The EU AI Act in 2026: what applies now, what was delayed, and what it means in Spain

The EU AI Act is already relevant for your company if you use AI tools. As of February 2025, you are not allowed to use AI for prohibited practices. You also need to take measures to ensure your team is AI-literate. From August 2026, you will need to label realistic AI content. For high-risk use cases like AI for screening job applicants, the Digital Omnibus pushed the heavy obligations back to 2 December 2027. Spain's intended national fines bill lapsed in October 2026, but the EU regulation still applies.

Summary AI Act in one paragraph

The AI Act (Regulation (EU) 2024/1689) regulates AI based on risk. Some use cases are completely prohibited. For high-risk use cases (mostly about people) there are strict rules. There are transparency obligations for systems that interact with people or generate content. For everything else, it's largely unregulated. The law defines roles and their obligations: the provider (the one that develops or sells the AI system, e.g. OpenAI, Google, Anthropic, software vendor) and the deployer (the one that deploys the AI system under its own authority). Most companies are deployers and have lighter but already applicable obligations.

Timeline after the Digital Omnibus

The Digital Omnibus on AI (Regulation (EU) 2026/1744) has been in force since 27 July 2026. It changed the high-risk deadlines and introduced two additional prohibitions. Here is the current timeline:

What has changed with the Digital Omnibus and what hasn't?

The Digital Omnibus was sold as a simplification. For companies that only use AI, it didn't change as much as you'd think from the headlines:

• Delay of the high-risk obligations: 2 December 2027 for the use cases listed in Annex III, 2 August 2028 for AI in regulated products.
• AI literacy obligation became more lenient, but is still there. Before, Article 4 said companies must ensure a sufficient level of AI literacy. Now, it says they must take measures to support AI literacy. And no specific level needs to be guaranteed for any individual.
• Two new prohibitions (from 2 December 2026): AI generating or manipulating sexually explicit images of identifiable people without their consent. And AI generating child sexual abuse material.
• Further relief for growing companies. Reduced fines and simplified documentation for SMEs now also apply to small mid-caps.
• Legal basis for bias correction. Providers can, under strict conditions, process sensitive personal data to detect and correct bias in their systems.

What hasn't changed: the original prohibitions, the transparency rules of Article 50 and the obligations of general-purpose model providers. All applicable on their original dates.

What you need to do as a company using AI

1. Avoid prohibited practices

As of 2 February 2025, the AI Act prohibits (among others): manipulative or deceptive techniques that distort people's behaviour and cause significant harm. Exploiting people's vulnerabilities (age, disability, economic situation). Social scoring. Emotion inference of employees or students (except for medical/safety reasons). Categorising people based on biometric data to infer sensitive traits such as ethnicity, political opinions, sexual orientation. Scraping images from the internet to build facial recognition databases. The one most likely to apply to an ordinary company is emotion recognition in the workplace (scoring the "mood" of call centre staff or candidates in video interviews).

2. Train your team (Article 4)

Every company using AI must take measures to ensure its staff (and anyone using AI on its behalf) is aware of what the tools can and can't do, the risks and the company's rules. No official certificate is required. No minimum number of hours. But you should be able to demonstrate what training you provided and to whom. So, in practice: a short session for everyone. A written AI policy. And a record of who did both. More in our Article 4 guide.

3. Be transparent (Article 50)

As of 2 August 2026:

• Deepfakes: if you publish an image/audio/video generated/manipulated with AI that looks real, you must disclose it's artificial. For obvious creative/satirical work, you only need to disclose it without spoiling it.
• Text about public interest matters: if you publish AI-generated text to inform the public, you must disclose it. Unless a person reviewed it and there is editorial responsibility. For example, a product description or marketing email is usually not "public interest" information. But a news-style article can be.
• Emotion recognition, biometric categorisation: if you use it (and it's not prohibited), you must inform the people exposed to it.
• Chatbots: if you use a system that interacts with people, you must make it clear it's an AI. This obligation lies with the provider. But if you have a chatbot on your website, make sure it does.

4. If you use AI for a high-risk area (from 2 December 2027)

Deployers of high-risk systems must:

• Use the system as instructed by the provider (Articles 26 and 27)
• Assign human oversight to people with the competence and authority to overrule the system
• Ensure the input data you control is relevant
• Monitor the system and report serious incidents
• Keep the logs the system generates for at least six months
• Inform workers and their representatives before using a high-risk system at work
• Inform people when a high-risk system is used to make decisions about them. Explain the decision if they ask (Article 86)
• Perform a fundamental rights impact assessment if you are a public body, provide a public service or use AI for credit scoring or pricing life and health insurance.

Do you use AI for a high-risk use case?

Annex III lists the areas where AI is high-risk. For a typical company, two are relevant:

• Employment: AI used for recruitment/selection (targeted job ads, screening, evaluating candidates). To decide on promotions or dismissals. To allocate tasks based on behaviour/personal traits. To monitor and evaluate performance.
• Access to essential services: AI used to evaluate individuals' creditworthiness. Or to price life and health insurance.

The other areas listed in Annex III (biometric identification, critical infrastructure, education, law enforcement, migration, justice and elections) are mostly relevant for public bodies and specialised vendors.

But there is an important exception (Article 6(3)): a system in one of those areas is not high-risk if it only performs a narrow procedural task. Or improves the result of work already done by a person. Or detects patterns without replacing human judgement. Or does preparatory work. It is always high-risk if it profiles people. So, asking AI to draft a job ad is not high-risk. But letting it rank the candidates is.

Fines

The AI Act sets maximum fines in three tiers (Article 99):

For SMEs (and, since the Omnibus, small mid-caps), the cap is the lower of the two figures. Each member state defines its own penalty rules within these limits. And who imposes them.

Spain: who enforces it, Spanish AI law that lapsed

Spain was the first EU country to set up an AI supervisory agency: AESIA (Agencia Española de Supervisión de la Inteligencia Artificial). Based in A Coruña. The Spanish data protection authority (AEPD) remains the authority for anything involving personal data.

But Spain doesn't have its own AI law. The government's bill on the "good use and governance of AI" (designating the authorities and setting the national penalty regime) reached Congress in June 2026. But it lapsed on 6 October 2026 because the Cortes were dissolved by Royal Decree 806/2026 ahead of the general election on 29 November. So, the next government will have to start over with a new bill.

But this doesn't suspend anything. The AI Act is an EU regulation and directly applies in Spain. On the dates above. Whether Spanish authorities can impose fines before the national law sets the penalty rules is a matter of debate among lawyers. But it's prudent to assume that the obligations stand. And what you did to comply will be judged once the rules are in place.

What to do this quarter

1. List the AI tools your company uses (including the ones people use on personal accounts). What are they used for?
2. Check if the list contains prohibited practices or high-risk use cases. For most companies, the answer will be "no" for both. But it's good to be sure.
3. Write/update your AI policy. And give everyone a short training session. Record who did it.
4. How do you label AI-generated content you publish? Especially realistic images/video.
5. If you have any high-risk use cases, start planning for December 2027 now: human oversight, logs, inform staff, ask your provider for its documentation.
6. Review it every year. And whenever you change your tools.

Sources

• Regulation (EU) 2024/1689 (AI Act): Articles 3, 4, 5, 6, 26, 27, 50, 86, 99, 113. Annex III.
• Regulation (EU) 2026/1744 (Digital Omnibus on AI). Consolidated reading in the AI Act Explorer.
• AESIA (Spanish AI Supervisory Agency).
• Congress of Deputies: bill 121/000096 (good use and governance of AI). Lapsed on 6 October 2026. Royal Decree 806/2026 (dissolving the Cortes).
• European Commission: AI literacy questions and answers.