AI Act in Force: New Obligations If Your Application Uses AI

As of August 2, 2026, most of the EU AI Act has come into force. If you have a chatbot in your app or web platform, generate images or text, recommend products, perform facial analysis, score users, or call any AI model in the background — and you have a user in the European Union — you now have legal obligations that didn’t exist in July.

This article is not a summary of the law. It is a practical guide written by engineers who build these features, for entrepreneurs, product owners, and companies that use AI in their software. It tells you what is currently binding you, what is postponed, what the fines look like, and what you really need to change in your product.

This article is for general information only and does not constitute legal advice. Consult a lawyer who is versed in EU technology regulation for your specific situation.

Does it matter to me if my company isn’t in the EU?

If you have a user in the EU, the answer is almost certainly yes. The AI Act follows the GDPR/KVKK model: if the output of an AI system is used in the EU, the system also applies to companies located outside the EU. A Turkish, American, or Gulf‑based company whose software can be downloaded in Germany falls within the scope. It is the location of your users, not the address of your legal entity, that determines applicability.

What “AI system” means — broader than you think

The law counts any machine‑based system that produces an output—prediction, content, recommendation, or decision—based on its inputs as an AI system. In practice, the following are covered:

• Chatbots and AI assistants (including those built on OpenAI, Anthropic, Google, or open‑source models)
• Image, video, audio, or text generation capabilities
• Recommendation engines (“you might also like”)
• Facial analysis, skin analysis, body‑type detection
• Fraud scoring, credit scoring, risk scoring
• CV filtering and candidate ranking
• Voice assistants and transcription
• Any characteristic of the output that is determined by a model rather than a rule you wrote

If you send a prompt to an LLM API and show the result to a user, you are operating an AI system.

What is currently in force (September 2026)

Since February 2025: prohibited practices and AI literacy

Some uses are outright banned, and the highest penalties in the law apply to them. The most relevant for commercial applications are:

• Manipulative or deceptive techniques that distort user behavior to cause harm
• Exploiting vulnerabilities of specific groups (age, disability, economic status)
• Social scoring of individuals
• Emotion recognition in workplaces and schools
• Deriving race, political opinion, religion, or sexual orientation from biometric data
• Mass collection of faces from the internet or cameras to build facial‑recognition databases

In addition, every company that provides or uses an AI system must ensure that its employees have sufficient AI literacy. This is an obligation on you as the employer, not on the product.

Since August 2025: rules for general‑purpose model providers

These rules bind the companies that train large models (OpenAI, Google, Meta, Mistral, etc.), not the downstream developers. If you fine‑tune an existing model for your product, you are usually still not considered a GPAI provider—but you could be if you go far enough.

Since August 2, 2026: transparency obligations (Article 50) — the real issue for applications

Four concrete rules, all affecting everyday products:

1. Users must be told they are interacting with AI.
If your app includes a chatbot, assistant, or any feature that directly interacts with people, it must be clear that the counterpart is a machine—unless the context already makes this obvious. A support bot that introduces itself as “Elif from Customer Service” without stating it’s a bot is now a compliance breach.

2. AI‑generated content must be marked in a machine‑readable way.
If your product creates images, video, audio, or text, the output must carry a technical marker—metadata, watermark, or equivalent—that indicates it is synthetic. This obligation belongs to the provider of the generating system. If you built the feature, you must implement the marking; if you call a third‑party API, verify what markers it adds and whether your pipeline preserves them (resizing, re‑encoding, screenshots often strip them).

3. Emotion detection and biometric categorisation must be disclosed.
If your app extracts emotions from facial, voice, or body data, or categorises people, the affected individuals must be informed. Camera‑based analysis in beauty, health, fitness, dating, and retail apps should scrutinise this clause closely.

4. Deepfakes and AI‑written public‑interest texts must be labelled.
Users (deployers) who publish AI‑generated content that resembles real people, places, or events must label it as artificial. AI‑generated texts released for public information must be disclosed unless a human has reviewed them and assumed editorial responsibility.

Deadline for existing products: Systems that were on the market before August 2, 2026 have until December 2, 2026 to comply with the content‑marking rule. New systems must comply from day one.

Postponed items — and why you should still care

The most burdensome part of the law — the full regime for high‑risk AI systems (risk management, data governance, technical documentation, human oversight, conformity assessment) — was delayed with the 2025–2026 “digital omnibus” package. Current dates:

• December 2, 2027: For the high‑risk categories listed in Annex III — recruitment and HR, credit scoring, insurance pricing, education and exam scoring, access to essential services, biometric identification, law enforcement, migration
• August 2, 2028: For AI embedded in products already subject to EU product‑safety legislation (medical devices, vehicles, machinery, toys)

If your product does any of these, the postponement is not a pardon, it’s a breathing room. The documentation required by these obligations — training‑data source, logging, bias testing, human‑intervention design — are things that take months to add to a system later. Teams that start now will spend only a tiny fraction of what those starting in mid‑2027 will have to spend.

Penalties

• For prohibited practices up to €35 million or up to 7 % of global annual turnover
• For most other obligations, including transparency rules, up to €15 million or up to 3 %
• For providing false information to authorities up to €7.5 million or up to 1 %

For SMEs and startups, the lower of the two figures applies. Enforcement will be carried out by national authorities in each Member State; for GPAI models, directly by the EU AI Office.

Provider or user? Why the distinction matters

The law assigns different duties depending on your role:

• Provider: You developed (or had developed) the AI system and released it under your own name. Most obligations fall here.
• User (deployer): You use an AI system in a professional context under your own authority.

A company that adds a chatbot to its own application is generally the provider of that chatbot system, even if the underlying model comes from a third party. A company that uses an off‑the‑shelf HR screening tool is its user. Many businesses are both, depending on the feature. Determining which role you have for each feature is the first step of any compliance review.

Practical checklist for application and platform owners

Do this this month

• Inventory every AI feature in your product. Include third‑party APIs and SDKs — a supplier’s model counts if it makes decisions in your app.
• Decide for each feature: are we the provider or the user?
• Check that every chat feature includes a clear “you are talking to AI” disclosure.
• Compare your product against every prohibited‑application category. Pay special attention to interaction mechanisms aimed at minors and any kind of emotional or biometric inference.
• Ensure your team has documented AI‑literacy training. A short internal session with attendance records is enough to get started.

Do this before December 2, 2026

• Apply machine‑readable labeling (C2PA metadata, provider watermarks or equivalent) to every feature that generates visual, audio, video or text content, and verify that the label survives your storage and delivery pipeline.
• Add visible tags for users wherever deep‑fake or AI‑generated content must be disclosed.
• Update your privacy policy and terms of use to cover AI features, their purposes and the disclosures above.

Plan for 2027

• If any feature falls into an Annex III category (recruitment, credit, education, insurance, essential services, biometrics), start the high‑risk documentation now: data sources, model assessment, logging, human‑oversight design.
• Appoint an internal responsible person for AI compliance. Regulators’ first question is always “who is responsible?”

How this changes the way we build AI features

At UmaySoftware, AI‑Act requirements are now part of the design phase of every project that contains AI, not a downstream check. Concretely:

• Explanation and labeling are designed into the UI from the first wireframe, not slapped on later.
• Generated content is labeled the moment it is created, and the label is tested throughout the delivery pipeline.
• Each AI feature is delivered with a one‑page record: what the model does, what data it sees, who the provider is, which legal obligations apply, how a human can intervene.
• If a customer’s use case borders a high‑risk category, we flag it during discovery, before any budget is set.

If you already have AI features in production and aren’t sure where you stand, we offer an AI‑Act feature review: we inventory your AI components, classify each by role and risk level, and give you a written gap list split into “fix before December” and “plan for 2027.” It’s an engineering review, not a legal opinion — but it’s exactly the document your lawyer will ask for.

Request a review →

Frequently asked questions

My app only calls the OpenAI / Anthropic / Gemini API. Am I the responsible party or are they?
Both, in different ways. The model provider assumes the obligations that apply to a general‑purpose model. You are responsible for the AI system you build with it — including transparency rules, prohibited‑application checks and any high‑risk obligations that apply to your use case.

Is the recommendation engine in an e‑commerce app covered by the AI Act?
A recommendation engine is an AI system, so the general rules (prohibited practices, AI literacy) apply. Standard product recommendations are not high‑risk, and because users don’t interact with them like they do with a chatbot, Article 50 disclosures are not triggered. Recommendations that exploit vulnerabilities — e.g., targeting minors with manipulative patterns — fall into the prohibited‑application area.

Do I need to label every AI‑generated image in my app?
Machine‑readable labeling is mandatory for content produced by your system—from day one for new products and starting December 2, 2026 for existing products. A visible label is required in certain cases for users (deployers)—deepfakes of real people or events and AI‑written texts serving the public interest. For an AI avatar generator, a metadata tag is mandatory; a visible label is a best practice.

We are a Turkish company with no office in the EU. Can they really fine us?
If your output is used in the EU, the law applies to you, and member‑state authorities can act against non‑EU providers—including through app stores and EU‑based distributors. Whether a particular small company will actually be targeted is a risk question, not a legal certainty—but “they can’t find us” is not a lasting strategy under GDPR.

Is a beauty app that analyses skin or facial shape performing “biometric categorisation”?
It depends on what is being extracted. Determining skin tone to suggest foundation is generally not categorisation of protected groups. Inferring ethnicity, health status, or emotions from the face is a different matter and may be restricted or prohibited. The legal outcome hinges on the exact design of the feature.

What if I develop an AI feature and offer it only outside the EU?
Then the law does not apply to that feature—but the geographic restriction must be real (store availability, account‑region checks), not just a clause in the terms of service.