Application of most AI Act provisions starts on 2 August 2026. Is your company ready?

Yes. As a “deployer” you have obligations: ensuring employees' AI literacy (Article 4), overseeing how AI is used and — depending on the use case — further requirements. The key is establishing what AI is really used for in your company, including “shadow AI”.

Maximum fines reach EUR 35M or 7% of global annual turnover (prohibited practices) and EUR 15M or 3% (other violations). Beyond fines, the practical risk is disputes with business partners, who increasingly require compliance in contracts.

With an inventory: what uses AI, where and why — including tools employees adopted on their own. Then risk classification and a gap-closing plan. That is exactly the scope of our audit.

AI tools used by employees outside the company's knowledge and control — private ChatGPT accounts, plugins, automations. The risks: leakage of company and customer data, and harder AI Act or GDPR compliance, especially where personal data or high-risk AI are involved. A shadow-AI inventory is the first week of our audit.

Typically 2–4 weeks, depending on the number of systems and the size of the organisation. It ends with a report containing risk classification and an action plan — a working document, not a decorative one.

Any company in the EU that develops or uses AI systems in a professional context — in practice almost every company using tools like ChatGPT, Copilot or a custom model. You are a “deployer” even when you only use off-the-shelf AI, and deployers have their own obligations. An audit is most urgent where AI touches personal data, regulated decisions or high-risk use cases.

An inventory of the AI systems in use (including shadow AI), each system’s deployer/provider classification and risk category, evidence of AI literacy measures for staff (Article 4), human-oversight and AI usage policies, and — for systems whose obligations apply by then — the technical documentation those obligations require. A compliance audit maps exactly what each system needs and where the gaps are, with a plan to close them.

GPAI (general-purpose AI) models — large models like GPT or Gemini — carry AI Act obligations such as technical documentation, a copyright policy and a training-data summary. These apply from 2 August 2025 and, as a rule, fall on the model provider (e.g. OpenAI, Google), not on a company that merely uses the model. Your company can itself become a GPAI provider if it fine-tunes or substantially modifies such a model and places it on the market under its own name. Models with systemic risk carry extra obligations (evaluations, testing, incident reporting). The audit determines whether you are only a deployer or cross the GPAI-provider threshold.

The act on artificial intelligence systems was signed by the President on 27 July 2026 and awaits publication in the Journal of Laws and entry into force, so as of this update it is not yet binding law. It provides for a national supervisory authority — the Commission for the Development and Security of Artificial Intelligence (KRiBSI), made up of representatives of UOKiK, KNF, KRRiT and UKE — which will oversee AI use, handle complaints and supervise high-risk systems. Regardless of the national act, the AI Act's own obligations start applying in stages, most from 2 August 2026.

In four weeks you can build the readiness foundation: a register of the AI systems you use (including shadow AI), a role and risk classification, the scope of AI literacy (Art. 4) and human oversight (Art. 14), and a prioritised gap-closing backlog. It is not a guarantee of full compliance — the gaps themselves are then closed through implementation and documentation, and some obligations only start applying on 2 August 2026. The 30-day plan does give you a clear picture of where you stand and what to do next.