts, outputs, actions, tool calls, and human validations according to sensitivity levels. They become central as soon as a system influences a decision, accesses confidential data, or acts within a business information system. Requirements: timestamped traces, integrity, post-incident search, controlled retention duration.

Le brief IA que lisent les pros

Le brief IA que les pros lisent chaque soir

Les 7 actus IA du jour, décryptées en 5 min. Gratuit.

Inclus dès l'inscription : notre sélection des meilleurs guides & comparatifs IA.

Choisissez votre rythme

Gratuit · Pas de spam · Désabonnement en 1 clic

The Framework: Key Texts for Businesses

AI Act: compliance milestones to follow until 2028

Key dates, status as of October 20, 2026.

AI Act

Regulation (EU) 2024/1689 came into effect on August 1, 2024, and applies in phases. Since February 2, 2025, prohibited practices are banned, and staff mastery of AI is required. From August 2, 2026, transparency obligations apply, as highlighted in our article on transparency. High-risk systems in Annex III will only transition from December 2, 2027.

High Risk and Sensitive Professions

High-risk autonomous systems cover areas such as biometric identification, education, employment, access to certain essential services, policing, migration, justice, and democratic processes. In business, the most frequent points are HR, individual creditworthiness, risk assessment, and pricing in life and health insurance, as well as admission, evaluation, and monitoring of examinations. The obligations of Annex III will apply from December 2, 2027, not from August 2026.

GDPR and Automated Decisions

The GDPR has been in effect since May 25, 2018. Its Article 22 regulates decisions based solely on automated processing that produces legal or significant effects on a person. For a business, the point of attention is on processes that refuse, classify, score, or trigger an individual consequence without real human intervention. The AI Act does not replace this control; it adds to it.

Data, Products, and Social Dialogue

The Data Act has been in effect since September 12, 2025, and facilitates changing cloud providers. The Cyber Resilience Act has imposed certain reporting requirements on manufacturers of products containing digital elements since September 11, 2026, with alerts within 24 hours and notifications within 72 hours. The directive on defective product liability includes software, including AI systems, and must be transposed by December 9, 2026, at the latest. The CSE is informed and consulted when introducing new technologies.

Pitfalls to Avoid

Confusing transparency with high risk. Since August 2, 2026, transparency applies, but the obligations of high-risk systems in Annex III only apply from December 2, 2027. Avoid planning based on a misaligned timeline.

Forgetting access. According to IBM, in the Cost of a Data Breach Report 2026 conducted with the Ponemon Institute among 602 companies, 92% of companies affected by AI security breaches had inadequate access controls. See our article on IBM.

Allowing business units to purchase independently. An AI tool integrated into a SaaS can read files, emails, tickets, or customer databases without being visible to the IT department. Compliance must impose a purchasing process that verifies processed data, subcontractors, access rights, logs, and reuse conditions.

Automating a sensitive decision. An AI recommendation becomes risky when it effectively produces an individual decision: recruitment, credit, evaluation, sanction, or access to a service. The presence of a human is not sufficient if their role is limited to mechanically validating the output.

Training without proof. The obligation for AI mastery requires training tailored to the individuals involved. Oral awareness or an intranet page does not provide enough evidence to manage the risk. Keep records of programs, target audiences, dates, materials, and proof of participation.

Taking Action: The 90-Day Plan

A three-step plan to frame AI in business

Three steps: frame, test, deploy.

Start by inventorying actual uses, including AI functions integrated into already deployed tools. Within three months, classify uses by risk, block sensitive data in unapproved tools, set responsibilities, and launch two measurable cases. Then, implement controls in line with project rhythms, reviewing access, incidents, costs, and user feedback.

The AI compliance checklist before deployment

Eight checks to perform before each new use.

Essential Questions

What AI Act obligations already apply to businesses in 2026?

Since February 2, 2025, prohibited practices are banned, and organizations using AI systems must ensure a sufficient level of AI mastery among their staff. Since August 2, 2026, transparency obligations apply: a conversational assistant must indicate that it is an AI, and certain generated content must be flagged.

Are high-risk AI systems already subject to all their obligations?

No. The Digital Omnibus has postponed the obligations for high-risk systems. For autonomous systems in Annex III, they will apply from December 2, 2027. For AI integrated into already regulated products, such as medical devices, machinery, or toys, they will apply from August 2, 2028.

Which AI uses are high risk in business?

Annex III specifically targets employment, including recruitment, selection, promotion, dismissal, task allocation, evaluation, and monitoring of employees. It also covers education, assessment of individual creditworthiness excluding fraud, risk assessment, and pricing in life and health insurance, triage of emergency calls, justice, policing, migration, and democratic processes.

How to start an AI compliance process?

Begin by listing the tools and AI functions actually used, including in already installed software. Then classify accessible data, qualify prohibited, limited, or high-risk uses, designate responsible individuals, train users, and document controls. Initial deployments should remain measurable, reversible, and validated by humans.

Is GDPR sufficient to comply with the AI Act?

No. GDPR remains applicable to personal data processing, particularly with its Article 22 on certain exclusively automated decisions. The AI Act adds its own rules: prohibitions, training, transparency, and soon obligations for high-risk systems. The two frameworks accumulate when AI processes personal data or influences an individual decision.