AI Act from 2 August 2026: What Changes for Businesses and Managers
From 2 August 2026, the AI Act enters its most operational phase for businesses, managers, and technology providers. From that date, most rules become applicable and enforcement moves into full swing, with direct impact on high-risk systems, transparency obligations, and organisations’ ability to demonstrate how they govern artificial intelligence.
For companies, it will no longer be enough to declare that a system works. They will need to prove how it works, which data it uses, what risks it creates, which controls oversee it, and what technical documentation accompanies its entire lifecycle.
The end of artificial intelligence without accountability
Over the past two years, management has approached artificial intelligence with a question that was almost exclusively productive: what can it do for the business? Automate customer care, generate content, analyse documents, screen candidates, speed up processes, cut costs, increase efficiency. AI has often been adopted as a performance lever long before it became a matter of governance. Many solutions entered departments through SaaS subscriptions, local pilots, modules embedded in existing software, or team initiatives that moved faster than internal control processes.
From 2 August 2026, the question will no longer be only “what does the system produce”, but “how does it produce it”. The AI Act shifts attention from output to the chain of accountability that makes that output usable in a business context.
From “what can it do” to “how is it doing it”
The AI Act does not open a purely legal season. It would be a mistake to treat it as something to park in the compliance office or with an external consultant called in after the solution is already integrated. The heart of the regulation goes much deeper and concerns how artificial intelligence is designed, updated, and explained.
European law demands a verifiable chain of accountability. For companies, this means AI stops being an experiment left to individual departments’ enthusiasm and becomes sensitive infrastructure that shapes decisions, priorities, opportunities, or access within the organisation — and must be demonstrable in every application.
The AI Act and the four risk levels
The AI Act is built on a risk-based logic: not all AI systems are regulated the same way, because they do not all have the same impact on safety, fundamental rights, and people’s opportunities. What matters is the concrete use a company makes of the system. An informational chatbot, a spam filter, a candidate scoring system, and a biometric identification tool do not carry the same regulatory weight.
The regulation therefore distinguishes four main categories: unacceptable risk, high risk, limited risk, and minimal or negligible risk.
Unacceptable risk
This category covers systems considered incompatible with the values and fundamental rights protected by the European Union. These are not systems subject to stricter requirements: they are prohibited. Examples in the regulation include practices such as social scoring by public or private authorities, certain forms of subliminal manipulation or exploitation of people’s vulnerabilities, specific predictive policing practices, and certain uses of real-time biometric identification in public spaces, except for very narrow legal exceptions.
The principle is clear: when an AI system poses a clear threat to safety, individual freedom, or fundamental rights, the answer is not to make it “more compliant”. It must be ruled out.
High risk
High risk is the most important category for businesses. High-risk systems are not banned, but may only be used if stringent requirements are met. They cover areas where AI can significantly affect people’s lives: education, employment, worker management, access to essential services, credit, insurance, medical devices, critical infrastructure, justice, and some public functions.
High risk can also apply to common business processes. An AI system that filters CVs, assigns scores to candidates, or suggests who to invite for interview may be high risk because it conditions access to work. Here, risk management, data quality, technical documentation, logging, human oversight, accuracy, robustness, and cybersecurity become central.
Limited risk
This category covers systems that do not necessarily affect rights or safety with the same intensity as high-risk systems, but can create opacity or misunderstanding in user interaction. The main obligation here is transparency. People must know when they are interacting with an AI system, when content is artificially generated or manipulated, or when a technology can simulate a relationship, voice, image, or human behaviour.
At this level, trust depends on informational clarity.
Minimal or negligible risk
Most AI systems fall into this band: spam filters, video games, low-criticality recommendation systems, or routine optimisation features. For these tools, the AI Act does not impose particularly heavy obligations. Voluntary codes of conduct, internal good practices, and governance criteria may still be adopted, but the strict regime for high risk does not apply.
The European logic is proportional: concentrate the strongest controls on systems that can have the greatest impact.
Compliance is not added at the end: it is built into the solution
The most dangerous misconception is to treat the AI Act as mainly a legal issue. The regulation certainly requires legal expertise, but the most delicate part for companies is technical. For high-risk systems, an privacy notice, contract clause, or internal policy is not enough: organisations must show how the system was developed, integrated, tested, documented, and monitored.
The company must know which models it uses, which data is processed, which criteria drive scoring, which thresholds trigger a recommendation, who can intervene on output, how updates and changes are managed, and which user groups might face disproportionate effects.
Three immediate actions before 2 August 2026
1. Map and verify AI systems in use
The first step is to map existing systems: where AI is already used, by which departments, for what purposes, on which data, with which vendors, within which processes, and with what decisional impact. Without an inventory, there is no governance. Many organisations will find AI present in more places than they assumed: marketing automation, HR tech, CRM, customer service, analytics, commercial scoring, individual productivity tools.
2. Risk matrix for AI systems
The second step is to build a risk register. Each system must be classified under the European framework: minimal, limited, high, or unacceptable. The register should document intended use, data processed, potential impact, mitigation measures, human oversight, internal responsibilities, vendors involved, and subsequent updates. It is not a static archive but a living control matrix.
3. AI literacy for business teams
The third step is staff training. The AI Act also introduces AI literacy: those who use or govern AI systems must have skills appropriate to their role and context of use. HR, marketing, sales, operations, IT, and management must learn to distinguish trivial use from sensitive use, a productivity tool from a system that affects people, a vendor promise from a documentable requirement.
Compliance-by-design: the role of BOOONSAI
This is where BOOONSAI fits in: helping companies avoid treating the AI Act as a late constraint and instead turning it into a design criterion. Compliance-by-design means building AI solutions that embed risk classification, technical documentation, human oversight, traceability, control criteria, training, and governance from the start.
For businesses integrating AI into their processes, this approach becomes a competitive advantage. It reduces risk, improves decision quality, strengthens internal trust, and makes relationships with customers, partners, and stakeholders more solid. From 2026 onward, the question will no longer be only whether a company uses artificial intelligence, but whether it can demonstrate that it governs it.
BOOONSAI can support this journey with preliminary audits, system classification, risk registers, team training, and development of solutions designed to align with the new European framework from day one.
The source of truth: the AI Act Service Desk
In a market that will quickly fill with interpretations, improvised advice, and hard-to-verify “AI compliant” claims, the first reference should remain the institutional source: the AI Act Service Desk is the official platform provided by the European Commission to navigate timelines, obligations, FAQs, interactive tools, the AI Act Explorer, and the Compliance Checker.
For companies, providers, and managers, it should become the source of truth: the starting point before buying, integrating, classifying, or declaring an AI solution compliant. The AI Act Service Desk helps verify where you are on the regulatory calendar, which obligations may apply, how to read risk categories, and which steps to consider on the path to conformity.
Sources