How to prepare for the EU AI Act: the new dates and steps

• In short: the EU AI Act applies in stages, and Regulation (EU) 2026/1744 (the Digital Omnibus, in force since 27 July 2026) moved the dates: high-risk rules apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• Article 4 (AI literacy) has applied since 2 February 2025. The new text asks for "measures to support" people's AI literacy, not a "sufficient level" and not a certificate.
• Transparency obligations (Article 50) apply from 2 August 2026; for marking generated content (Article 50(2)) the transition runs to 2 December 2026.
• In Romania, ANCOM is the market-surveillance authority, but the national law on sanctions had not been adopted when we checked on 26 September 2026.

This article is an operational guide, not legal advice; for your company's specific situation, talk to a lawyer.

What changed in the EU AI Act in 2026?

The EU AI Act classifies AI systems by risk level and imposes obligations proportionate to the risk. In 2026 the rules changed: the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026, postponed the rules for high-risk systems and rewrote Article 4. Many pages still say the regulation becomes "fully applicable in August 2026"; for high-risk systems that is no longer true. Article 4 now asks companies that use AI to "take measures to support the development of AI literacy" of their people, taking into account their knowledge, experience and context, and states that no specific level has to be guaranteed for any individual. For the people side, see AI workshops for company teams run by Vlad Tudor.

Which AI Act dates apply now?

The table below follows the text of Regulation 2026/1744 and the timeline published by the European Commission's AI Act Service Desk.

How do I classify the risk of the AI systems I use?

Classification decides how many obligations you have, and from when. Run every AI system in your company through the table below before anything else. For most companies, business applications (an internal chatbot, a document automation, an assistant that answers from company documentation) fall into limited or minimal risk, not high risk.

The most common trap is to assume you are high risk and block projects out of caution, or the reverse: to run a CV-screening tool without realising that it is precisely an Annex III system. Correct classification, system by system, is the first investment to make.

What is the practical compliance checklist for a company?

For a company without a dedicated AI legal team, preparation comes down to five steps, in order. You don't need to be a lawyer to go through them; you need to be organised.

1. Build the AI systems register: which tool, who uses it, for what, what data goes in, who owns it.
2. Classify each system's risk with the table above, and note from which date its obligations apply.
3. Document what the system does, on what data, what it decides and who is responsible. For high risk it is mandatory; for the rest it is good hygiene.
4. Keep a person in charge where the system affects people, and tell users when they are dealing with an AI.
5. Take AI-literacy measures by role and keep a training log: who, when, what was covered.

On step five, the European Commission's AI literacy Q&A says no certificate is needed, an internal record of trainings is enough, and there is no single format: different levels of training for different groups are appropriate. The duty also covers contractors who work with AI systems on the company's behalf.

What does this mean if I use AI in recruitment and HR?

Some of it applies already, the rest from 2 December 2027. Since 2 February 2025, using AI to infer people's emotions in the workplace is banned, except for medical or safety reasons. From 2 December 2027, the high-risk rules apply to AI used in recruitment, selection, promotion, termination, task allocation or performance monitoring. As an employer deploying such systems, you use them according to the instructions, with human oversight by trained people, keep the logs, and inform workers' representatives and affected workers before putting them into service. The delay is not a reason to wait: the GDPR already applies to automated decisions about candidates.

Who enforces the AI Act in Romania, and what are the fines?

Supervision and enforcement start in August 2026 and sit with national market-surveillance authorities, not the AI Office. In Romania, ANCOM has been designated market-surveillance authority and single point of contact, alongside sector authorities (ASF, BNR, ANSPDCP). The national law setting the sanctions regime was still being prepared in July 2026, as ANCOM confirmed, and had not been adopted as of mid-August 2026, according to JURIDICE.ro. That does not make the obligations optional: the regulation applies directly. Article 99 sets the ceilings for fines, Member States set the actual regime, and the Commission requires any sanction to be proportionate to the nature and gravity of the breach and to whether it was intentional or negligent. An up-to-date register is exactly what shows you were not negligent.

How do you build a new AI system with the AI Act in mind?

The cheapest moment for compliance is before the first line of code. When Sapio builds an AI agent or an automation, the AI Act questions are part of scoping: which risk class the system falls into, what users must be told, where a person stays in charge, what gets logged, and what documentation you receive at handover. AI Act preparation is part of our AI consulting and AI transformation work. If you are planning such a project, tell us what you want to build in the contact form; after a short call we send you an offer that fits.

Sources

• Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex, Official Journal, 24 July 2026
• European Commission, AI literacy questions and answers, updated 27 July 2026
• AI Act Service Desk, implementation timeline
• AGERPRES, ANCOM statement on applying the AI Act in Romania, 24 July 2026 (Romanian)
• JURIDICE.ro, "The AI Act applies in Romania but cannot yet be sanctioned", 13 August 2026 (Romanian)