EU AI Act: which dates matter for offices that only use AI

An office that only uses AI and does not offer it to others is a deployer under the AI Act. Three stages matter for you. AI literacy under Art. 4 has applied since 2 February 2025, and the transparency rules under Art. 50 have applied since 2 August 2026. The high-risk rules are mostly not relevant to typical office applications and apply to Annex III only from 2 December 2027. This is a general overview, status November 2026, and not legal advice. A lawyer or your data protection officer clarifies the individual case.

The dates at a glance

Regulation (EU) 2024/1689 came into force in stages. In July 2026 it was amended by Regulation (EU) 2026/1744, whose title reads “Digital Omnibus on AI”. I checked the dates in the graphic against the wording in the Official Journal and the Commission’s pages.

Who is a deployer

Art. 3(4) of the AI Act defines a deployer as a natural or legal person, public authority, agency or other body using an AI system under its authority, except where the system is used in the course of a personal non-professional activity. An office that uses AI services professionally falls under this on the wording. Many of the Regulation’s duties are aimed at providers, meaning the bodies that supply AI services, and not at you as a user.

Art. 4: AI literacy

The duty has applied since 2 February 2025. Regulation (EU) 2026/1744 has reworded it. Before, providers and deployers had to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. Now they must take measures to support the development of AI literacy of their staff and of other persons dealing with AI systems on their behalf. The duty expressly does not require them to guarantee any specific level of AI literacy of any individual. The Commission and the member states are to support small and medium-sized enterprises in particular.

The Commission adds that persons acting within the organisation’s remit are also covered, for example contractors or service providers. It says there are no fixed requirements and no mandatory training, and no certificate is needed. You can keep an internal record of which training or other measures have taken place. Simply asking staff to read the instructions for use is often ineffective. One example from the Commission: if employees use an AI chat service for advertising copy, they should be informed about the risks, for example invented content.

Supervision and enforcement lie with the national market surveillance authorities and apply, according to the Commission, from 2 August 2026. The authorities could impose penalties, which would have to be proportionate. How this is arranged in Germany I have not checked.

What belongs in a house policy is covered in the article on an AI policy for the office. For private use of chat services at work, there is the article on shadow AI.

Art. 50: transparency

Art. 50 applies from 2 August 2026. Its wording distinguishes by role. The duties in paragraph 1 (telling people they are dealing with an AI) and paragraph 2 (machine-readable marking of generated content) fall on providers. For deployers, the article names two areas. Deployers of an emotion recognition or biometric categorisation system must inform the people exposed to it about its operation (paragraph 3). Anyone who generates or manipulates image, audio or video content that is a deep fake must disclose that it has been artificially generated or manipulated. The same applies to text published to inform the public on matters of public interest, unless it has undergone human review or editorial control and someone holds editorial responsibility (paragraph 4).

The information must be given in a clear way at the latest at the time of first interaction or first contact with the content (paragraph 5). My assessment, not legal advice: internal drafts, minutes, summaries and research that a person checks do not appear in these areas. Whether something you publish counts as informing the public on matters of public interest is a question of interpretation that I do not judge here.

On 2 December 2026 a transition applies for Art. 50(2) (new Art. 111(4)). It concerns providers of systems that were on the market before 2 August 2026, not you as a deployer. On the same date two new prohibitions in Art. 5 apply: AI systems that generate realistic intimate or sexually explicit depictions of identifiable persons without their consent, and AI systems that generate depictions of child sexual abuse.

High risk: mostly not relevant

High-risk systems are those listed in Annex III to Art. 6(2) (or embedded in regulated products, Annex I, which the Commission illustrates with medical devices, toys and lifts). Annex III names eight areas: biometrics, critical infrastructure, education, employment and workers’ management, essential private and public services, law enforcement, migration and border control, and administration of justice and democratic processes.

For an office, employment is the obvious area. It covers AI for recruiting or selecting people, for example screening or filtering applications, and AI for decisions on working relationships, for example promotion, termination, task allocation based on personal traits, and monitoring and evaluating performance and behaviour. Meeting minutes, searching the project files, drafts of letters or summaries of standards are not on the list. That is my reading of the list. Classifying a specific use is for a lawyer.

Since the amendment, Art. 113, paragraph 3, point (c) of the AI Act reads: Chapter III, Sections 1 to 3 apply from 2 December 2027 to high-risk systems under Art. 6(2) and Annex III, and from 2 August 2028 to those under Art. 6(1) and Annex I. Originally the dates were 2 August 2026 and 2 August 2027. For deployers of high-risk systems, the Commission says the obligation to have staff trained for human oversight remains.

What “Digital Omnibus” means

There are two projects under a similar name.

The AI part ran as follows, according to the European Parliament’s page: Commission proposal on 19 November 2025, agreement in trilogue on 7 May 2026, Parliament vote on 16 June 2026, Council adoption on 29 June 2026, signature on 8 July 2026, publication in the Official Journal on 24 July 2026. Under its Art. 4 the Regulation enters into force on the third day after publication, that is on 27 July 2026. The Commission gives the same date.

The part on the GDPR, ePrivacy and data law is a separate proposal from the same Commission. The member states agreed the Council’s negotiating mandate on 21 October 2026 in the Committee of Permanent Representatives (document 14756/26). Negotiations start only once Parliament has set its position, which according to a law firm article is expected in February 2027. Until it enters into force, the existing law applies unchanged. The statement on Parliament rests on that secondary source.

Which stages affect your office

The graphic summarises what is set out above. It is an orientation based on the text of the Regulation and does not replace a check of your own use. Art. 4 applies in every case where you use AI professionally.

What I could not check

The EUR-Lex pages could not be retrieved automatically on 13 November 2026. I read the Official Journal versions through the EU publications portal instead: Regulation (EU) 2026/1744 of 24 July 2026 and Regulation (EU) 2024/1689 in the German wording. Of Art. 50, the amendment touches only paragraph 7. I have not checked penalties and competent authorities in Germany.

What you can do now

1. List which AI services are used in your office, and check for each whether one of the Annex III areas is touched, especially for applications and performance evaluation.
2. Record in writing which AI training or briefings you have carried out, with dates and participants.
3. Clarify whether you publish AI-generated images, videos or texts, and have your lawyer check the labelling.
4. Put a date in your diary for 2 December 2027 and check by then whether your use has changed.