The EU AI Act in plain English, updated for 2026

The EU AI Act became generally applicable on 2 August 2026, enforcement began, and Ireland now has its own regulator for it. If you run a small business that uses ChatGPT, Copilot or an AI feature inside software you already pay for, the reasonable question is whether any of this lands on you.

For most small businesses it asks considerably less than the coverage suggests. Not nothing, and less than it was going to ask, because the deadlines changed in July 2026. Here is where it actually stands.

General information, not legal advice. Where a decision turns on the detail, take advice on your own situation.

Applies to you if

• You use AI software of any kind in the business. The AI literacy duty reaches you.
• You run a chatbot that talks to customers, or you publish AI-generated video, audio or realistic imagery.
• You use software to screen, rank or score job applicants. This is the high-risk use most likely to catch an ordinary business.
• You build something on top of an AI model and supply it to others under your own name.

Probably does not apply if

• You use AI to draft emails, summarise documents, transcribe calls or produce first-pass marketing copy, and a person reviews the output. That sits in the tier the Act largely leaves alone.
• You use these tools personally rather than in the business. Purely personal, non-professional use is carved out.
• You have been told you must now stamp “made with AI” on every social post. You almost certainly do not, and that is covered below.

What the Act actually does

It does not regulate AI. It regulates uses of AI, sorted by how much damage a particular use could do to a person. The same technology can be almost unregulated in one context and tightly controlled in another, which is why the headline fines rarely describe an ordinary business.

• Prohibited. Banned outright. Social scoring, manipulating vulnerable people, untargeted scraping of faces to build recognition databases, inferring emotions of staff in a workplace.
• High risk. Permitted, with real obligations: documentation, human oversight, accuracy, logging. Recruitment, credit decisions, education, essential services, safety components.
• Transparency. A specific set of disclosure duties, narrower than most summaries suggest.
• Minimal. Everything else, which is the overwhelming majority of small-business use.

Separately, the Act regulates the companies that build general-purpose models, with duties on transparency, copyright and systemic risk. Those land on the model builders, not on you for using their product.

Provider or deployer

A provider develops an AI system, or has one developed, and puts it on the market under its own name. A deployer uses one under its own authority. Providers carry most of the weight.

If your business uses ChatGPT, Copilot, or an AI feature inside software you licence, you are a deployer. That is the ordinary case and it stays the ordinary case.

You may become a provider if you develop, substantially modify or rebrand a system and supply it to others. Calling an API does not make you one on its own: it depends on what you build, whose name is on it, what it is for, and whether anyone else uses it. If you are near that line, check properly rather than assuming either way.

The duty that reaches almost everyone

AI literacy. Under Article 4, providers and deployers must take measures to support the development of AI literacy among staff and people operating these systems on their behalf.

That wording changed in July 2026 and the change matters. It previously read as ensuring a sufficient level. It is now an obligation of effort rather than of result: you support people getting there, you do not guarantee that every individual reaches a measurable standard.

Nothing in it names a course, a certificate or a provider. For a small business, proportionate measures usually mean a short acceptable-use policy, clear guidance on what must never be pasted into a public tool, something on hallucinations and checking, role-specific guidance for anyone in recruitment or finance, a named person who approves new tools, and a refresher when things change.

Anyone selling a mandatory certified programme to a twelve-person company is selling something the law did not ask for. There is more on this in what the AI literacy duty actually requires.

The labelling question, answered narrowly

The transparency rules in Article 50 started applying on 2 August 2026, and they are the most widely misdescribed part of the Act. There is no general rule that AI-assisted content must carry a visible disclaimer.

• Providers of systems that interact directly with people must design them so it is clear a person is dealing with a machine, unless that is obvious.
• Providers of systems generating synthetic text, image, audio or video must mark the output in a machine-readable way. A provider duty, not yours, with a transitional deadline of 2 December 2026 for systems already on the market.
• Deployers must disclose deepfakes: generated or manipulated image, audio or video that appears to show a real person, place or event.
• Deployers publishing AI-generated text to inform the public on a matter of public interest must disclose it, unless it has been through human review or editorial control and a person or organisation holds editorial responsibility.
• Deployers of emotion recognition or biometric categorisation must tell the people exposed to it.

So a product description drafted with AI and edited by you needs no disclaimer. An abstract illustration on a blog post needs no disclaimer. A realistic video appearing to show a named person saying something they never said is an entirely different matter.

The dates, as they now stand

These moved. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and pushed the high-risk deadlines back. Anything written before then carries the old dates.

• 1 August 2024. The Act entered into force.
• 2 February 2025. Definitions, prohibited practices and AI literacy began applying.
• 2 August 2025. Governance and general-purpose model obligations began applying.
• 2 August 2026. General application, enforcement, and the Article 50 transparency duties.
• 2 December 2026. Transitional deadline for machine-readable marking on generative systems already on the market, and two new prohibitions covering non-consensual intimate imagery and child sexual abuse material.
• 2 December 2027. The main high-risk obligations, including recruitment. Moved from 2 August 2026.
• 2 August 2028. High-risk AI embedded in regulated products.

The high-risk delay is a genuine reprieve if you screen CVs with software, and it is not a reason to forget about it. The new date is fixed rather than conditional on standards being ready, so it will not drift again without fresh legislation.

Who enforces this in Ireland

Ireland’s Regulation of Artificial Intelligence Act 2026 was signed in July 2026 and established the AI Office of Ireland, Oifig IS na hÉireann, as the central coordinating authority and single point of contact.

Ireland chose a distributed model, so the regulator you would actually deal with depends on the sector and the use. Existing bodies act as market surveillance authorities, among them the Data Protection Commission, the Workplace Relations Commission, the Central Bank, the Competition and Consumer Protection Commission and Coimisiún na Meán.

The practical consequence is that an AI question about staff monitoring goes to a different regulator than one about financial services or advertising.

Five things worth doing

1. Write down where AI is already in use. Not what you are considering. Most businesses find more than expected, because features arrive switched on inside software nobody thinks of as AI.
2. Check that list for hiring, credit, or access to a service. If nothing touches those, you are almost certainly outside the high-risk tier.
3. Write a one-page acceptable-use policy: approved tools, what must never go in, who to ask. That is the literacy duty, proportionately met.
4. Check your chatbot says it is a chatbot, and that any realistic generated media is disclosed.
5. Handle the data question separately. The AI Act is not GDPR. If personal data goes into a tool, you need a lawful basis and a privacy notice that reflects reality.

The first three of those are a spreadsheet and a page of writing. If it helps to start from something rather than nothing, an inventory sheet and a policy template are here. The inventory carries the tiers above as dropdowns, which makes sorting your own uses into them considerably less abstract than reading about them.

Common misconceptions

• “Everything made with AI must be labelled.” No. The visible duties are narrow: deepfakes, and public-interest text published without human editorial responsibility. Machine-readable marking is a provider duty.
• “You need consent before anything goes into an AI tool.” The AI Act imposes no such general rule. Where personal data is involved GDPR applies, and consent is one of six lawful bases, often not the right one.
• “Every business must log every AI prompt.” No. Logging duties attach to high-risk systems, for logs under your control, for at least six months. An inventory is good practice, not a universal statutory requirement.
• “The fines are a share of turnover for anyone.” The top tier is up to €35 million or 7% of worldwide turnover, for prohibited practices. For SMEs the cap is the lower of the two figures, not the higher.
• “High-risk rules started in August 2026.” They were going to. They now generally start on 2 December 2027.

The honest summary

If your business uses AI to write faster, summarise more and answer routine questions, the substantive duties on you are the literacy measures and the narrow transparency rules. That is an afternoon of thinking and a page of writing, not a project.

It is not nothing, though. Ignoring it entirely still leaves you exposed on transparency, on prohibited uses, on AI literacy, and separately on GDPR, consumer protection and whatever you have promised clients contractually. “Not high risk” is not the same as “not regulated”.

If AI touches hiring or decisions about who gets access to something, December 2027 is closer than it sounds. If you are unsure which side of the line one of your systems sits on, describe what it does and you will get a straight answer about whether it is a real problem or not.

The rest of it, in order

This page is the overview. Each of these takes one part of it and goes properly into the detail, and they are ordered by how likely they are to matter to an ordinary business rather than by how the Act is structured.

Sources

Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 on EUR-Lex; the European Commission’s AI Act pages and Article 50 transparency guidance; the Regulation of Artificial Intelligence Act 2026 on the Irish Statute Book; and the Department of Enterprise, Tourism and Employment on the AI Office of Ireland. Dates and thresholds were checked against those sources on 6 August 2026.