By Anna Shpak, Founder & CEO, Generation Impact Global

In short

The EU AI Act is now largely in application, and a July 2026 amendment moved some deadlines but left the core rules in place. Six points to take away:

1. The AI Act reaches beyond the EU. It applies to providers and deployers outside the EU whenever the output of their AI system is used in the EU. A Swiss company serving EU clients is likely to be in scope.
2. It regulates by risk, not by technology. A few uses are banned, a defined list is high-risk, some systems carry transparency duties, and everything else is minimal risk.
3. Much of it already applies. Bans and AI literacy since February 2025, general-purpose AI rules since August 2025, transparency rules and most of the Act since 2 August 2026.
4. The Digital Omnibus delayed the heaviest part. Regulation (EU) 2026/1744 moved high-risk obligations to 2 December 2027 for standalone systems and 2 August 2028 for systems inside regulated products. It kept the four risk levels, though it added two new bans.
5. The rest of the world is moving too, but differently. The Council of Europe has a binding treaty, Switzerland is preparing its own approach, South Korea’s AI Basic Act took effect in January 2026, and the US federal government is pushing against state-level rules.
6. Finance has extra layers. For banks, asset managers and insurers, DORA, supervisory statements from ESMA, the EBA and EIOPA, and data protection law apply to AI alongside the AI Act.

This article explains each in plain language, gives a practical checklist, and shows how Generation Impact Global applies the AI Act to its own AI features. A companion article explains how AI agents work and why a specialised platform is usually a better route than building your own.

This article is general information, not legal advice.

Why AI regulation matters, even if you only use AI

Many organisations assume AI rules are for the companies that build models. That is only partly true. The EU AI Act gives duties to two main groups: providers, who develop or market an AI system under their own name, and deployers, who use one in their work. If your team uses an AI tool in a professional setting, you are a deployer.

Three practical reasons to care:

• Your own duties. Deployers have obligations of their own, starting with AI literacy for staff and, for some uses, transparency towards the people affected.
• Your suppliers’ duties. When you buy AI, you depend on the provider meeting its obligations. If it does not, your use may be affected, and you will be asked about it by auditors, clients and supervisors.
• Your clients’ expectations. Banks, investors and large corporates now ask suppliers how they govern AI. For financial institutions, these questions are backed by supervisory rules on outsourcing and ICT risk.

For sustainability reporting the link is direct. If AI helps prepare figures that go into a CSRD report, an SFDR disclosure or a bank’s ESG risk assessment, the people relying on those figures will want to know how that AI is controlled.

The EU AI Act in plain words

The AI Act, Regulation (EU) 2024/1689, was adopted on 13 June 2024 and entered into force on 1 August 2024. The European Commission describes it as the first comprehensive legal framework on AI. Article references below follow the European Commission’s AI Act Service Desk, which shows the text as amended by the Digital Omnibus.

Who it covers

Under Article 2, the Act applies to:

• providers placing AI systems or general-purpose AI models on the EU market, wherever they are based;
• deployers established in the EU;
• providers and deployers outside the EU where the output of the AI system is used in the EU;
• importers, distributors and certain product manufacturers.

Non-EU companies often overlook the third point. A Swiss, British or American company whose AI output reaches EU users is likely to be in scope.

The roles

One company can hold several roles. A software company that builds a feature on top of another firm’s model and sells it under its own brand can be a provider for that feature and a deployer of the underlying service.

Four levels of risk

1. Prohibited. Article 5 bans a short list of practices, in force since 2 February 2025:

• manipulative or deceptive techniques that distort behaviour and cause harm;
• exploiting vulnerabilities linked to age, disability or social or economic situation;
• social scoring;
• predicting that someone will commit a crime based solely on profiling;
• untargeted scraping of facial images to build recognition databases;
• emotion recognition at work or in education, except for medical or safety reasons;
• biometric categorisation to infer sensitive traits;
• real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.

The Digital Omnibus added two more bans, applying from 2 December 2026: AI that creates realistic intimate imagery of an identifiable person without consent, and AI that generates child sexual abuse material.

2. High-risk. There are two routes into this category (Article 6):

• AI that is a safety component of a product already covered by EU product law, such as medical devices, toys or lifts (Annex I). Following the Omnibus, AI in machinery is handled under the Machinery Regulation instead;
• AI used in the areas listed in Annex III: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and justice and democracy.

For finance, two Annex III entries stand out: credit scoring of individuals (fraud detection is excluded), and risk assessment and pricing for life and health insurance.

An Annex III system can fall outside high-risk if it poses no significant risk, for example because it only performs a narrow procedural task, improves the result of work a person has already done, or does preparatory work. A system that profiles individuals is always high-risk. A provider relying on this exception must document its assessment and register the system.

High-risk systems carry the heaviest duties: risk management, data quality, technical documentation, logging, human oversight, accuracy and security, and conformity assessment. Deployers of high-risk systems must follow the instructions for use, assign human oversight, and keep logs for at least six months (Article 26).

3. Transparency. Article 50 applies from 2 August 2026:

• providers must tell people when they are interacting with an AI system, unless it is obvious;
• providers of generative AI must mark synthetic audio, images, video and text in a machine-readable way;
• deployers of emotion recognition or biometric categorisation systems must inform the people exposed, and deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest, unless a person has reviewed and taken editorial responsibility for it.

The Commission published a voluntary code of practice on marking and labelling AI-generated content on 10 June 2026. On 20 July 2026 it also published guidelines explaining how the Article 50 duties apply.

4. Minimal risk. Everything else, which is most AI in use today. No specific duties beyond AI literacy, though voluntary codes are encouraged.

AI literacy

Article 4 has applied since 2 February 2025 to all providers and deployers, whatever the risk level. The Digital Omnibus softened the wording: organisations must now take measures to support the AI literacy of staff and others using AI on their behalf, and the law does not require any specific level for any individual. In practice, it still means training people on what the AI does, what it does not do, and how to check its output.

General-purpose AI models

Rules for providers of general-purpose AI models, such as the large language models behind chat assistants, have applied since 2 August 2025. Under Article 53, they must keep technical documentation, give information to companies building on their models, have a copyright policy, and publish a summary of their training content. Models trained with more than 10^25 floating-point operations are presumed to carry systemic risk and face extra duties. Models placed on the market before 2 August 2025 have until 2 August 2027.

A voluntary General-Purpose AI Code of Practice, published on 10 July 2025, helps providers show compliance. Signatories listed by the Commission include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI.

For businesses that buy AI, this matters indirectly: the model providers your software vendor relies on now have documented legal duties of their own.

Penalties

For SMEs and start-ups, the lower of the two amounts applies, and the same goes for small mid-caps except for prohibited practices (Article 99).

Who enforces it

The European Commission’s AI Office supervises general-purpose AI models and, following the Omnibus, AI systems built on a provider’s own general-purpose model and AI systems integrated into very large online platforms and search engines. National market surveillance authorities handle most other enforcement. An AI Board of Member State representatives, a scientific panel and an advisory forum support the system (Commission overview).

Timeline after the Digital Omnibus

The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026, just before the original high-risk deadline of 2 August 2026. It moved the timing of the high-risk regime, not its substance.

Dates up to 2 December 2026 already apply or are imminent. The two high-risk dates are the ones the Omnibus moved; the 2 December 2026 date covers the two new bans and machine-readable marking for generative systems placed on the market before 2 August 2026 (Article 111, Article 113).

The Omnibus made a few other changes worth knowing:

• AI literacy softened from a duty to ensure literacy to a duty to take measures that support it.
• Registration stays for Annex III systems that a provider assesses as not high-risk, with less information required.
• Bias detection: the legal basis to process sensitive personal data to detect and correct bias now covers all AI systems, not only high-risk ones, and still only where strictly necessary.
• SME relief extended, including to small mid-cap companies.
• The AI Office gains direct supervisory powers over AI systems built on a provider’s own general-purpose model, and over AI systems integrated into very large online platforms and search engines.

What organisations should do now

The delay to high-risk rules is not a reason to wait. AI literacy, bans and transparency duties already apply, and the work for high-risk systems takes time. A practical sequence:

1. Know what you use

• List every AI system in use, including features inside software you already buy.
• Record the supplier, purpose, data used, and who owns each system internally.
• Note where staff use personal AI tools for work, and decide what is allowed.

2. Classify each use

• Check each use against the prohibited practices in Article 5.
• Check whether any use falls in Annex III, such as credit scoring, HR decisions or insurance pricing.
• Note whether you are a provider, a deployer, or both, for each system.
• Note which Article 50 transparency duties apply.

3. Act on what already applies

• Put AI literacy measures in place: role-based training on what each tool does, its limits, and how to check its output.
• Label AI interactions and AI-generated content where Article 50 requires it.
• Write a short AI policy: approved tools, data rules, human review, escalation.

4. Manage suppliers

• Ask each AI supplier for its own risk classification and transparency notice.
• Check contracts for data use, model training, retention, sub-processors and audit rights.
• For financial entities, bring AI suppliers into your DORA register and third-party risk process.

5. Prepare for high-risk duties if relevant

• If any use is high-risk, start on risk management, data governance, logging and human oversight now. The deadline is 2 December 2027, and supporting standards and guidance are still arriving.
• Follow the Commission’s draft guidelines on high-risk classification, published in May 2026.

6. Keep it alive

• Review the inventory and classifications at least once a year, and whenever a tool, model or purpose changes.
• Consider a recognised framework such as ISO/IEC 42001 to structure the work.

Beyond the EU: the global picture

No other jurisdiction has copied the AI Act wholesale, but the same themes recur everywhere: transparency, human oversight, fairness, security and accountability.

Council of Europe Framework Convention on AI

The Framework Convention on Artificial Intelligence is the first binding international treaty on AI. It opened for signature on 5 September 2024 and focuses on human rights, democracy and the rule of law across the whole life of an AI system. Switzerland signed it on 27 March 2025. The EU ratified it on 15 May 2026, the first and so far only ratification. It enters into force three months after five signatories, including at least three Council of Europe member states, have ratified it. It is therefore not yet in force.

Switzerland

Switzerland has chosen not to copy the AI Act. On 12 February 2025, the Federal Council decided to ratify the Council of Europe Convention, adapt Swiss law where needed, and keep regulation largely sector-specific. A consultation draft covering transparency, data protection, non-discrimination and oversight is being prepared by the Federal Office of Justice, with the latest official timing pointing to early or spring 2027.

Meanwhile, existing law already applies. The Federal Data Protection and Information Commissioner has stated that the Federal Act on Data Protection applies directly to AI. In practice that means being transparent about the purpose, workings and data sources of AI processing, allowing people to object to automated processing and to ask for human review of automated decisions, carrying out impact assessments for high-risk processing, telling people when they are talking to a machine, and clearly labelling deepfakes.

For Swiss financial institutions, FINMA’s Guidance 08/2024 sets supervisory expectations on governance and risk management for AI, including model, data, IT and third-party dependency risks.

A Swiss company selling into the EU therefore lives under both regimes: Swiss data protection law at home, and the AI Act wherever its AI output is used in the EU.

International principles

• OECD AI Principles. Adopted in 2019 and updated in May 2024, they set five values-based principles: inclusive growth, sustainable development and well-being; respect for the rule of law, human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability.
• UNESCO Recommendation on the Ethics of AI. Adopted in November 2021 by all 193 member states, it sets values and principles including human oversight, transparency and non-discrimination.
• G7 Hiroshima Process. A voluntary code of conduct for organisations developing advanced AI, agreed on 30 October 2023, with an OECD reporting framework launched in 2025.
• United Nations. A General Assembly resolution of August 2025 set up an Independent International Scientific Panel on AI and a Global Dialogue on AI Governance. The first Dialogue met in Geneva in July 2026.

Other major jurisdictions

• United Kingdom. No AI-specific law. Existing regulators apply five cross-sector principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. UK GDPR still applies to personal data.
• United States. No federal AI law. A January 2025 executive order told agencies to review and roll back measures taken under the revoked 2023 AI safety order, and a December 2025 order seeks a national framework and challenges state AI laws. States continue to act: Colorado replaced its 2024 AI Act with a narrower law on automated decision-making (SB 26-189), due to take effect on 1 January 2027 if the state completes its implementing rules by then, and California’s SB 53 requires transparency from developers of the largest frontier models.
• China. Binding, service-specific rules. Interim measures for generative AI services have applied since August 2023, and rules on labelling AI-generated content since 1 September 2025, requiring both visible labels and hidden metadata.
• South Korea. The AI Basic Act took effect on 22 January 2026, with duties for high-impact AI and generative AI labelling, and a grace period of at least one year before fines.
• Japan. The AI Promotion Act of 2025 encourages responsible AI and asks businesses to cooperate with government measures. It has no penalties.
• Brazil. A risk-based AI bill passed the Senate in December 2024 and is still before the Chamber of Deputies.

At a glance

Sector rules for finance

For banks, asset managers, insurers and the companies that supply them, the AI Act is only one layer. Financial supervisors apply existing rules to AI as well.

The AI Act also eases the load for financial institutions in one respect: deployers that are financial institutions can meet some monitoring and logging duties through their existing governance and documentation under financial services law (Article 26).

For a sustainability data provider, the DORA point is the most immediate. When a bank uses software to collect clients’ ESG data under the EBA guidelines on the management of ESG risks, that software sits inside the bank’s ICT third-party risk framework, AI features included. See also our pages on ESG for investment and finance and stress testing.

Standards that make governance practical

Laws say what must be achieved. Standards and frameworks show how. Four are worth knowing.

OWASP has also published a Top 10 for Agentic Applications, covering hijacking of agent behaviour, misuse of tools and abuse of identity or privileges.

For a company already certified to ISO/IEC 27001, ISO/IEC 42001 is a natural next step: the structure is familiar and much of the evidence overlaps.

Ethics, governance and security: the three pillars

Read side by side, the AI Act, the Council of Europe Convention, the OECD and UNESCO principles, and the guidance from AI developers point to the same three pillars. Together they cover most of what the rules ask for.

Ethics: what the AI should and should not do

• Human oversight. People stay responsible for decisions, and can review, correct or overrule the AI.
• Fairness. The AI should not produce discriminatory outcomes. Where it affects people, test for bias.
• Transparency. People should know when AI is involved, what it does and what its limits are.
• Proportionality. Use AI where it adds value, and avoid uses whose risks outweigh the benefit.

Governance: who is accountable, and how

• Ownership. Every AI system has a named owner.
• Inventory and classification. You know what you use, why, and under which rules.
• Policy and training. Staff know what is allowed and how to check output.
• Records. Decisions, assessments and changes are documented so they can be shown to auditors and supervisors.
• Supplier management. Contracts cover data use, model training, retention and audit rights.

Security: keeping the system and data safe

• Data protection. Only necessary data goes to AI services, under agreements that restrict its use.
• Least privilege. AI features get the minimum access their task requires.
• Attack testing. Defences against prompt injection and other AI-specific attacks are tested and retested.
• Logging and monitoring. AI use is logged so problems can be found and investigated.
• Certification. Independent audits, such as ISO/IEC 27001, confirm controls work in practice.

These pillars are not separate projects. A single control, such as recording who approved each AI-assisted figure, serves all three: it supports oversight, provides accountability and creates an audit trail.

How Generation Impact Global applies the AI Act

We are a Swiss company, and many of our clients are in the EU, so the AI Act applies to the AI features we offer. Everything about how we apply it is set out in one place: our AI Transparency Notice, published under Article 50. It explains which features use AI, how they work, how we have classified them under the AI Act, and what we expect from users.

Our AI features are there to support professional work, with people reviewing the output before it is used. VitAI™, the AI layer of our platform, shows its mapping proposals for review and keeps an audit log of decisions.

Related pages:

• Security and Licences and certifications
• Legal documents, including our privacy policy and data processing agreement
• Compliance and governance
• Data management
• Our companion article, AI agents explained

Frequently asked questions

Further reading on our site

• AI agents explained: how agentic AI works and why most organisations should not build it alone
• AI Transparency Notice
• VitAI™
• Guides: CSRD hub, SFDR hub, EU Taxonomy, ESPR
• Frameworks: ESRS, GRI, SFDR, VSME
• The EBA ESG rules are live: banks now need ESG data from their clients
• Security and Licences and certifications
• News on policy and regulation

Sources

European Union

• Regulation (EU) 2024/1689, the AI Act, EUR-Lex
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, EUR-Lex
• European Commission, AI Act Service Desk, consolidated text as at 27 July 2026, including Articles 4, 5, 6, 26, 50, 53, 99, 111, 113 and Annex III
• European Commission, Timeline for the implementation of the AI Act
• European Commission, AI Act governance and enforcement
• European Commission, General-Purpose AI Code of Practice, 10 July 2025
• European Commission, Code of practice on marking and labelling AI-generated content, 10 June 2026
• European Commission, Guidelines on the transparency obligations for providers and deployers of certain AI systems, 20 July 2026
• European Commission, Draft guidelines on the classification of high-risk AI systems, May 2026

Finance supervisors

• EIOPA, Digital Operational Resilience Act (DORA)
• ESMA, Public statement on AI and investment services, 30 May 2024
• EBA, AI Act implications for the EU banking sector, 21 November 2025
• EIOPA, Opinion on AI governance and risk management, 6 August 2025
• FINMA, Guidance 08/2024 on AI governance and risk management, 18 December 2024
• Regulation (EU) 2016/679, General Data Protection Regulation, Article 22, EUR-Lex

Switzerland and the Council of Europe

• Federal Council, decision on the approach to AI regulation, 12 February 2025
• Federal Office of Justice, Künstliche Intelligenz
• SME Portal, Draft AI regulation expected by early 2027, September 2026
• FDPIC, Current data protection law is directly applicable to AI
• Council of Europe, Switzerland signs the global treaty on AI, 27 March 2025
• Council of Europe, EU ratifies the Framework Convention on AI, May 2026

International

• OECD, Recommendation of the Council on Artificial Intelligence, as amended May 2024
• UNESCO, Recommendation on the Ethics of Artificial Intelligence
• European Commission, Hiroshima Process International Code of Conduct for Advanced AI Systems, 30 October 2023
• United Nations, Global Dialogue on AI Governance and Independent International Scientific Panel on AI

Other jurisdictions

• UK Government, A pro-innovation approach to AI regulation: government response, 6 February 2024
• The White House, Removing Barriers to American Leadership in Artificial Intelligence, January 2025
• The White House, Executive order on a national AI policy framework, December 2025
• Cyberspace Administration of China, Interim Measures for Generative AI Services, 2023, and Measures for Labelling AI-Generated Content, 2025
• US International Trade Administration, South Korea AI Basic Act
• Japanese Law Translation, Act on the Promotion of AI-related Technology
• Brazilian Chamber of Deputies, PL 2338/2023

Standards

• ISO/IEC 42001:2023, AI management systems
• ISO/IEC 23894:2023, AI risk management
• NIST, AI Risk Management Framework
• OWASP, Top 10 for LLM Applications 2026, August 2026, and Top 10 for Agentic Applications, December 2025

Generation Impact Global

• AI Transparency Notice, last updated 2 September 2026