{"id":28179,"date":"2026-11-10T11:36:50","date_gmt":"2026-11-10T11:36:50","guid":{"rendered":"https:\/\/generationimpact.global\/?p=28179"},"modified":"2026-11-10T11:36:50","modified_gmt":"2026-11-10T11:36:50","slug":"ai-regulation-2026","status":"publish","type":"post","link":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/","title":{"rendered":"AI regulation in 2026: the EU AI Act, global rules, and how Generation Impact Global applies them"},"content":{"rendered":"\n<style data-wp-block-html=\"css\">\n.gig-article .gig-sources,.gig-article .gig-sources li,.gig-article .gig-sources a,.gig-article .gig-sources strong{font-size:13px!important;line-height:1.45!important}\n.gig-article p.gig-sources{margin:14px 0 4px!important}\n.gig-article ul.gig-sources{margin:0 0 10px!important;padding-left:18px}\n.gig-article ul.gig-sources li{margin:0 0 2px!important}\n.gig-article h2{font-weight:900;font-size:32px;line-height:1.3;margin:48px 0 16px}\n.gig-article h3{font-weight:800;font-size:22px;margin:32px 0 12px}\n.gig-article table{width:100%;border-collapse:collapse;margin:20px 0;font-size:15px}\n.gig-article th{background:#eff5f5;color:#2c555a;text-align:left;padding:10px;border:1px solid #dfeaeb}\n.gig-article td{padding:10px;border:1px solid #dfeaeb;vertical-align:top}\n.gig-article .gig-clip{margin:28px 0}\n.gig-article .gig-clip video{width:100%;height:auto;border-radius:12px;display:block}\n.gig-article .gig-clip figcaption{font-size:14px;color:#6c6763;margin-top:8px}\n<\/style>\n\n\n\r\n\t\t<div  class=\"block-265065fb-094e-49c5-95a5-1999f38eac50 areoi-element gig-article\">\r\n\t\t\t\r\n\t\t\t\n\n<p class=\"gig-meta fs-14 m-fs-12 has-custom-neutral-500-color has-text-color has-link-color wp-elements-1 wp-block-paragraph\">By Anna Shpak, Founder &amp; CEO, Generation Impact Global<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">In short<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The EU AI Act is now largely in application, and a July 2026 amendment moved some deadlines but left the core rules in place. Six points to take away:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>The AI Act reaches beyond the EU.<\/strong> It applies to providers and deployers outside the EU whenever the output of their AI system is used in the EU. A Swiss company serving EU clients is likely to be in scope.<\/li>\n\n\n\n<li><strong>It regulates by risk, not by technology.<\/strong> A few uses are banned, a defined list is high-risk, some systems carry transparency duties, and everything else is minimal risk.<\/li>\n\n\n\n<li><strong>Much of it already applies.<\/strong> Bans and AI literacy since February 2025, general-purpose AI rules since August 2025, transparency rules and most of the Act since 2 August 2026.<\/li>\n\n\n\n<li><strong>The Digital Omnibus delayed the heaviest part.<\/strong> Regulation (EU) 2026\/1744 moved high-risk obligations to 2 December 2027 for standalone systems and 2 August 2028 for systems inside regulated products. It kept the four risk levels, though it added two new bans.<\/li>\n\n\n\n<li><strong>The rest of the world is moving too, but differently.<\/strong> The Council of Europe has a binding treaty, Switzerland is preparing its own approach, South Korea&#8217;s AI Basic Act took effect in January 2026, and the US federal government is pushing against state-level rules.<\/li>\n\n\n\n<li><strong>Finance has extra layers.<\/strong> For banks, asset managers and insurers, DORA, supervisory statements from ESMA, the EBA and EIOPA, and data protection law apply to AI alongside the AI Act.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This article explains each in plain language, gives a practical checklist, and shows how Generation Impact Global applies the AI Act to its own AI features. A companion article explains how AI agents work and why a specialised platform is usually a better route than building your own.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>This article is general information, not legal advice.<\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why AI regulation matters, even if you only use AI<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Many organisations assume AI rules are for the companies that build models. That is only partly true. The EU AI Act gives duties to two main groups: <strong>providers<\/strong>, who develop or market an AI system under their own name, and <strong>deployers<\/strong>, who use one in their work. If your team uses an AI tool in a professional setting, you are a deployer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three practical reasons to care:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Your own duties.<\/strong> Deployers have obligations of their own, starting with AI literacy for staff and, for some uses, transparency towards the people affected.<\/li>\n\n\n\n<li><strong>Your suppliers&#8217; duties.<\/strong> When you buy AI, you depend on the provider meeting its obligations. If it does not, your use may be affected, and you will be asked about it by auditors, clients and supervisors.<\/li>\n\n\n\n<li><strong>Your clients&#8217; expectations.<\/strong> Banks, investors and large corporates now ask suppliers how they govern AI. For financial institutions, these questions are backed by supervisory rules on outsourcing and ICT risk.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For sustainability reporting the link is direct. If AI helps prepare figures that go into a <a href=\"https:\/\/generationimpact.global\/products\/csrd\/\">CSRD<\/a> report, an <a href=\"https:\/\/generationimpact.global\/products\/sfdr\/overview\/\">SFDR<\/a> disclosure or a bank&#8217;s <a href=\"https:\/\/generationimpact.global\/blog\/sustainable-banking-esg-data\/\">ESG risk assessment<\/a>, the people relying on those figures will want to know how that AI is controlled.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The EU AI Act in plain words<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The AI Act, <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\/eng\" target=\"_blank\" rel=\"nofollow noopener\">Regulation (EU) 2024\/1689<\/a>, was adopted on 13 June 2024 and entered into force on 1 August 2024. The European Commission describes it as the first comprehensive legal framework on AI. Article references below follow the European Commission&#8217;s <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-2\" target=\"_blank\" rel=\"nofollow noopener\">AI Act Service Desk<\/a>, which shows the text as amended by the Digital Omnibus.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who it covers<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Under <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-2\" target=\"_blank\" rel=\"nofollow noopener\">Article 2<\/a>, the Act applies to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>providers placing AI systems or general-purpose AI models on the EU market, <strong>wherever they are based<\/strong>;<\/li>\n\n\n\n<li>deployers established in the EU;<\/li>\n\n\n\n<li>providers and deployers outside the EU <strong>where the output of the AI system is used in the EU<\/strong>;<\/li>\n\n\n\n<li>importers, distributors and certain product manufacturers.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Non-EU companies often overlook the third point. A Swiss, British or American company whose AI output reaches EU users is likely to be in scope.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The roles<\/h3>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Role<\/th><th>Plain meaning<\/th><th>Article<\/th><\/tr><\/thead><tbody><tr><td>Provider<\/td><td>Develops an AI system, or has one developed, and puts it on the market under its own name or trademark, paid or free<\/td><td>3(3)<\/td><\/tr><tr><td>Deployer<\/td><td>Uses an AI system in a professional capacity<\/td><td>3(4)<\/td><\/tr><tr><td>Importer<\/td><td>An EU-based company bringing in a system carrying a non-EU company&#8217;s name<\/td><td>3(6)<\/td><\/tr><tr><td>Distributor<\/td><td>Anyone else in the supply chain making a system available in the EU<\/td><td>3(7)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">One company can hold several roles. A software company that builds a feature on top of another firm&#8217;s model and sells it under its own brand can be a provider for that feature and a deployer of the underlying service.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Four levels of risk<\/h3>\n\n\n\n<figure class=\"gig-clip mb-20 mb-lg-32\"><video aria-label=\"Animated pyramid of the four EU AI Act risk levels\" autoplay=\"\" loop=\"\" muted=\"\" controls=\"\" playsinline=\"\" poster=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-risk-levels-16x9-poster.jpg\" preload=\"metadata\"><source src=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-risk-levels-16x9.mp4\" type=\"video\/mp4\"><\/video><figcaption>The four risk levels of the EU AI Act.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Prohibited.<\/strong> <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-5\" target=\"_blank\" rel=\"nofollow noopener\">Article 5<\/a> bans a short list of practices, in force since 2 February 2025:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>manipulative or deceptive techniques that distort behaviour and cause harm;<\/li>\n\n\n\n<li>exploiting vulnerabilities linked to age, disability or social or economic situation;<\/li>\n\n\n\n<li>social scoring;<\/li>\n\n\n\n<li>predicting that someone will commit a crime based solely on profiling;<\/li>\n\n\n\n<li>untargeted scraping of facial images to build recognition databases;<\/li>\n\n\n\n<li>emotion recognition at work or in education, except for medical or safety reasons;<\/li>\n\n\n\n<li>biometric categorisation to infer sensitive traits;<\/li>\n\n\n\n<li>real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The Digital Omnibus added two more bans, applying from 2 December 2026: AI that creates realistic intimate imagery of an identifiable person without consent, and AI that generates child sexual abuse material.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. High-risk.<\/strong> There are two routes into this category (<a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-6\" target=\"_blank\" rel=\"nofollow noopener\">Article 6<\/a>):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AI that is a safety component of a product already covered by EU product law, such as medical devices, toys or lifts (Annex I). Following the Omnibus, AI in machinery is handled under the Machinery Regulation instead;<\/li>\n\n\n\n<li>AI used in the areas listed in <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/annex-3\" target=\"_blank\" rel=\"nofollow noopener\">Annex III<\/a>: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and justice and democracy.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For finance, two Annex III entries stand out: credit scoring of individuals (fraud detection is excluded), and risk assessment and pricing for life and health insurance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An Annex III system can fall outside high-risk if it poses no significant risk, for example because it only performs a narrow procedural task, improves the result of work a person has already done, or does preparatory work. A system that profiles individuals is always high-risk. A provider relying on this exception must document its assessment and register the system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">High-risk systems carry the heaviest duties: risk management, data quality, technical documentation, logging, human oversight, accuracy and security, and conformity assessment. Deployers of high-risk systems must follow the instructions for use, assign human oversight, and keep logs for at least six months (<a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-26\" target=\"_blank\" rel=\"nofollow noopener\">Article 26<\/a>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Transparency.<\/strong> <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-50\" target=\"_blank\" rel=\"nofollow noopener\">Article 50<\/a> applies from 2 August 2026:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>providers must tell people when they are interacting with an AI system, unless it is obvious;<\/li>\n\n\n\n<li>providers of generative AI must mark synthetic audio, images, video and text in a machine-readable way;<\/li>\n\n\n\n<li>deployers of emotion recognition or biometric categorisation systems must inform the people exposed, and deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest, unless a person has reviewed and taken editorial responsibility for it.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The Commission published a voluntary <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-publishes-code-practice-marking-and-labelling-ai-generated-content\" target=\"_blank\" rel=\"nofollow noopener\">code of practice on marking and labelling AI-generated content<\/a> on 10 June 2026. On 20 July 2026 it also published <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-publishes-guidelines-transparency-obligations-providers-and-deployers-certain-ai-systems\" target=\"_blank\" rel=\"nofollow noopener\">guidelines explaining how the Article 50 duties apply<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Minimal risk.<\/strong> Everything else, which is most AI in use today. No specific duties beyond AI literacy, though voluntary codes are encouraged.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">AI literacy<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-4\" target=\"_blank\" rel=\"nofollow noopener\">Article 4<\/a> has applied since 2 February 2025 to all providers and deployers, whatever the risk level. The Digital Omnibus softened the wording: organisations must now take measures to support the AI literacy of staff and others using AI on their behalf, and the law does not require any specific level for any individual. In practice, it still means training people on what the AI does, what it does not do, and how to check its output.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">General-purpose AI models<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Rules for providers of general-purpose AI models, such as the large language models behind chat assistants, have applied since 2 August 2025. Under <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-53\" target=\"_blank\" rel=\"nofollow noopener\">Article 53<\/a>, they must keep technical documentation, give information to companies building on their models, have a copyright policy, and publish a summary of their training content. Models trained with more than 10^25 floating-point operations are presumed to carry systemic risk and face extra duties. Models placed on the market before 2 August 2025 have until 2 August 2027.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A voluntary <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/gpai-code-practice\" target=\"_blank\" rel=\"nofollow noopener\">General-Purpose AI Code of Practice<\/a>, published on 10 July 2025, helps providers show compliance. Signatories listed by the Commission include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For businesses that buy AI, this matters indirectly: the model providers your software vendor relies on now have documented legal duties of their own.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Penalties<\/h3>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Breach<\/th><th>Maximum fine<\/th><th>Article<\/th><\/tr><\/thead><tbody><tr><td>Prohibited practices<\/td><td>EUR 35 million or 7% of worldwide annual turnover, whichever is higher<\/td><td>99(3)<\/td><\/tr><tr><td>Most other obligations, including transparency<\/td><td>EUR 15 million or 3%<\/td><td>99(4)<\/td><\/tr><tr><td>Incorrect or misleading information to authorities<\/td><td>EUR 7.5 million or 1%<\/td><td>99(5)<\/td><\/tr><tr><td>General-purpose AI model providers<\/td><td>EUR 15 million or 3%<\/td><td>101<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For SMEs and start-ups, the lower of the two amounts applies, and the same goes for small mid-caps except for prohibited practices (<a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-99\" target=\"_blank\" rel=\"nofollow noopener\">Article 99<\/a>).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Who enforces it<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The European Commission&#8217;s AI Office supervises general-purpose AI models and, following the Omnibus, AI systems built on a provider&#8217;s own general-purpose model and AI systems integrated into very large online platforms and search engines. National market surveillance authorities handle most other enforcement. An AI Board of Member State representatives, a scientific panel and an advisory forum support the system (<a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/ai-act-governance-and-enforcement\" target=\"_blank\" rel=\"nofollow noopener\">Commission overview<\/a>).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Timeline after the Digital Omnibus<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2026\/1744\/oj\/eng\" target=\"_blank\" rel=\"nofollow noopener\">Digital Omnibus on AI<\/a>, Regulation (EU) 2026\/1744, entered into force on 27 July 2026, just before the original high-risk deadline of 2 August 2026. It moved the timing of the high-risk regime, not its substance.<\/p>\n\n\n\n<figure class=\"gig-clip mb-20 mb-lg-32\"><video aria-label=\"Animated timeline of EU AI Act application dates\" autoplay=\"\" loop=\"\" muted=\"\" controls=\"\" playsinline=\"\" poster=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-ai-act-timeline-16x9-poster.jpg\" preload=\"metadata\"><source src=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig-ai-act-timeline-16x9.mp4\" type=\"video\/mp4\"><\/video><figcaption>EU AI Act application dates, as amended by the Digital Omnibus (Regulation (EU) 2026\/1744).<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Date<\/th><th>What applies<\/th><\/tr><\/thead><tbody><tr><td>2 February 2025<\/td><td>Prohibited practices and AI literacy duties apply<\/td><\/tr><tr><td>2 August 2025<\/td><td>Rules for general-purpose AI models apply<\/td><\/tr><tr><td>2 August 2026<\/td><td>Transparency duties (Article 50), governance and most remaining rules apply<\/td><\/tr><tr><td>2 December 2026<\/td><td>New prohibitions added by the Omnibus; machine-readable marking for generative systems already on the market<\/td><\/tr><tr><td>2 December 2027<\/td><td>High-risk obligations for Annex III systems<\/td><\/tr><tr><td>2 August 2028<\/td><td>High-risk obligations for Annex I systems (products under EU safety law)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Dates up to 2 December 2026 already apply or are imminent. The two high-risk dates are the ones the Omnibus moved; the 2 December 2026 date covers the two new bans and machine-readable marking for generative systems placed on the market before 2 August 2026 (<a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-111\" target=\"_blank\" rel=\"nofollow noopener\">Article 111<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-113\" target=\"_blank\" rel=\"nofollow noopener\">Article 113<\/a>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Omnibus made a few other changes worth knowing:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AI literacy softened<\/strong> from a duty to ensure literacy to a duty to take measures that support it.<\/li>\n\n\n\n<li><strong>Registration stays<\/strong> for Annex III systems that a provider assesses as not high-risk, with less information required.<\/li>\n\n\n\n<li><strong>Bias detection:<\/strong> the legal basis to process sensitive personal data to detect and correct bias now covers all AI systems, not only high-risk ones, and still only where strictly necessary.<\/li>\n\n\n\n<li><strong>SME relief<\/strong> extended, including to small mid-cap companies.<\/li>\n\n\n\n<li><strong>The AI Office<\/strong> gains direct supervisory powers over AI systems built on a provider&#8217;s own general-purpose model, and over AI systems integrated into very large online platforms and search engines.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What organisations should do now<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The delay to high-risk rules is not a reason to wait. AI literacy, bans and transparency duties already apply, and the work for high-risk systems takes time. A practical sequence:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Know what you use<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>List every AI system in use, including features inside software you already buy.<\/li>\n\n\n\n<li>Record the supplier, purpose, data used, and who owns each system internally.<\/li>\n\n\n\n<li>Note where staff use personal AI tools for work, and decide what is allowed.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Classify each use<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check each use against the prohibited practices in Article 5.<\/li>\n\n\n\n<li>Check whether any use falls in Annex III, such as credit scoring, HR decisions or insurance pricing.<\/li>\n\n\n\n<li>Note whether you are a provider, a deployer, or both, for each system.<\/li>\n\n\n\n<li>Note which Article 50 transparency duties apply.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Act on what already applies<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Put AI literacy measures in place: role-based training on what each tool does, its limits, and how to check its output.<\/li>\n\n\n\n<li>Label AI interactions and AI-generated content where Article 50 requires it.<\/li>\n\n\n\n<li>Write a short AI policy: approved tools, data rules, human review, escalation.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Manage suppliers<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ask each AI supplier for its own risk classification and transparency notice.<\/li>\n\n\n\n<li>Check contracts for data use, model training, retention, sub-processors and audit rights.<\/li>\n\n\n\n<li>For financial entities, bring AI suppliers into your DORA register and third-party risk process.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Prepare for high-risk duties if relevant<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If any use is high-risk, start on risk management, data governance, logging and human oversight now. The deadline is 2 December 2027, and supporting standards and guidance are still arriving.<\/li>\n\n\n\n<li>Follow the Commission&#8217;s <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/library\/draft-commission-guidelines-classification-high-risk-ai-systems\" target=\"_blank\" rel=\"nofollow noopener\">draft guidelines on high-risk classification<\/a>, published in May 2026.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6. Keep it alive<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Review the inventory and classifications at least once a year, and whenever a tool, model or purpose changes.<\/li>\n\n\n\n<li>Consider a recognised framework such as ISO\/IEC 42001 to structure the work.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Beyond the EU: the global picture<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">No other jurisdiction has copied the AI Act wholesale, but the same themes recur everywhere: transparency, human oversight, fairness, security and accountability.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Council of Europe Framework Convention on AI<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/www.coe.int\/en\/web\/artificial-intelligence\/-\/european-union-ratifies-the-council-of-europe-framework-convention-on-artificial-intelligence\" target=\"_blank\" rel=\"nofollow noopener\">Framework Convention on Artificial Intelligence<\/a> is the first binding international treaty on AI. It opened for signature on 5 September 2024 and focuses on human rights, democracy and the rule of law across the whole life of an AI system. <a href=\"https:\/\/www.coe.int\/en\/web\/artificial-intelligence\/-\/switzerland-signs-the-council-of-europe-s-global-treaty-on-ai\" target=\"_blank\" rel=\"nofollow noopener\">Switzerland signed it<\/a> on 27 March 2025. The EU ratified it on 15 May 2026, the first and so far only ratification. It enters into force three months after five signatories, including at least three Council of Europe member states, have ratified it. It is therefore not yet in force.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Switzerland<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Switzerland has chosen not to copy the AI Act. On <a href=\"https:\/\/www.admin.ch\/en\/nsb?id=104110\" target=\"_blank\" rel=\"nofollow noopener\">12 February 2025<\/a>, the Federal Council decided to ratify the Council of Europe Convention, adapt Swiss law where needed, and keep regulation largely sector-specific. A consultation draft covering transparency, data protection, non-discrimination and oversight is being prepared by the <a href=\"https:\/\/www.bj.admin.ch\/de\/kuenstliche-intelligenz\" target=\"_blank\" rel=\"nofollow noopener\">Federal Office of Justice<\/a>, with the <a href=\"https:\/\/www.kmu.admin.ch\/de\/bis-anfang-2027-soll-ein-vorentwurf-zur-ki-regulierung-ausgearbeitet-werden\" target=\"_blank\" rel=\"nofollow noopener\">latest official timing<\/a> pointing to early or spring 2027.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Meanwhile, existing law already applies. The Federal Data Protection and Information Commissioner has stated that the <a href=\"https:\/\/www.edoeb.admin.ch\/en\/update-current-legislation-directly-applicable-ai\" target=\"_blank\" rel=\"nofollow noopener\">Federal Act on Data Protection applies directly to AI<\/a>. In practice that means being transparent about the purpose, workings and data sources of AI processing, allowing people to object to automated processing and to ask for human review of automated decisions, carrying out impact assessments for high-risk processing, telling people when they are talking to a machine, and clearly labelling deepfakes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For Swiss financial institutions, FINMA&#8217;s <a href=\"https:\/\/www.finma.ch\/en\/news\/2024\/12\/20241218-mm-finma-am-08-24\/\" target=\"_blank\" rel=\"nofollow noopener\">Guidance 08\/2024<\/a> sets supervisory expectations on governance and risk management for AI, including model, data, IT and third-party dependency risks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A Swiss company selling into the EU therefore lives under both regimes: Swiss data protection law at home, and the AI Act wherever its AI output is used in the EU.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">International principles<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OECD AI Principles.<\/strong> Adopted in 2019 and <a href=\"https:\/\/legalinstruments.oecd.org\/public\/doc\/648\/648.en.pdf\" target=\"_blank\" rel=\"nofollow noopener\">updated in May 2024<\/a>, they set five values-based principles: inclusive growth, sustainable development and well-being; respect for the rule of law, human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability.<\/li>\n\n\n\n<li><strong>UNESCO Recommendation on the Ethics of AI.<\/strong> <a href=\"https:\/\/www.unesco.org\/en\/artificial-intelligence\/recommendation-ethics\" target=\"_blank\" rel=\"nofollow noopener\">Adopted in November 2021<\/a> by all 193 member states, it sets values and principles including human oversight, transparency and non-discrimination.<\/li>\n\n\n\n<li><strong>G7 Hiroshima Process.<\/strong> A voluntary <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/library\/hiroshima-process-international-code-conduct-advanced-ai-systems\" target=\"_blank\" rel=\"nofollow noopener\">code of conduct for organisations developing advanced AI<\/a>, agreed on 30 October 2023, with an OECD reporting framework launched in 2025.<\/li>\n\n\n\n<li><strong>United Nations.<\/strong> A General Assembly resolution of August 2025 set up an <a href=\"https:\/\/www.un.org\/independent-international-scientific-panel-ai\/en\/faq\" target=\"_blank\" rel=\"nofollow noopener\">Independent International Scientific Panel on AI<\/a> and a <a href=\"https:\/\/www.un.org\/global-dialogue-ai-governance\/en\/faq\" target=\"_blank\" rel=\"nofollow noopener\">Global Dialogue on AI Governance<\/a>. The first Dialogue met in Geneva in July 2026.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Other major jurisdictions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>United Kingdom.<\/strong> No AI-specific law. Existing regulators apply five <a href=\"https:\/\/www.gov.uk\/government\/consultations\/ai-regulation-a-pro-innovation-approach-policy-proposals\/outcome\/a-pro-innovation-approach-to-ai-regulation-government-response\" target=\"_blank\" rel=\"nofollow noopener\">cross-sector principles<\/a>: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. UK GDPR still applies to personal data.<\/li>\n\n\n\n<li><strong>United States.<\/strong> No federal AI law. A January 2025 <a href=\"https:\/\/www.whitehouse.gov\/presidential-actions\/2025\/01\/removing-barriers-to-american-leadership-in-artificial-intelligence\/\" target=\"_blank\" rel=\"nofollow noopener\">executive order<\/a> told agencies to review and roll back measures taken under the revoked 2023 AI safety order, and a <a href=\"https:\/\/www.whitehouse.gov\/presidential-actions\/2025\/12\/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy\/\" target=\"_blank\" rel=\"nofollow noopener\">December 2025 order<\/a> seeks a national framework and challenges state AI laws. States continue to act: Colorado replaced its 2024 AI Act with a narrower law on automated decision-making (SB 26-189), due to take effect on 1 January 2027 if the state completes its implementing rules by then, and California&#8217;s SB 53 requires transparency from developers of the largest frontier models.<\/li>\n\n\n\n<li><strong>China.<\/strong> Binding, service-specific rules. <a href=\"https:\/\/www.cac.gov.cn\/2023-07\/13\/c_1690898327029107.htm\" target=\"_blank\" rel=\"nofollow noopener\">Interim measures for generative AI services<\/a> have applied since August 2023, and <a href=\"https:\/\/www.cac.gov.cn\/2025-03\/14\/c_1743654684782215.htm\" target=\"_blank\" rel=\"nofollow noopener\">rules on labelling AI-generated content<\/a> since 1 September 2025, requiring both visible labels and hidden metadata.<\/li>\n\n\n\n<li><strong>South Korea.<\/strong> The <a href=\"https:\/\/www.trade.gov\/market-intelligence\/south-korea-ai-basic-act\" target=\"_blank\" rel=\"nofollow noopener\">AI Basic Act<\/a> took effect on 22 January 2026, with duties for high-impact AI and generative AI labelling, and a grace period of at least one year before fines.<\/li>\n\n\n\n<li><strong>Japan.<\/strong> The <a href=\"https:\/\/www.japaneselawtranslation.go.jp\/en\/laws\/view\/5066\" target=\"_blank\" rel=\"nofollow noopener\">AI Promotion Act<\/a> of 2025 encourages responsible AI and asks businesses to cooperate with government measures. It has no penalties.<\/li>\n\n\n\n<li><strong>Brazil.<\/strong> A risk-based AI bill passed the Senate in December 2024 and is <a href=\"https:\/\/www.camara.leg.br\/proposicoesWeb\/fichadetramitacao?idProposicao=2487262\" target=\"_blank\" rel=\"nofollow noopener\">still before the Chamber of Deputies<\/a>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">At a glance<\/h3>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Jurisdiction<\/th><th>Approach<\/th><th>Binding?<\/th><th>Status<\/th><th>Relevance for a company serving EU clients<\/th><\/tr><\/thead><tbody><tr><td>European Union<\/td><td>Risk-based law across all sectors<\/td><td>Yes<\/td><td>Largely in application; high-risk from Dec 2027 and Aug 2028<\/td><td>High: applies whenever AI output is used in the EU<\/td><\/tr><tr><td>Council of Europe<\/td><td>Human rights treaty<\/td><td>For ratifying states<\/td><td>EU ratified May 2026; Switzerland signed<\/td><td>Indirect: shapes national law<\/td><\/tr><tr><td>Switzerland<\/td><td>Sector-specific, plus data protection law<\/td><td>Data protection: yes; AI law: pending<\/td><td>Consultation draft expected early or spring 2027<\/td><td>High for Swiss companies<\/td><\/tr><tr><td>OECD, UNESCO, G7, UN<\/td><td>Principles and codes<\/td><td>No<\/td><td>In place<\/td><td>Benchmarks for good practice<\/td><\/tr><tr><td>United Kingdom<\/td><td>Principles applied by existing regulators<\/td><td>Mostly no<\/td><td>No AI-specific bill enacted<\/td><td>Low, unless serving UK clients<\/td><\/tr><tr><td>United States<\/td><td>Federal deregulation; state laws<\/td><td>States: yes<\/td><td>Contested between federal and state levels<\/td><td>Low for most EU-focused firms<\/td><\/tr><tr><td>China<\/td><td>Service-specific rules<\/td><td>Yes<\/td><td>In force<\/td><td>Only if serving the Chinese market<\/td><\/tr><tr><td>South Korea<\/td><td>Framework law<\/td><td>Yes<\/td><td>In force since Jan 2026<\/td><td>If serving Korean users; a local representative is needed above set thresholds<\/td><\/tr><tr><td>Japan<\/td><td>Promotion law<\/td><td>No penalties<\/td><td>In force<\/td><td>Low<\/td><\/tr><tr><td>Brazil<\/td><td>Risk-based bill<\/td><td>Not yet<\/td><td>In parliament<\/td><td>Watch<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Sector rules for finance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For banks, asset managers, insurers and the companies that supply them, the AI Act is only one layer. Financial supervisors apply existing rules to AI as well.<\/p>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Rule<\/th><th>What it means for AI<\/th><th>Source<\/th><\/tr><\/thead><tbody><tr><td>DORA (Regulation (EU) 2022\/2554), in application since 17 January 2025<\/td><td>An AI-enabled software service supplied to an EU financial entity is an ICT third-party service. Expect contract clauses, audit rights, incident support, a place in the client&#8217;s register of information, and exit plans.<\/td><td><a href=\"https:\/\/www.eiopa.europa.eu\/digital-operational-resilience-act-dora_en\" target=\"_blank\" rel=\"nofollow noopener\">EIOPA overview<\/a><\/td><\/tr><tr><td>ESMA public statement on AI in investment services, 30 May 2024<\/td><td>Under MiFID II, management stays responsible for decisions however they are made. Firms should tell clients when AI is used, train staff, test regularly, manage bias and false outputs, and apply outsourcing rules to third-party AI.<\/td><td><a href=\"https:\/\/www.esma.europa.eu\/sites\/default\/files\/2024-05\/ESMA35-335435667-5924__Public_Statement_on_AI_and_investment_services.pdf\" target=\"_blank\" rel=\"nofollow noopener\">ESMA statement<\/a><\/td><\/tr><tr><td>EBA AI Act factsheet, 21 November 2025<\/td><td>No significant contradictions found between the AI Act and EU banking and payments law. Credit scoring of individuals is high-risk under the AI Act.<\/td><td><a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/2025-11\/d8b999ce-a1d9-4964-9606-971bbc2aaf89\/AI%20Act%20implications%20for%20the%20EU%20banking%20sector.pdf\" target=\"_blank\" rel=\"nofollow noopener\">EBA factsheet<\/a><\/td><\/tr><tr><td>EIOPA opinion on AI governance, 6 August 2025<\/td><td>Applies existing insurance rules to AI that is not high-risk under the AI Act, without adding new requirements.<\/td><td><a href=\"https:\/\/www.eiopa.europa.eu\/eiopa-publishes-opinion-ai-governance-and-risk-management-2025-08-06_en\" target=\"_blank\" rel=\"nofollow noopener\">EIOPA opinion<\/a><\/td><\/tr><tr><td>FINMA Guidance 08\/2024, 18 December 2024<\/td><td>Swiss supervisory expectations on AI governance and risk, including third-party dependencies.<\/td><td><a href=\"https:\/\/www.finma.ch\/en\/news\/2024\/12\/20241218-mm-finma-am-08-24\/\" target=\"_blank\" rel=\"nofollow noopener\">FINMA<\/a><\/td><\/tr><tr><td>GDPR Article 22<\/td><td>People have the right not to be subject to solely automated decisions with legal or similarly significant effects, with limited exceptions and safeguards such as human review.<\/td><td><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj\/eng\" target=\"_blank\" rel=\"nofollow noopener\">GDPR, EUR-Lex<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The AI Act also eases the load for financial institutions in one respect: deployers that are financial institutions can meet some monitoring and logging duties through their existing governance and documentation under financial services law (<a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-26\" target=\"_blank\" rel=\"nofollow noopener\">Article 26<\/a>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a sustainability data provider, the DORA point is the most immediate. When a bank uses software to <a href=\"https:\/\/generationimpact.global\/blog\/sustainable-banking-esg-data\/\">collect clients&#8217; ESG data<\/a> under the EBA guidelines on the management of ESG risks, that software sits inside the bank&#8217;s ICT third-party risk framework, AI features included. See also our pages on <a href=\"https:\/\/generationimpact.global\/solutions\/esg-investment-finance\/\">ESG for investment and finance<\/a> and <a href=\"https:\/\/generationimpact.global\/hub\/stress-testing\/\">stress testing<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Standards that make governance practical<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Laws say what must be achieved. Standards and frameworks show how. Four are worth knowing.<\/p>\n\n\n\n<figure class=\"wp-block-table table-responsive\"><table><thead><tr><th>Standard<\/th><th>What it is<\/th><th>Use it for<\/th><\/tr><\/thead><tbody><tr><td><a href=\"https:\/\/webstore.iec.ch\/publication\/90574\" target=\"_blank\" rel=\"nofollow noopener\">ISO\/IEC 42001:2023<\/a><\/td><td>A certifiable management system for AI, published December 2023<\/td><td>Running AI governance as a repeatable process, in the same way ISO\/IEC 27001 does for information security<\/td><\/tr><tr><td><a href=\"https:\/\/www.iso.org\/standard\/77304.html\" target=\"_blank\" rel=\"nofollow noopener\">ISO\/IEC 23894:2023<\/a><\/td><td>Guidance on AI risk management<\/td><td>Identifying and treating AI-specific risks<\/td><\/tr><tr><td><a href=\"https:\/\/www.nist.gov\/itl\/ai-risk-management-framework\" target=\"_blank\" rel=\"nofollow noopener\">NIST AI Risk Management Framework<\/a><\/td><td>A voluntary US framework built on four functions: Govern, Map, Measure, Manage, with a profile for generative AI<\/td><td>A practical structure for risk work, recognised internationally<\/td><\/tr><tr><td><a href=\"https:\/\/genai.owasp.org\/resource\/owasp-genai-llm-top-10-2026\/\" target=\"_blank\" rel=\"nofollow noopener\">OWASP Top 10 for LLM Applications 2026<\/a><\/td><td>The open security community&#8217;s list of the main risks in AI applications<\/td><td>Security testing; it includes prompt injection, sensitive data disclosure, excessive agency and misinformation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">OWASP has also published a <a href=\"https:\/\/genai.owasp.org\/resource\/owasp-top-10-for-agentic-applications-for-2026\/\" target=\"_blank\" rel=\"nofollow noopener\">Top 10 for Agentic Applications<\/a>, covering hijacking of agent behaviour, misuse of tools and abuse of identity or privileges.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For a company already certified to ISO\/IEC 27001, ISO\/IEC 42001 is a natural next step: the structure is familiar and much of the evidence overlaps.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ethics, governance and security: the three pillars<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Read side by side, the AI Act, the Council of Europe Convention, the OECD and UNESCO principles, and the guidance from AI developers point to the same three pillars. Together they cover most of what the rules ask for.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Ethics: what the AI should and should not do<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Human oversight.<\/strong> People stay responsible for decisions, and can review, correct or overrule the AI.<\/li>\n\n\n\n<li><strong>Fairness.<\/strong> The AI should not produce discriminatory outcomes. Where it affects people, test for bias.<\/li>\n\n\n\n<li><strong>Transparency.<\/strong> People should know when AI is involved, what it does and what its limits are.<\/li>\n\n\n\n<li><strong>Proportionality.<\/strong> Use AI where it adds value, and avoid uses whose risks outweigh the benefit.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance: who is accountable, and how<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Ownership.<\/strong> Every AI system has a named owner.<\/li>\n\n\n\n<li><strong>Inventory and classification.<\/strong> You know what you use, why, and under which rules.<\/li>\n\n\n\n<li><strong>Policy and training.<\/strong> Staff know what is allowed and how to check output.<\/li>\n\n\n\n<li><strong>Records.<\/strong> Decisions, assessments and changes are documented so they can be shown to auditors and supervisors.<\/li>\n\n\n\n<li><strong>Supplier management.<\/strong> Contracts cover data use, model training, retention and audit rights.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security: keeping the system and data safe<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Data protection.<\/strong> Only necessary data goes to AI services, under agreements that restrict its use.<\/li>\n\n\n\n<li><strong>Least privilege.<\/strong> AI features get the minimum access their task requires.<\/li>\n\n\n\n<li><strong>Attack testing.<\/strong> Defences against prompt injection and other AI-specific attacks are tested and retested.<\/li>\n\n\n\n<li><strong>Logging and monitoring.<\/strong> AI use is logged so problems can be found and investigated.<\/li>\n\n\n\n<li><strong>Certification.<\/strong> Independent audits, such as ISO\/IEC 27001, confirm controls work in practice.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These pillars are not separate projects. A single control, such as recording who approved each AI-assisted figure, serves all three: it supports oversight, provides accountability and creates an audit trail.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Generation Impact Global applies the AI Act<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We are a Swiss company, and many of our clients are in the EU, so the AI Act applies to the AI features we offer. Everything about how we apply it is set out in one place: our <a href=\"https:\/\/generationimpact.global\/legal\/ai-transparency-notice\/\">AI Transparency Notice<\/a>, published under Article 50. It explains which features use AI, how they work, how we have classified them under the AI Act, and what we expect from users.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our AI features are there to support professional work, with people reviewing the output before it is used. <a href=\"https:\/\/generationimpact.global\/products\/vitai\/\">VitAI\u2122<\/a>, the AI layer of our platform, shows its mapping proposals for review and keeps an audit log of decisions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Related pages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/generationimpact.global\/security\/\">Security<\/a> and <a href=\"https:\/\/generationimpact.global\/licences-and-certifications\/\">Licences and certifications<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/legal\/\">Legal documents<\/a>, including our privacy policy and data processing agreement<\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/solutions\/esg-compliance-governance\/\">Compliance and governance<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/platform\/data-management\/\">Data management<\/a><\/li>\n\n\n\n<li>Our companion article, <a href=\"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/\">AI agents explained<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\r\n\t\t<div  class=\"block-e86c3281-8562-4842-b977-c8075b3733ae areoi-element section-faq\">\r\n\t\t\t\r\n\t\t\t\n\r\n\t\t<div  class=\"block-039bdb20-8d74-4087-8878-c461aafcc867 row areoi-element m-row-gap-20\">\r\n\t\t\t\r\n\r\n\t\t\t\n\r\n\t\t<div  class=\"block-09d561e7-0e62-4c86-980d-62db09ac132c col areoi-element col-12 d-flex flex-column gap-20\">\r\n\t\t\t\r\n\t\t\t\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Does the EU AI Act apply to companies outside the EU?<\/summary>\n<p class=\"wp-block-paragraph\">Yes, when they place AI systems on the EU market or when the output of their AI system is used in the EU (Article 2).<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Was the AI Act delayed?<\/summary>\n<p class=\"wp-block-paragraph\">Only in part. The Digital Omnibus, Regulation (EU) 2026\/1744, in force since 27 July 2026, moved high-risk obligations to 2 December 2027 for standalone systems and 2 August 2028 for systems embedded in regulated products. Bans, AI literacy, general-purpose AI rules and transparency rules were not delayed, apart from a transition to 2 December 2026 for machine-readable marking on generative systems already on the market.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What is AI literacy under the AI Act?<\/summary>\n<p class=\"wp-block-paragraph\">Providers and deployers must take measures to support the AI literacy of their staff and others using AI on their behalf. It has applied since 2 February 2025. The Omnibus confirmed that no specific level is required for each person, but training on what tools do, their limits and how to check their output is the practical way to meet it.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Is ESG or sustainability reporting software high-risk under the AI Act?<\/summary>\n<p class=\"wp-block-paragraph\">Not by default. Sustainability reporting is not listed in Annex III. It could become high-risk only if used for a listed purpose, such as credit scoring of individuals. Each use needs its own assessment.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Do I have to label AI-generated content?<\/summary>\n<p class=\"wp-block-paragraph\">Under Article 50, providers of generative AI must mark synthetic content in a machine-readable way, and deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and taken editorial responsibility. Providers of systems already on the market before 2 August 2026 have until 2 December 2026 for the machine-readable marking.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What are the fines?<\/summary>\n<p class=\"wp-block-paragraph\">Up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for most other breaches. For SMEs, the lower amount applies.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Does Switzerland have an AI law?<\/summary>\n<p class=\"wp-block-paragraph\">Not yet. Switzerland signed the Council of Europe AI Convention and plans targeted changes to its law, with a consultation draft expected in early or spring 2027. The Federal Act on Data Protection already applies to AI processing.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Is ISO\/IEC 42001 required?<\/summary>\n<p class=\"wp-block-paragraph\">No. It is voluntary, but it gives a recognised structure for AI governance and can support AI Act compliance.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>How does Generation Impact Global apply the AI Act?<\/summary>\n<p class=\"wp-block-paragraph\">Our approach, including how we have classified our AI features, is set out in our <a href=\"https:\/\/generationimpact.global\/legal\/ai-transparency-notice\/\">AI Transparency Notice<\/a>.<\/p>\n<\/details>\n\n \r\n\t\t\t\r\n\t\t<\/div>\r\n\t\n \r\n\t\t<\/div>\r\n\t\n\r\n\t\t\t \r\n\t\t<\/div>\r\n\t\n\n\n<h2 class=\"wp-block-heading\">Further reading on our site<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/generationimpact.global\/blog\/ai-agents-explained\/\">AI agents explained: how agentic AI works and why most organisations should not build it alone<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/legal\/ai-transparency-notice\/\">AI Transparency Notice<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/products\/vitai\/\">VitAI\u2122<\/a><\/li>\n\n\n\n<li>Guides: <a href=\"https:\/\/generationimpact.global\/products\/csrd\/\">CSRD hub<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/sfdr\/overview\/\">SFDR hub<\/a>, <a href=\"https:\/\/generationimpact.global\/hub\/taxonomy-compass-about\/\">EU Taxonomy<\/a>, <a href=\"https:\/\/generationimpact.global\/solutions\/circular-economy\/espr\/\">ESPR<\/a><\/li>\n\n\n\n<li>Frameworks: <a href=\"https:\/\/generationimpact.global\/products\/esrs\/\">ESRS<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/gri\/\">GRI<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/sfdr\/\">SFDR<\/a>, <a href=\"https:\/\/generationimpact.global\/products\/vsme\/\">VSME<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/blog\/sustainable-banking-esg-data\/\">The EBA ESG rules are live: banks now need ESG data from their clients<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/security\/\">Security<\/a> and <a href=\"https:\/\/generationimpact.global\/licences-and-certifications\/\">Licences and certifications<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/generationimpact.global\/news\/\">News on policy and regulation<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<p class=\"gig-sources wp-block-paragraph\"><strong>European Union<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list gig-sources\">\n<li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj\/eng\" target=\"_blank\" rel=\"nofollow noopener\">Regulation (EU) 2024\/1689, the AI Act<\/a>, EUR-Lex<\/li>\n\n\n\n<li><a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2026\/1744\/oj\/eng\" target=\"_blank\" rel=\"nofollow noopener\">Regulation (EU) 2026\/1744, the Digital Omnibus on AI<\/a>, EUR-Lex<\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-2\" target=\"_blank\" rel=\"nofollow noopener\">AI Act Service Desk<\/a>, consolidated text as at 27 July 2026, including Articles <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-4\" target=\"_blank\" rel=\"nofollow noopener\">4<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-5\" target=\"_blank\" rel=\"nofollow noopener\">5<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-6\" target=\"_blank\" rel=\"nofollow noopener\">6<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-26\" target=\"_blank\" rel=\"nofollow noopener\">26<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-50\" target=\"_blank\" rel=\"nofollow noopener\">50<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-53\" target=\"_blank\" rel=\"nofollow noopener\">53<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-99\" target=\"_blank\" rel=\"nofollow noopener\">99<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-111\" target=\"_blank\" rel=\"nofollow noopener\">111<\/a>, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-113\" target=\"_blank\" rel=\"nofollow noopener\">113<\/a> and <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/annex-3\" target=\"_blank\" rel=\"nofollow noopener\">Annex III<\/a><\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/timeline\/timeline-implementation-eu-ai-act\" target=\"_blank\" rel=\"nofollow noopener\">Timeline for the implementation of the AI Act<\/a><\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/ai-act-governance-and-enforcement\" target=\"_blank\" rel=\"nofollow noopener\">AI Act governance and enforcement<\/a><\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/gpai-code-practice\" target=\"_blank\" rel=\"nofollow noopener\">General-Purpose AI Code of Practice<\/a>, 10 July 2025<\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-publishes-code-practice-marking-and-labelling-ai-generated-content\" target=\"_blank\" rel=\"nofollow noopener\">Code of practice on marking and labelling AI-generated content<\/a>, 10 June 2026<\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/news\/commission-publishes-guidelines-transparency-obligations-providers-and-deployers-certain-ai-systems\" target=\"_blank\" rel=\"nofollow noopener\">Guidelines on the transparency obligations for providers and deployers of certain AI systems<\/a>, 20 July 2026<\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/library\/draft-commission-guidelines-classification-high-risk-ai-systems\" target=\"_blank\" rel=\"nofollow noopener\">Draft guidelines on the classification of high-risk AI systems<\/a>, May 2026<\/li>\n<\/ul>\n\n\n\n<p class=\"gig-sources wp-block-paragraph\"><strong>Finance supervisors<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list gig-sources\">\n<li>EIOPA, <a href=\"https:\/\/www.eiopa.europa.eu\/digital-operational-resilience-act-dora_en\" target=\"_blank\" rel=\"nofollow noopener\">Digital Operational Resilience Act (DORA)<\/a><\/li>\n\n\n\n<li>ESMA, <a href=\"https:\/\/www.esma.europa.eu\/sites\/default\/files\/2024-05\/ESMA35-335435667-5924__Public_Statement_on_AI_and_investment_services.pdf\" target=\"_blank\" rel=\"nofollow noopener\">Public statement on AI and investment services<\/a>, 30 May 2024<\/li>\n\n\n\n<li>EBA, <a href=\"https:\/\/www.eba.europa.eu\/sites\/default\/files\/2025-11\/d8b999ce-a1d9-4964-9606-971bbc2aaf89\/AI%20Act%20implications%20for%20the%20EU%20banking%20sector.pdf\" target=\"_blank\" rel=\"nofollow noopener\">AI Act implications for the EU banking sector<\/a>, 21 November 2025<\/li>\n\n\n\n<li>EIOPA, <a href=\"https:\/\/www.eiopa.europa.eu\/eiopa-publishes-opinion-ai-governance-and-risk-management-2025-08-06_en\" target=\"_blank\" rel=\"nofollow noopener\">Opinion on AI governance and risk management<\/a>, 6 August 2025<\/li>\n\n\n\n<li>FINMA, <a href=\"https:\/\/www.finma.ch\/en\/news\/2024\/12\/20241218-mm-finma-am-08-24\/\" target=\"_blank\" rel=\"nofollow noopener\">Guidance 08\/2024 on AI governance and risk management<\/a>, 18 December 2024<\/li>\n\n\n\n<li>Regulation (EU) 2016\/679, <a href=\"https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj\/eng\" target=\"_blank\" rel=\"nofollow noopener\">General Data Protection Regulation<\/a>, Article 22, EUR-Lex<\/li>\n<\/ul>\n\n\n\n<p class=\"gig-sources wp-block-paragraph\"><strong>Switzerland and the Council of Europe<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list gig-sources\">\n<li>Federal Council, <a href=\"https:\/\/www.admin.ch\/en\/nsb?id=104110\" target=\"_blank\" rel=\"nofollow noopener\">decision on the approach to AI regulation<\/a>, 12 February 2025<\/li>\n\n\n\n<li>Federal Office of Justice, <a href=\"https:\/\/www.bj.admin.ch\/de\/kuenstliche-intelligenz\" target=\"_blank\" rel=\"nofollow noopener\">K\u00fcnstliche Intelligenz<\/a><\/li>\n\n\n\n<li>SME Portal, <a href=\"https:\/\/www.kmu.admin.ch\/de\/bis-anfang-2027-soll-ein-vorentwurf-zur-ki-regulierung-ausgearbeitet-werden\" target=\"_blank\" rel=\"nofollow noopener\">Draft AI regulation expected by early 2027<\/a>, September 2026<\/li>\n\n\n\n<li>FDPIC, <a href=\"https:\/\/www.edoeb.admin.ch\/en\/update-current-legislation-directly-applicable-ai\" target=\"_blank\" rel=\"nofollow noopener\">Current data protection law is directly applicable to AI<\/a><\/li>\n\n\n\n<li>Council of Europe, <a href=\"https:\/\/www.coe.int\/en\/web\/artificial-intelligence\/-\/switzerland-signs-the-council-of-europe-s-global-treaty-on-ai\" target=\"_blank\" rel=\"nofollow noopener\">Switzerland signs the global treaty on AI<\/a>, 27 March 2025<\/li>\n\n\n\n<li>Council of Europe, <a href=\"https:\/\/www.coe.int\/en\/web\/artificial-intelligence\/-\/european-union-ratifies-the-council-of-europe-framework-convention-on-artificial-intelligence\" target=\"_blank\" rel=\"nofollow noopener\">EU ratifies the Framework Convention on AI<\/a>, May 2026<\/li>\n<\/ul>\n\n\n\n<p class=\"gig-sources wp-block-paragraph\"><strong>International<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list gig-sources\">\n<li>OECD, <a href=\"https:\/\/legalinstruments.oecd.org\/public\/doc\/648\/648.en.pdf\" target=\"_blank\" rel=\"nofollow noopener\">Recommendation of the Council on Artificial Intelligence<\/a>, as amended May 2024<\/li>\n\n\n\n<li>UNESCO, <a href=\"https:\/\/www.unesco.org\/en\/artificial-intelligence\/recommendation-ethics\" target=\"_blank\" rel=\"nofollow noopener\">Recommendation on the Ethics of Artificial Intelligence<\/a><\/li>\n\n\n\n<li>European Commission, <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/library\/hiroshima-process-international-code-conduct-advanced-ai-systems\" target=\"_blank\" rel=\"nofollow noopener\">Hiroshima Process International Code of Conduct for Advanced AI Systems<\/a>, 30 October 2023<\/li>\n\n\n\n<li>United Nations, <a href=\"https:\/\/www.un.org\/global-dialogue-ai-governance\/en\/faq\" target=\"_blank\" rel=\"nofollow noopener\">Global Dialogue on AI Governance<\/a> and <a href=\"https:\/\/www.un.org\/independent-international-scientific-panel-ai\/en\/faq\" target=\"_blank\" rel=\"nofollow noopener\">Independent International Scientific Panel on AI<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"gig-sources wp-block-paragraph\"><strong>Other jurisdictions<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list gig-sources\">\n<li>UK Government, <a href=\"https:\/\/www.gov.uk\/government\/consultations\/ai-regulation-a-pro-innovation-approach-policy-proposals\/outcome\/a-pro-innovation-approach-to-ai-regulation-government-response\" target=\"_blank\" rel=\"nofollow noopener\">A pro-innovation approach to AI regulation: government response<\/a>, 6 February 2024<\/li>\n\n\n\n<li>The White House, <a href=\"https:\/\/www.whitehouse.gov\/presidential-actions\/2025\/01\/removing-barriers-to-american-leadership-in-artificial-intelligence\/\" target=\"_blank\" rel=\"nofollow noopener\">Removing Barriers to American Leadership in Artificial Intelligence<\/a>, January 2025<\/li>\n\n\n\n<li>The White House, <a href=\"https:\/\/www.whitehouse.gov\/presidential-actions\/2025\/12\/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy\/\" target=\"_blank\" rel=\"nofollow noopener\">Executive order on a national AI policy framework<\/a>, December 2025<\/li>\n\n\n\n<li>Cyberspace Administration of China, <a href=\"https:\/\/www.cac.gov.cn\/2023-07\/13\/c_1690898327029107.htm\" target=\"_blank\" rel=\"nofollow noopener\">Interim Measures for Generative AI Services<\/a>, 2023, and <a href=\"https:\/\/www.cac.gov.cn\/2025-03\/14\/c_1743654684782215.htm\" target=\"_blank\" rel=\"nofollow noopener\">Measures for Labelling AI-Generated Content<\/a>, 2025<\/li>\n\n\n\n<li>US International Trade Administration, <a href=\"https:\/\/www.trade.gov\/market-intelligence\/south-korea-ai-basic-act\" target=\"_blank\" rel=\"nofollow noopener\">South Korea AI Basic Act<\/a><\/li>\n\n\n\n<li>Japanese Law Translation, <a href=\"https:\/\/www.japaneselawtranslation.go.jp\/en\/laws\/view\/5066\" target=\"_blank\" rel=\"nofollow noopener\">Act on the Promotion of AI-related Technology<\/a><\/li>\n\n\n\n<li>Brazilian Chamber of Deputies, <a href=\"https:\/\/www.camara.leg.br\/proposicoesWeb\/fichadetramitacao?idProposicao=2487262\" target=\"_blank\" rel=\"nofollow noopener\">PL 2338\/2023<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"gig-sources wp-block-paragraph\"><strong>Standards<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list gig-sources\">\n<li><a href=\"https:\/\/webstore.iec.ch\/publication\/90574\" target=\"_blank\" rel=\"nofollow noopener\">ISO\/IEC 42001:2023<\/a>, AI management systems<\/li>\n\n\n\n<li><a href=\"https:\/\/www.iso.org\/standard\/77304.html\" target=\"_blank\" rel=\"nofollow noopener\">ISO\/IEC 23894:2023<\/a>, AI risk management<\/li>\n\n\n\n<li>NIST, <a href=\"https:\/\/www.nist.gov\/itl\/ai-risk-management-framework\" target=\"_blank\" rel=\"nofollow noopener\">AI Risk Management Framework<\/a><\/li>\n\n\n\n<li>OWASP, <a href=\"https:\/\/genai.owasp.org\/resource\/owasp-genai-llm-top-10-2026\/\" target=\"_blank\" rel=\"nofollow noopener\">Top 10 for LLM Applications 2026<\/a>, August 2026, and <a href=\"https:\/\/genai.owasp.org\/resource\/owasp-top-10-for-agentic-applications-for-2026\/\" target=\"_blank\" rel=\"nofollow noopener\">Top 10 for Agentic Applications<\/a>, December 2025<\/li>\n<\/ul>\n\n\n\n<p class=\"gig-sources wp-block-paragraph\"><strong>Generation Impact Global<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list gig-sources\">\n<li><a href=\"https:\/\/generationimpact.global\/legal\/ai-transparency-notice\/\">AI Transparency Notice<\/a>, last updated 2 September 2026<\/li>\n<\/ul>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Does the EU AI Act apply to companies outside the EU?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes, when they place AI systems on the EU market or when the output of their AI system is used in the EU (Article 2).\"}}, {\"@type\": \"Question\", \"name\": \"Was the AI Act delayed?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Only in part. The Digital Omnibus, Regulation (EU) 2026\/1744, in force since 27 July 2026, moved high-risk obligations to 2 December 2027 for standalone systems and 2 August 2028 for systems embedded in regulated products. Bans, AI literacy, general-purpose AI rules and transparency rules were not delayed, apart from a transition to 2 December 2026 for machine-readable marking on generative systems already on the market.\"}}, {\"@type\": \"Question\", \"name\": \"What is AI literacy under the AI Act?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Providers and deployers must take measures to support the AI literacy of their staff and others using AI on their behalf. It has applied since 2 February 2025. The Omnibus confirmed that no specific level is required for each person, but training on what tools do, their limits and how to check their output is the practical way to meet it.\"}}, {\"@type\": \"Question\", \"name\": \"Is ESG or sustainability reporting software high-risk under the AI Act?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Not by default. Sustainability reporting is not listed in Annex III. It could become high-risk only if used for a listed purpose, such as credit scoring of individuals. Each use needs its own assessment.\"}}, {\"@type\": \"Question\", \"name\": \"Do I have to label AI-generated content?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Under Article 50, providers of generative AI must mark synthetic content in a machine-readable way, and deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and taken editorial responsibility. Providers of systems already on the market before 2 August 2026 have until 2 December 2026 for the machine-readable marking.\"}}, {\"@type\": \"Question\", \"name\": \"What are the fines?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for most other breaches. For SMEs, the lower amount applies.\"}}, {\"@type\": \"Question\", \"name\": \"Does Switzerland have an AI law?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Not yet. Switzerland signed the Council of Europe AI Convention and plans targeted changes to its law, with a consultation draft expected in early or spring 2027. The Federal Act on Data Protection already applies to AI processing.\"}}, {\"@type\": \"Question\", \"name\": \"Is ISO\/IEC 42001 required?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. It is voluntary, but it gives a recognised structure for AI governance and can support AI Act compliance.\"}}, {\"@type\": \"Question\", \"name\": \"How does Generation Impact Global apply the AI Act?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Our approach, including how we have classified our AI features, is set out in our AI Transparency Notice.\"}}]}<\/script>\n\n\r\n\t\t\t \r\n\t\t<\/div>\r\n\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":2,"featured_media":28234,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","css_class_manager_body_classes":"","css_class_manager_use_in_post_loop":false},"categories":[1549],"tags":[],"class_list":["post-28179","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>EU AI Act 2026: dates, rules and global AI law | GIG<\/title>\n<meta name=\"description\" content=\"What the EU AI Act requires in 2026, what the Digital Omnibus delayed, how other countries regulate AI, and a practical checklist for organisations.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"EU AI Act 2026: dates, rules and global AI law | GIG\" \/>\n<meta property=\"og:description\" content=\"What the EU AI Act requires in 2026, what the Digital Omnibus delayed, how other countries regulate AI, and a practical checklist for organisations.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"Generation Impact Global\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-10T11:36:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/generationimpact.global\/wp-content\/uploads\/gig_regulation_header-3d_2064x512_v01.webp?wsr\" \/>\n\t<meta property=\"og:image:width\" content=\"2064\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Generation Impact Global SA\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@GenImpactGlobal\" \/>\n<meta name=\"twitter:site\" content=\"@GenImpactGlobal\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/\"},\"author\":{\"@type\":\"Organization\",\"name\":\"Generation Impact Global SA\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/about\"},\"headline\":\"AI regulation in 2026: the EU AI Act, global rules, and how Generation Impact Global applies them\",\"datePublished\":\"2026-11-10T11:36:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/\"},\"wordCount\":4731,\"publisher\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/gig_regulation_header-3d_2064x512_v01.webp?wsr\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/\",\"name\":\"EU AI Act 2026: dates, rules and global AI law | GIG\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/gig_regulation_header-3d_2064x512_v01.webp?wsr\",\"datePublished\":\"2026-11-10T11:36:50+00:00\",\"description\":\"What the EU AI Act requires in 2026, what the Digital Omnibus delayed, how other countries regulate AI, and a practical checklist for organisations.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/#primaryimage\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/gig_regulation_header-3d_2064x512_v01.webp?wsr\",\"contentUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/gig_regulation_header-3d_2064x512_v01.webp?wsr\",\"width\":2064,\"height\":512,\"caption\":\"3D illustration of AI systems sorted into four risk lanes under the EU AI Act, with a prohibited system stopped at a barrier\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/ai-regulation-2026\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"AI regulation in 2026: the EU AI Act, global rules, and how Generation Impact Global applies them\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#website\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/\",\"name\":\"Generation Impact Global\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#organization\",\"name\":\"Generation Impact Global SA\",\"alternateName\":\"GIG\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/2_GIG_Logo_emblem.svg\",\"contentUrl\":\"https:\\\/\\\/generationimpact.global\\\/wp-content\\\/uploads\\\/2_GIG_Logo_emblem.svg\",\"width\":72,\"height\":72,\"caption\":\"Generation Impact Global SA\"},\"image\":{\"@id\":\"https:\\\/\\\/generationimpact.global\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/GenImpactGlobal\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/generation-impact-global\\\/\",\"https:\\\/\\\/wa.me\\\/41782224582\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"EU AI Act 2026: dates, rules and global AI law | GIG","description":"What the EU AI Act requires in 2026, what the Digital Omnibus delayed, how other countries regulate AI, and a practical checklist for organisations.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/","og_locale":"it_IT","og_type":"article","og_title":"EU AI Act 2026: dates, rules and global AI law | GIG","og_description":"What the EU AI Act requires in 2026, what the Digital Omnibus delayed, how other countries regulate AI, and a practical checklist for organisations.","og_url":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/","og_site_name":"Generation Impact Global","article_published_time":"2026-11-10T11:36:50+00:00","og_image":[{"width":2064,"height":512,"url":"https:\/\/generationimpact.global\/wp-content\/uploads\/gig_regulation_header-3d_2064x512_v01.webp?wsr","type":"image\/webp"}],"author":"Generation Impact Global SA","twitter_card":"summary_large_image","twitter_creator":"@GenImpactGlobal","twitter_site":"@GenImpactGlobal","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/#article","isPartOf":{"@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/"},"author":{"@type":"Organization","name":"Generation Impact Global SA","url":"https:\/\/generationimpact.global\/about"},"headline":"AI regulation in 2026: the EU AI Act, global rules, and how Generation Impact Global applies them","datePublished":"2026-11-10T11:36:50+00:00","mainEntityOfPage":{"@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/"},"wordCount":4731,"publisher":{"@id":"https:\/\/generationimpact.global\/it\/#organization"},"image":{"@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/gig_regulation_header-3d_2064x512_v01.webp?wsr","articleSection":["Blog"],"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/","url":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/","name":"EU AI Act 2026: dates, rules and global AI law | GIG","isPartOf":{"@id":"https:\/\/generationimpact.global\/it\/#website"},"primaryImageOfPage":{"@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/#primaryimage"},"image":{"@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/gig_regulation_header-3d_2064x512_v01.webp?wsr","datePublished":"2026-11-10T11:36:50+00:00","description":"What the EU AI Act requires in 2026, what the Digital Omnibus delayed, how other countries regulate AI, and a practical checklist for organisations.","breadcrumb":{"@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/#primaryimage","url":"https:\/\/generationimpact.global\/wp-content\/uploads\/gig_regulation_header-3d_2064x512_v01.webp?wsr","contentUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/gig_regulation_header-3d_2064x512_v01.webp?wsr","width":2064,"height":512,"caption":"3D illustration of AI systems sorted into four risk lanes under the EU AI Act, with a prohibited system stopped at a barrier"},{"@type":"BreadcrumbList","@id":"https:\/\/generationimpact.global\/it\/blog\/ai-regulation-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/generationimpact.global\/it\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/generationimpact.global\/it\/blog\/"},{"@type":"ListItem","position":3,"name":"AI regulation in 2026: the EU AI Act, global rules, and how Generation Impact Global applies them"}]},{"@type":"WebSite","@id":"https:\/\/generationimpact.global\/it\/#website","url":"https:\/\/generationimpact.global\/it\/","name":"Generation Impact Global","description":"","publisher":{"@id":"https:\/\/generationimpact.global\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/generationimpact.global\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/generationimpact.global\/it\/#organization","name":"Generation Impact Global SA","alternateName":"GIG","url":"https:\/\/generationimpact.global\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/generationimpact.global\/it\/#\/schema\/logo\/image\/","url":"https:\/\/generationimpact.global\/wp-content\/uploads\/2_GIG_Logo_emblem.svg","contentUrl":"https:\/\/generationimpact.global\/wp-content\/uploads\/2_GIG_Logo_emblem.svg","width":72,"height":72,"caption":"Generation Impact Global SA"},"image":{"@id":"https:\/\/generationimpact.global\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/GenImpactGlobal","https:\/\/www.linkedin.com\/company\/generation-impact-global\/","https:\/\/wa.me\/41782224582"]}]}},"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts\/28179","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/comments?post=28179"}],"version-history":[{"count":9,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts\/28179\/revisions"}],"predecessor-version":[{"id":28232,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/posts\/28179\/revisions\/28232"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/media\/28234"}],"wp:attachment":[{"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/media?parent=28179"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/categories?post=28179"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/generationimpact.global\/it\/wp-json\/wp\/v2\/tags?post=28179"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}