{"slug": "eu-ai-act-for-businesses-three-questions-that-tell-you-what-you-owe-and-when", "title": "EU AI Act for businesses: three questions that tell you what you owe and when", "summary": "Businesses using AI in the EU face only limited obligations today under the EU AI Act — staff AI literacy, avoiding banned practices, and labeling two kinds of content — while the heavier deployer duties for AI used in hiring, credit scoring and life or health insurance pricing were pushed from 2 August 2026 to 2 December 2027 by an amendment, according to practitioner Jamie Watters. Watters cites Article 99 of the Act, under which banned practices carry fines of up to €35m or 7% of worldwide turnover, whichever is higher, and breaches of the Article 26 deployer duties or Article 50 transparency duties carry up to €15m or 3%, with SMEs and start-ups subject to the lower of the amount or percentage under Article 99(6) and (6a). Watters also notes that GDPR Article 22 already restricts decisions based solely on automated processing with legal or similarly significant effects, and that Colorado and California rules take effect on 1 January 2027.", "body_md": "# EU AI Act for businesses: three questions that tell you what you owe and when\n\nJamie Watters\n\nOperational resilience and AI delivery practitioner.\n\n**Who this is for:** you run or manage a business that uses AI tools, such as a CV screener, a chatbot or ChatGPT for the marketing. Someone has asked whether the EU AI Act applies to you, and what you have to do. By the end you'll know which parts are yours and from when, how the UK, US and Korean rules differ, and what to do this quarter.\n\n**Skip it if** you build AI models for a living. The model-maker duties get one line here.\n\nIf your business is in the EU, or uses AI whose output is used in the EU, the EU AI Act applies to you. For most firms, what it asks today is small: help your staff understand the AI they use, stay clear of a short list of banned practices, and label two kinds of content. The heavy part, for AI used to hire people, judge their credit or price their life or health insurance, starts on 2 December 2027. It was due on 2 August 2026 until an amendment moved it.\n\nThat gives you time. It doesn't make the Act small. The fines are set in [Article 99](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727). Using a banned practice can cost up to €35m or 7% of worldwide turnover, whichever is higher (paragraph 3). Breaking the deployer duties in Article 26 or the transparency duties in Article 50 can cost up to €15m or 3% (paragraph 4). Smaller firms get the other cap: for SMEs, including start-ups, each fine is the amount or the percentage \"whichever thereof is lower\", and small mid-caps get the same on the lower tiers (Article 99(6) and (6a)).\n\nAnd it isn't the only law in play. Decisions made about people by AI alone are already regulated. In the EU, the GDPR gives people \"the right not to be subject to a decision based solely on automated processing\" that has legal or similarly significant effects, with three exceptions (Article 22). The UK has its own version, and Colorado's and California's rules start on 1 January 2027. They come after the three questions.\n\nWhere I'm coming from: I sat on a bank's US committee that approved AI and cloud deployments, and signed off each one's resilience, disaster recovery and service continuity. I haven't applied the EU AI Act inside a firm. This is research, not legal advice. Every quote here was pulled from the primary texts (the laws, the court order and the ministry's release) on 28 October 2026. For the wider map of five regions, see [my October paper on where AI regulation stands](https://jamiewatters.work/journey/ai-governance-regulation-2026).\n\n## Three questions that tell you what you owe\n\nThe Act sorts AI by what it's used for, not by how clever it is. So the questions are about you and your uses, not about the technology.\n\n*The three questions, with the article each answer rests on. Source: the AI Act's consolidated text of 27 July 2026.*\n\n**1. Are you building it or using it?**\n\nTwo definitions decide who carries what. A provider develops an AI system, or has one developed, and puts it on the market \"under its own name or trademark\". A deployer is anyone \"using an AI system under its authority\", unless the use is personal and non-professional (Article 3). If you buy a tool and use it as sold, you're a deployer. The reach is wide: the Act covers deployers outside the EU \"where the output produced by the AI system is used in the Union\" (Article 2(1)(c)).\n\nThe trap is that you can become a provider without meaning to. You become a provider of a high-risk system, with the much heavier provider duties, in three cases (Article 25(1)). You put your name or trademark on a high-risk system. You make a \"substantial modification\" to one. Or you change the intended purpose of a system that wasn't high-risk, a general-purpose one included, so that it becomes high-risk. Taking a general chatbot and using it to rank job applicants may be exactly that third case. Take advice before you do it.\n\n**2. Is what you use it for on the list?**\n\nThere are two lists. The first is the banned one (Article 5). The ban most likely to catch an ordinary business is on AI used \"to infer emotions of a natural person in the areas of workplace and education institutions\", unless it's there for medical or safety reasons. That has been banned since 2 February 2025. On 2 December 2026 the list grows to include AI that generates realistic intimate or sexually explicit images, video or audio of an identifiable person without their consent.\n\nThe second is the high-risk list (Annex III). Annex III lists eight areas. The two an ordinary business meets most are employment and essential private services. Employment covers AI used \"to analyse and filter job applications, and to evaluate candidates\". It also covers AI that decides on promotion or termination, that hands out tasks based on people's behaviour or personal traits, and that monitors and evaluates staff performance and behaviour. Essential services cover AI that judges the creditworthiness of individuals (\"with the exception of AI systems used for the purpose of detecting financial fraud\") and AI used for \"risk assessment and pricing\" in life and health insurance.\n\nIf you use AI to screen candidates, manage staff, judge people's credit or price life or health insurance, the deployer duties in Article 26 apply from 2 December 2027. In plain words: use it the way the vendor says, put a trained person in charge of it, watch it and stop it if it turns risky, keep its logs, and tell your staff and the people it decides about. The main duties, in the Act's words, for whoever deals with the vendor:\n\n- use the system \"in accordance with the instructions for use\";\n- give human oversight to people \"who have the necessary competence, training and authority, as well as the necessary support\";\n- monitor how it runs and, if it may present a risk, \"without undue delay\" tell the provider or distributor and the market surveillance authority, and \"suspend the use of that system\" (Article 26(5));\n- keep the logs the system generates, \"to the extent such logs are under their control\", for at least six months, \"unless provided otherwise in applicable Union or national law\" (banks and insurers keep them with the records their financial services law already requires);\n- tell workers' representatives and the affected workers before using it at work;\n- tell people that the system is used in decisions about them.\n\nDeployers of credit scoring and of life or health insurance pricing must also assess the impact on people's fundamental rights before they start using it (Article 27(1)). So must public bodies and private firms providing public services, for almost every use on the list.\n\nTwo things can narrow this, and there's a catch on the first. A use on the list isn't high-risk where it \"does not pose a significant risk of harm\", for example where the system does \"a narrow procedural task\" (Article 6(3)). The provider has to document that assessment, so ask your vendor for it (Article 6(4)). The catch: any Annex III system that \"performs profiling of natural persons\" is always high-risk (Article 6(3), last subparagraph). A CV screener or a credit score usually does exactly that.\n\nThe second narrowing: a high-risk system already on the market or in use before 2 December 2027 is caught only if \"those systems are subject to significant changes in their designs\" after that date (Article 111(2)). Systems used by public authorities must comply by 2 August 2030 whatever happens. Your vendor usually controls the design changes, so ask them about those too.\n\n**3. Does anyone outside the business see what it makes?**\n\nIf you use AI to make a deepfake, or publish AI-written text \"with the purpose of informing the public on matters of public interest\", you must say it's AI-made (Article 50(4)). The text duty falls away where a person has reviewed it and someone \"holds editorial responsibility\" for it. This has applied since 2 August 2026.\n\nChatbots must tell people they're talking to an AI, unless that's obvious, and AI tools must mark what they generate. Both are the provider's job, which usually means the tool maker. If you build a chatbot on someone's model and run it under your own name, the provider is probably you. The user's narrower part is in [the piece on AI content labels](https://jamiewatters.work/journey/ai-content-labelling).\n\n**And one duty for everyone.** Whatever the answers above, every provider and deployer owes this one. They have had an AI literacy duty since 2 February 2025. Since the July 2026 amendment it reads: they must \"take measures to support the development of AI literacy\" of their staff and others who operate and use AI systems on their behalf (Article 4, as amended). The amended text adds that this \"does not require providers or deployers to guarantee any specific level of AI literacy\". A short briefing, and a record of who had it, is cheap evidence that you govern AI at all.\n\n## The dates, and why they moved\n\n*Every date comes from Article 113 or Article 111 of the consolidated text. Past dates in grey.*\n\nThe high-risk date moved because the standards and guidance weren't ready. Regulation (EU) 2026/1744, the Digital Omnibus on AI, has been in force since 27 July 2026. Its recitals give the reason for the delay: the \"delayed availability of standards, common specifications, and alternative guidance\", against an \"initial date of application, namely 2 August 2026\". One piece is still missing. Article 6(5) told the Commission to publish guidelines on what counts as high-risk by 2 February 2026. On 2 November 2026 its page still showed only the draft of 19 May 2026. Until they're final, the narrow-task exception in question two is your vendor's reading of the text. It isn't the Commission's.\n\n## The laws around it\n\nHere's the short version. Where they apply, all five ask you to tell people when AI is used on them, though each has its own trigger. The UK, Colorado and California also give people a route to a human, with conditions in Colorado and exceptions in California. Build that route once, and record each regime's extra steps on it.\n\n*Five regimes. All five ask you to tell people when AI is used on them; the UK, Colorado and California add a route to a human. Sources under each panel.*\n\n**The UK: in force now.** The UK's rules on AI decisions sit in data protection law. Since 5 February 2026 (SI 2026/82), section 80 of the [Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80/enacted) has replaced Article 22 of the UK GDPR with Articles 22A to 22D. A significant decision \"based solely on automated processing\", meaning with \"no meaningful human involvement\", is allowed with four safeguards (Article 22C). People must get information about it. They must be able to make representations, get human intervention, and contest it.\n\nHealth, biometric and other special category data are the exception: a solely automated significant decision can't rest on them without explicit consent or a narrow legal basis (Article 22B). If AI decides about UK customers or staff with no meaningful human step, those four routes are owed now.\n\n**Colorado: from 1 January 2027, if a court lets it.** SB 26-189 applies to \"consequential decisions made on or after January 1, 2027\" in education, employment, housing, lending, insurance, health care and public benefits. Before using automated decision technology to \"materially influence\" one, a business must give clear notice. After an adverse outcome, it must give, within thirty days, \"a plain language description\" of the decision and the role the technology played. On request it must let the person correct inaccurate personal data and give \"an opportunity for meaningful human review and reconsideration\", \"to the extent commercially reasonable\". A breach counts as a deceptive trade practice, though where a fix is possible the Attorney General must first give a business sixty days to cure it.\n\nThe catch is a lawsuit. A court order of 27 April 2026 in X.AI v. Weiser was made against Colorado's earlier AI law, and also covers \"any legislation replacing or amending\" it passed that session, which SB 26-189 did. Under it, the Attorney General can't start enforcement, \"including but not limited to the initiation of an investigation\", for violations up to 14 days after the court rules on a preliminary injunction.\n\n**California: from 1 January 2027.** The state privacy regulator has [rules on automated decisionmaking technology](https://cppa.ca.gov/regulations/ccpa_updates.html). They catch a business covered by the state's privacy law that uses technology \"to replace human decisionmaking or substantially replace human decisionmaking\" in a significant decision. Significant means lending, housing, education, employment and pay, or health care. A business already doing that must comply \"no later than January 1, 2027\" (section 7200). It must give a pre-use notice, offer an opt-out, and answer access requests. It can skip the opt-out if it offers an appeal \"to a human reviewer who has the authority to overturn the decision\" (section 7221(b)(1)). For some hiring and work-allocation uses it needs neither, where the tool is used only for that, works for it and doesn't unlawfully discriminate (section 7221(b)(2) and (3)).\n\n**The US government: against the state laws.** The pressure from the federal government is against state AI laws, not for a federal one. Executive Order 14365 of 11 December 2025 told the Attorney General to set up a task force \"whose sole responsibility shall be to challenge State AI laws inconsistent with the policy set forth in section 2 of this order\". Unless a court strikes them down or Congress overrides them, the state laws above stand.\n\n**South Korea: in force, penalties deferred.** The AI Basic Act and its Enforcement Decree came into force on 22 January 2026. Businesses providing products or services using high-impact or generative AI must \"inform users in advance that AI is being used\", and generative output, deepfakes above all, must be clearly labelled. The [Ministry of Science and ICT](https://www.msit.go.kr/eng/bbs/view.do?sCode=eng&nttSeqNo=1214&bbsSeqNo=42&mId=4&mPid=2) lists ten high-impact areas, including recruitment and credit assessment. The ministry has granted \"a grace period of at least one year\", in which fact-finding investigations and penalties are deferred, except in cases such as loss of life or human rights violations.\n\n## The case for doing nothing yet\n\nThe strongest objection comes from in-house counsel at a mid-size firm, and it goes like this. A deployer's real AI Act duties start in December 2027. Systems already on the market by then may stay outside them until their design changes. Meanwhile the exposure that bites today is data protection and consumer law. So spend this quarter on those, and come back to the AI Act in 2027.\n\nMost of that is right about the timing. It's wrong about the order of work. You can't tell which of those other laws applies until you know what AI you use, on whom, and where they are. That list is the first step for every regime above. The answers you need from vendors arrive on their schedule, not yours. And the way out in Article 111(2) depends on design changes your vendor makes. Colorado and California both start on 1 January 2027.\n\n## What to do this quarter\n\nThis is the part to copy.\n\n1. List every AI tool the business uses. One line each: what it does, who uses it, whose data goes in. Note whether it touches people in the EU, the UK, Colorado, California or South Korea.\n2. Mark each one: bought and used as sold (deployer), or built, rebranded, substantially changed or put to a new purpose (possibly a provider, Article 25).\n3. Check each use against Article 5. Stop anything that infers staff emotions at work, unless it's for medical or safety reasons.\n4. Check each use against Annex III, starting with hiring, staff management, credit scoring of individuals and life or health insurance pricing. For each match, ask the vendor in writing whether it treats the system as high-risk and why, what instructions for use and logs it will supply, and what design changes it plans.\n5. Brief everyone who uses an AI tool on what it's for, where it goes wrong and what not to put into it. Record who had the briefing (Article 4).\n6. If you make deepfakes with AI, or publish AI text on matters of public interest that no person reviewed and no one holds editorial responsibility for, label them (Article 50(4)).\n7. EU and UK: for any significant decision made by AI alone, check it against GDPR Article 22 (EU). In the UK, put in the four safeguards (Article 22C), and if special category data feeds it, check that Article 22B allows it.\n8. Colorado and California, by 1 January 2027: a notice before use; in Colorado, a plain-language explanation within 30 days of an adverse decision and human review on request; in California, an opt-out or a human appeal, unless a hiring or work-allocation exception applies.\n9. Put four dates in the diary: 2 December 2026 (the new bans), 1 January 2027 (Colorado and California), 2 December 2027 (the high-risk duties) and 2 August 2028 (high-risk AI inside regulated products).\n\nMost of the words a business will argue over haven't been tested yet: \"significant risk of harm\", \"substantial modification\", \"significant changes in their designs\", \"meaningful human involvement\". Every date here was checked on 28 October 2026 against the texts as they stood that day.\n\nThe AI Act's heavy rules are more than a year away. The UK's rules on automated decisions apply now, and Colorado's and California's start on 1 January 2027.\n\n## Sources\n\n- **EU:** Regulation (EU) 2024/1689 (the AI Act),[consolidated text of 27 July 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727) , Articles 2, 3, 4, 5, 6, 25, 26, 27, 50, 99, 111 and 113, and Annex III; the EUR-Lex record of[amendments and proposals](https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:32024R1689) (checked 28 October 2026); Regulation (EU) 2026/1744, recitals; the Commission's page on the draft high-risk guidelines (checked 2 November 2026); Regulation (EU) 2016/679 (the GDPR), Article 22.\n- **UK:** Data (Use and Access) Act 2025, section 80; SI 2026/82 (commencement).\n- **US:** Executive Order 14365, section 3; Colorado SB 26-189; X.AI LLC v. Weiser, 1:26-cv-01515 (D. Colo.), minute order of 27 April 2026; California Privacy Protection Agency, approved regulations text (filed 22 September 2025), sections 7001, 7200 and 7221.\n- **South Korea:** Ministry of Science and ICT, press release on the AI Basic Act coming into force.", "url": "https://wpnews.pro/news/eu-ai-act-for-businesses-three-questions-that-tell-you-what-you-owe-and-when", "canonical_source": "https://jamiewatters.work/journey/eu-ai-act", "published_at": "2026-11-03 03:51:12+00:00", "updated_at": "2026-11-03 04:20:42.043290+00:00", "lang": "en", "topics": ["ai-policy", "artificial-intelligence"], "entities": ["European Union", "EU AI Act", "Jamie Watters", "GDPR", "Colorado", "California"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/eu-ai-act-for-businesses-three-questions-that-tell-you-what-you-owe-and-when", "markdown": "https://wpnews.pro/news/eu-ai-act-for-businesses-three-questions-that-tell-you-what-you-owe-and-when.md", "text": "https://wpnews.pro/news/eu-ai-act-for-businesses-three-questions-that-tell-you-what-you-owe-and-when.txt", "jsonld": "https://wpnews.pro/news/eu-ai-act-for-businesses-three-questions-that-tell-you-what-you-owe-and-when.jsonld"}}