EU AI Act: what it really means for mid-market companies
Plenty of deadline panic circulates around the EU AI Act. Most of it is wrong. Here is where things actually stand in July 2026, honest and without scaremongering: which rules already apply, which date moved, and where your AI use most likely falls.
Frequently asked
What is the EU AI Act?
The EU AI Act is the European law that sorts AI systems by risk: prohibited, high-risk, limited-risk and minimal-risk. The higher the risk, the heavier the obligations. The law applies to anyone offering or using AI in the EU, mid-market companies included.
Which deadlines apply right now?
Prohibited AI practices have applied since 2 February 2025, GPAI obligations since 2 August 2025. The high-risk rules (Annex III) moved via the Digital Omnibus to 2 December 2027. But 2 August 2026 is still a real deadline: transparency duties (Article 50), fining powers and market surveillance kick in regardless.
What changes on 2 August 2026?
Three things. Article 50 starts: chatbots must say you are talking to AI unless that is already obvious. Deepfakes and certain AI-generated texts on public matters need labels. National authorities can enforce the rules and Article 101 GPAI fines become active. Existing generative systems have until 2 December 2026 for machine-readable marking.
Is that high-risk deadline final?
Yes. Parliament approved the Digital Omnibus on 16 June 2026 and the Council on 29 June. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July and has applied since 27 July. Annex III systems follow on 2 December 2027; high-risk AI in regulated products on 2 August 2028.
What does this mean for mid-market companies?
For most SMEs, AI use falls under limited-risk or minimal-risk, not high-risk. From 2 August 2026, Article 50 mainly asks three things: disclose direct AI interaction when it is not obvious, label deepfakes and label AI-generated text on public matters without human review. First determine your real risk tier and role.
What are the fines?
For prohibited practices, fines reach up to 35 million euro or 7% of global annual turnover. Other breaches: up to 15 million euro or 3%. Supplying incorrect information to regulators: up to 7.5 million euro or 1%. SMEs and start-ups face proportionally lower fines.
Who supervises this in the Netherlands?
The Netherlands appoints 10 market surveillance authorities, each in its own domain (AFM and DNB for financial services). For areas without an existing supervisor, such as prohibited practices and transparency duties, the Dutch Data Protection Authority (AP) gets a central role, alongside the Rijksinspectie Digitale Infrastructuur. Consultation on the implementation law closed 1 June 2026; parliamentary debate is to come.
How do you make AI AI-Act-proof in production?
Start by classifying each AI use case, not "AI" in general. Many pilots stall not on the law but on the production gap: governance, compliance and maintenance that arrive too late. Our Scan reviews your AI work on ROI, risk and what the law asks.
The four risk tiers
Prohibited
AI the EU deems too harmful, such as social scoring or manipulating vulnerable groups.
Banned since 2 February 2025.
High-risk
AI in sensitive domains (Annex III), such as hiring, credit or critical infrastructure.
Strict requirements. Date moved to 2 December 2027 (Digital Omnibus, finally approved June 2026).
Limited-risk
Direct AI interaction, emotion recognition, deepfakes and certain AI-generated texts.
Transparency by type from 2 August 2026. One transition period applies to existing generative systems.
Minimal-risk
Most AI: spam filters, recommendations, tools with no direct risk.
No specific obligations under the law.
The honest takeaway
No panic, but do not ignore it either. Most AI in mid-market companies falls under limited-risk or minimal-risk, not high-risk. Annex III systems follow from 2 December 2027; high-risk AI in regulated products from 2 August 2028. The transparency rules still start on 2 August 2026. First determine which category each use case actually falls into.
This is not legal advice. The EU AI Act is still getting implementing rules and guidance; details can shift. For your own situation, have a lawyer look at it.
AI work AI-Act-proof in production?
The law is rarely the real blocker; the production gap is. In the Scan we review your AI work on ROI, risk and what the law asks, and tell you which ones we would put into production.