The EU AI Act for small builders.

If you build a chatbot, app or website on top of someone else’s AI model, the EU AI Act mostly asks you to be transparent. Since August 2, 2026, people must be told when they are talking to an AI, and AI-generated content must be marked or labeled in set cases.

The heavy “high-risk” rules only reach products that make decisions about things like hiring, education or credit, and they now start on December 2, 2027. This guide covers the timeline actually in force on September 22, 2026, including the changes adopted in July 2026. It is a plain-English summary, not legal advice.

01What the EU AI Act is, in one minute

The EU AI Act is a regulation, so it applies directly in every member state. It sorts AI by risk: the more harm a use can do, the more rules apply.

The labs that make general-purpose models, such as GPT, Claude or Gemini, carry their own duties, which apply since August 2, 2025. If you only call a model through an API, those duties are not yours. The Commission says only those making significant modifications to a model take them on, not those making minor changes.

02The EU AI Act timeline in force in September 2026

Here is every date that matters to a small builder, as amended in July 2026.

1. August 1, 2024The AI Act enters into force.
2. February 2, 2025Bans on unacceptable practices and the AI literacy duty apply.
3. August 2, 2025Duties for providers of general-purpose AI models apply, along with the penalty rules.
4. July 27, 2026The Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force and changes several dates.
5. August 2, 2026Most remaining rules apply, including the Article 50 transparency duties.
6. December 2, 2026New bans on AI that generates non-consensual intimate images or child sexual abuse material. Generative tools already on the market before August 2, 2026 must mark their outputs.
7. December 2, 2027High-risk rules apply to uses listed in Annex III, such as hiring, education and credit scoring.
8. August 2, 2028High-risk rules apply to AI inside products that already need EU safety checks, such as toys or medical devices.

03Are you a provider or a deployer?

The Act gives different duties to the people who build an AI system and the people who use one. Small builders are often both.

The Commission’s own FAQ covers the common case directly. A small business that builds a chatbot on a third-party model and offers it under its own name is the provider. If that business also runs the chatbot on its own site, it is the deployer too.

04What applies to your chatbot, app or website

Article 50 is the part of the Act most small builders will actually meet. It has four duties that matter here.

• A chatbot, voice bot or agent that talks to people. Tell them they are dealing with an AI, clearly, at the latest at the first interaction. You can skip it only when this is obvious to a reasonably well-informed person.

• A tool that generates images, audio, video or text. Mark the outputs in a machine-readable format, such as C2PA content credentials, so they can be detected as AI-generated. Assistive features for standard editing, which do not substantially change the input, are exempt.

• Publishing realistic fakes. If you publish AI images, audio or video that resemble real people, places or events and could pass as authentic, disclose that they are AI-made. For clearly artistic, satirical or fictional work, a lighter disclosure that does not spoil the work is enough. Our guide to spotting a deepfake covers what a reader can check when that disclosure is missing.

• Publishing AI-written text on public matters. If AI-generated text informs the public on matters of public interest, disclose it, unless a human reviewed it and someone holds editorial responsibility. The Commission’s FAQ says spell-checking alone is not editorial control.

For help with the how, the Commission published a voluntary Code of Practice on marking and labelling AI-generated content on June 10, 2026, and guidelines on Article 50 on July 20, 2026. It has since confirmed the code as an adequate way to show compliance.

If you build on a model API, check what marking the model maker already applies, and make sure your product does not strip it. Transparency is also only the legal floor: a public chatbot needs protection against prompt injection too.

05What changed in 2026: the Digital Omnibus on AI

The EU amended the Act with Regulation (EU) 2026/1744 of July 8, 2026. It was published in the Official Journal on July 24 and entered into force on July 27, 2026. For small builders, five changes matter.

• High-risk rules moved. Uses listed in Annex III now start on December 2, 2027. AI inside regulated products starts on August 2, 2028.

• A grace period for marking. Generative tools placed on the market before August 2, 2026 have until December 2, 2026 to meet the marking duty in Article 50(2). New tools must comply from launch.

• Two new bans. From December 2, 2026, AI systems that generate sexual images of identifiable people without their consent, or child sexual abuse material, are prohibited.

• A softer AI literacy duty. Providers and deployers must now “take measures to support the development of AI literacy” of their staff. The law says this does not require guaranteeing any specific level, and the Commission will publish practical examples. Our AI use policy template is a one-page way to start on this.

• More relief for growing firms. The lower fine caps that protect SMEs now also cover small mid-cap enterprises for most fines.

06How big are the fines?

Member states set the actual penalty rules, within these ceilings from Article 99:

For SMEs, including start-ups, each cap is whichever of the two figures is lower. National authorities must also weigh an SME’s economic viability when setting a penalty.

07A checklist for small builders

Unsure about a feature? The Commission’s AI Act Single Information Platform offers a free compliance checker and a service desk for questions. The AI Act also sits alongside the GDPR, which still governs any personal data your product handles; see our AI privacy guide.

08FAQ

Next, read who owns AI-generated content, or our AI privacy guide.