In brief
The EU AI Act (Regulation (EU) 2024/1689) regulates AI systems in the EU according to their risk. It applies directly in Austria too and affects organisations of all sizes that provide AI or use it professionally. Which obligations apply depends on the role (provider or deployer) and the risk category of the system.
The roles: provider and deployer
- Providers develop an AI system (or have it developed) and place it on the market under their own name – for example a software company with an AI feature in its own product.
- Deployers use an AI system under their own authority in a professional context – for example an organisation using ChatGPT, Copilot or AI-supported specialist software. This is the most common role for SMEs.
- The regulation also defines importers and distributors. An organisation can have different roles for different systems.
The risk categories
| Risk category | Examples | Consequence |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative techniques, certain biometric applications | Prohibited |
| High risk | AI in recruitment, creditworthiness, critical infrastructure, safety components of regulated products | Extensive requirements for risk management, data, documentation, oversight |
| Transparency obligations | Chatbots, AI-generated or manipulated content (deepfakes) | Labelling or notice that people are interacting with AI |
| Minimal risk | Spam filters, translation, many office applications | No specific obligations – AI literacy still applies |
The key deadlines
EU AI Act · DeadlinesAs of 12 October 2026
- applies since 01 Aug 2024Entry into force
- applies since 02 Feb 2025Prohibitions & AI literacy
- applies since 02 Aug 2025GPAI obligations, penalties
- applies since 02 Aug 2026Transparency obligations Art. 50
- 02 Dec 2026New prohibitions, labelling of existing systems
- 02 Dec 2027High-risk under Annex III
- 02 Aug 2028High-risk in products (Annex I)
| Date | What applies | Status |
|---|---|---|
| 1 August 2024 | Entry into force of the Regulation The AI Act enters into force; obligations apply in stages. | applies |
| 2 February 2025 | Prohibitions & AI literacy Prohibited practices (Art. 5) and AI literacy (Art. 4) apply. | applies |
| 2 August 2025 | General-purpose AI models & penalties Obligations for providers of GPAI models, governance structures and rules on penalties apply. | applies |
| 2 August 2026 | Transparency obligations (Art. 50) Transparency obligations and further general provisions apply. | applies |
| 2 December 2026 | New prohibitions & labelling for existing systems Under Reg. (EU) 2026/1744: new prohibitions (AI-generated non-consensual intimate deepfakes, child sexual abuse material); end of the transition period for labelling (Art. 50(2)) for systems placed on the market before 2 Aug 2026. | upcoming |
| 2 December 2027 | High-risk systems under Annex III Postponed by Reg. (EU) 2026/1744 (previously 2 August 2026). | upcoming |
| 2 August 2028 | High-risk AI in regulated products (Annex I) Postponed by Reg. (EU) 2026/1744 (previously 2 August 2027). | upcoming |
The amending Regulation (EU) 2026/1744 (“Digital Omnibus”) was published in July 2026. It postpones the high-risk deadlines and, among other things, clarifies AI literacy under Article 4. Ongoing changes and news can be found under EU AI Act – news (last checked on 12 October 2026).
Checklist: what SMEs should do now
- Record all AI applications in use and planned in an AI inventory.
- Determine the role (provider / deployer) and the risk category for each system.
- Plan and document measures for the AI literacy of employees (Art. 4).
- Check transparency obligations – for example for chatbots on your website or AI-generated content.
- Introduce an AI policy with clear rules for employees.
- Define responsibilities and an approval process for new AI applications.
Official sources
Note: This page provides an overview and does not replace legal advice in individual cases.
Last updated: September 2026 · Author: Dipl.-Ing. (FH) Herbert Schrank