EU AI Act – businesses have eight weeks, no extension and fines up to €7.5m

Malcolm Che, head of innovation at Identity, said: “Most organisations using generative AI have no inventory of where it sits in their workflows. It is embedded in customer-facing tools, supplier platforms, internal systems and content production, often without the compliance function knowing it is there. From August 2 2026, that gap has a price tag.

“Article 50 of the EU AI Act applies to any organisation deploying AI in specific ways, regardless of sector and regardless of who built the underlying tool. AI interactions that could be mistaken for human contact must be disclosed as AI. AI-generated images, video and audio must carry machine-readable watermarks. Deepfakes and AI-generated content on matters of public interest require explicit labelling.

“Critically, the liability sits with deployers, the businesses using these tools, not only with the developers who built them. A grace period exists for tool providers already on the market before August 2 2026; no equivalent extension applies to the organisations deploying them.

“With the final Code of Practice expected this month and the Commission’s draft guidelines consultation having just closed, the regulatory framework is now settled enough to act on. The businesses that cannot demonstrate a disclosure standard will find that visible at procurement stage. Fines reach €7.5 million or 1.5 per cent of global annual turnover.

“Responsible AI deployment was never a differentiator. It was always the baseline. August 2 2026 simply makes that enforceable.”