What it requires today, what was postponed and what a company that only uses AI has to do
A reading of Regulation (EU) 2024/1689 and the digital omnibus of July 2026 in the language of a leadership team: which category what you use falls into, which obligations already apply, which have moved to 2027 and 2028, and the minimum required of a mid-sized company.
The EU Artificial Intelligence Act—Regulation (EU) 2024/1689, in force since 1 August 2024—doesn't regulate the technology: it regulates its uses. The same tool can be free of obligations in one case and high-risk in another, depending on what it's used for and who it makes decisions about. That's why the first question is never “which tool are we using?”, but “what are we using it for, and about whom”.
Because it's a regulation, it applies directly in every Member State with no need for transposition. What each country does have to do is designate authorities and set its penalty regime—and that's where Spain is still only halfway there, as explained further down.
Develops an AI system and markets it, or puts it into service under its own name or trademark. Bears the bulk of the obligations: risk management, data quality, technical documentation, record-keeping, human oversight by design and post-market monitoring.
Uses an AI system under its own authority—the norm in a mid-sized company. Lighter but real obligations: using it in line with the instructions, ensuring human oversight, reporting serious incidents and, for high-risk systems, informing the workers affected.
A deployer can become a provider without realising it: if it puts its brand on a high-risk system, substantially modifies it or changes its intended purpose. It then takes on the provider's obligations, in full.
On 27 July 2026 Regulation (EU) 2026/1744, the Digital Omnibus on AI, came into force, simplifying the regulation and moving dates. The headline: what already applied still applies. What moved is the high-risk block.
The regulation exists, but its obligations are phased in. The clock starts ticking.
Unacceptable uses are banned. And Article 4 comes into force: every company that uses AI must take AI literacy measures for its staff. No size threshold: a twelve-person company is covered too.
The governance rules and the obligations for providers of general-purpose AI models kick in—the large models that almost everything else is built on.
The regulation becomes fully applicable and the transparency obligations of Article 50 kick in: telling people when they're interacting with an AI and labelling certain synthetic content. This was not postponed.
The prohibition added by the omnibus comes into force: AI systems that generate non-consensual sexually explicit intimate content and child sexual abuse material.
Stand-alone high-risk systems: biometrics, critical infrastructure, education, employment, essential services, migration and justice. It was due on 2 August 2026 and the omnibus moved it here.
AI embedded in products already covered by sectoral safety legislation—machinery, lifts, medical devices. It was due in August 2027.
The regulation classifies by the risk of the use, not by the power of the tool. Go through all four in order: the first one that fits is yours.
| Category | What's in it | What it means |
|---|---|---|
| Unacceptable risk | Social scoring, manipulation that exploits vulnerabilities, emotion recognition in the workplace or in educational institutions, biometric categorisation based on sensitive characteristics, untargeted scraping of facial images. | Prohibited. There's no compliance regime: it can't be done. |
| High risk | Recruitment and staff management, access to education, credit scoring, life and health insurance, critical infrastructure, biometrics, and AI embedded in products with their own safety legislation. | The full regime. For whoever uses it: human oversight, use in line with the instructions, informing the workers affected and reporting incidents. |
| Transparency risk | Systems that interact with people, synthetic content generation, deepfakes, emotion recognition systems outside the prohibited cases. | Disclose. People have to know they're talking to an AI or that the content is generated. In force since August 2026. |
| Minimal risk | The vast majority of business use: drafting, summarising, translating, searching, classifying documents, assisting with programming. | No specific obligations under the regulation. Data protection, intellectual property and confidentiality still apply. |
The practical conclusion for a mid-sized company tends to be reassuring and tends to surprise: almost everything it's already using falls under minimal risk or transparency. The point where that changes is always the same—when the system starts making decisions about people—and that point is almost always crossed unintentionally, starting with human resources.
Since 2 February 2025, Article 4 has required providers and deployers to take measures so that their staff have a sufficient level of AI literacy. There's no size or sector threshold: if your company uses AI, it applies.
The July 2026 omnibus softened the wording—it no longer requires ensuring a specific individual level, but taking, and being able to demonstrate, support and promotion measures—and strengthened the role of the Commission and the Member States in facilitating that training. The obligation to have something written down and demonstrable doesn't go away.
Training by role—who uses, who reviews, who decides—isn't a generous reading of the law. It's what the law asks for and, as it happens, the only thing that works.
The regulation applies directly, but each state designates its authorities and sets its penalty regime. In Spain that's done by the draft Organic Law for the proper use and governance of artificial intelligence (Proyecto de Ley Orgánica para el buen uso y la gobernanza de la Inteligencia Artificial), approved by the Council of Ministers on 26 May 2026 and published in the Boletín Oficial de las Cortes Generales on 12 June 2026.
As of this guide's review date it's still going through parliament. In other words: the European framework already applies, but the Spanish penalty regime isn't settled yet. The penalty not being finalised doesn't suspend the obligation—it only delays who collects it and how.
The Spanish Agency for the Supervision of Artificial Intelligence (Agencia Española de Supervisión de la Inteligencia Artificial), based in A Coruña, is the central supervisory and notifying authority.
It shares powers with the Spanish Data Protection Agency and with sectoral authorities, depending on the system's area. The same case can have more than one supervisor.
The European regulation sets penalties of up to €35 million or 7% of worldwide turnover for prohibited practices, with lower bands for other infringements. The Spanish bill adopts that range.
Eleven points. They don't cover the high-risk regime—if it applies to you, this isn't enough—but they cover what most companies turning over €3–50M are required to do today, and they can be wrapped up in a morning's work.
The high-risk block was postponed. The prohibitions, AI literacy and transparency are in force and are exactly the ones that affect everyday business use.
Article 4 has no size threshold, and deployer obligations apply to anyone using a system under their authority. There are simplifications for SMEs and mid-cap companies, but simplifying isn't exempting.
Using it already makes you a deployer. And if you put your brand on a high-risk system or change its purpose, you become a provider with all its obligations.
They're separate frameworks that coexist. Data protection looks at personal data; the AI framework looks at how the system is used and its consequences, whether or not personal data is involved. Complying with one doesn't cover the other.
Everything stated here comes from these documents. If something doesn't match what you read elsewhere, the official text wins.
PDF guide, with the updated timeline and the compliance checklist
The complete guide with the timeline, the risk-category decision tree, the eleven-point checklist and links to the official sources.
Everything in the file is also on this page, open and without asking for anything. The email is so we can send you the version you can print and take to a session.
Done. Here it is.
Download the guide as a PDFIf the file doesn't open, save this link: it will keep working.
You decide which cookies we use
With your permission, we measure, in aggregate, how quether.com is used and remember your visit to show you Quether ads on Facebook and Instagram. You can accept everything, reject everything or choose. More detail in our cookie policy.
