IT Glossary
The EU AI Act regulates AI by risk level. Timeline after the 2026 AI Omnibus, deployer duties such as AI literacy, and why an AI inventory comes first.
November 2, 2026
The EU AI Act is a European regulation that sets rules for AI systems according to the risk they pose, from prohibited practices to high-risk systems, transparency obligations and minimal risk, with separate rules for general-purpose AI models. Formally Regulation (EU) 2024/1689, it entered into force on 1 August 2024 and applies to companies that provide AI and to those that deploy it.
The act distinguishes the provider, which develops an AI system or model and places it on the market, from the deployer, which uses an AI system under its own authority in a professional context. Most mid-market companies are deployers of AI assistants, AI features in SaaS tools and transcription services. The heaviest requirements fall mainly on providers, but two obligations already concern deployers: the ban on prohibited practices and the AI literacy obligation of Article 4. Neither can be met without knowing which AI tools staff actually use, including those adopted without IT approval.
Regulation (EU) 2024/1689 became generally applicable on 2 August 2026, one year after the obligations for general-purpose AI models. The AI Omnibus, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, postponed the high-risk obligations: they now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I (product-embedded) systems.
A 350-person software company approved one AI assistant for all staff. A SaaS discovery scan finds 27 AI tools in use, from meeting note-takers to AI features switched on inside the CRM, many paid on expense cards. Before planning AI literacy training per team or checking that no use comes close to a prohibited practice, the compliance lead needs that list, with the users of each tool.
Corma provides the inventory step: its shadow AI visibility identifies the AI tools in use with their users and licenses, access reviews with audit evidence document who still uses each tool, and AI spend monitoring tracks their cost.
In stages. It entered into force on 1 August 2024 and became generally applicable on 2 August 2026, with earlier dates for prohibited practices, AI literacy and general-purpose AI models, and later dates for high-risk systems.
Yes. A company using an AI system in a professional context is a deployer, already concerned by the ban on prohibited practices and by the AI literacy obligation.
For prohibited practices, fines can reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
It postponed the high-risk obligations, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. The act itself still became generally applicable on 2 August 2026.
