Informational, not legal advice. This article summarises public legal texts as of October 2026. Laws and dates change, so check the current text and take advice from qualified counsel before acting on any of it.
The Compliance Imperative
As AI moves into core business processes, the rules that govern it keep moving too. In 2026 alone, the EU rewrote the AI Act's high-risk deadlines and a US state replaced its AI statute, while data-protection law applies alongside both.
The stakes are material. Under the EU AI Act, breaching the prohibited-practice rules can bring administrative fines "of up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher" (Regulation (EU) 2024/1689, Article 99(3)).
The Global Regulatory Landscape
- EU AI Act: The European Commission describes Regulation (EU) 2024/1689 as "the first-ever comprehensive legal framework on AI worldwide" and says it "defines 4 levels of risk for AI systems", from banned practices to high-risk uses and transparency duties (European Commission, AI Act). It applies in stages; the dates are set out in the timeline below.
- GDPR & Data Privacy: Where an AI system processes personal data, GDPR's principles apply in full, including "purpose limitation" and "data minimisation", and the controller must "be able to demonstrate compliance" with them (Regulation (EU) 2016/679, Article 5).
- United States — no comprehensive federal AI statute: Federal oversight runs through existing agency authority rather than a single AI law. The Federal Trade Commission has been explicit that "there is no AI exemption from the laws on the books" (FTC, Operation AI Comply, September 2024). AI-specific duties sit in state law, and those laws are still changing. Colorado enacted SB24-205 in 2024, moved its start date to June 30, 2026 with SB25B-004, and in May 2026 repealed and re-enacted it as SB26-189, which sets "new requirements regarding the use of automated decision-making technology in consequential decisions" (Colorado General Assembly).
- China PIPL: China's Personal Information Protection Law also reaches processing outside China of the personal information of people in China, for example when the purpose is "providing products or services" to them or "analyzing or evaluating" their behaviour (Article 3), and it has a separate chapter on cross-border transfers (National People's Congress, PIPL English text).
EU AI Act: What Applies When
| From | What applies | Where it is set |
|---|---|---|
| 2 February 2025 | General provisions, including the AI-literacy duty (Article 4), and the prohibited practices in Article 5. | Article 113, point (a) |
| 2 August 2025 | Governance rules and the obligations for general-purpose AI models. | Article 113, point (b) |
| 2 August 2026 | General date of application, including the Article 50 transparency duties. | Article 113, second paragraph |
| 2 December 2026 | New prohibitions on AI-generated non-consensual intimate material and child sexual abuse material. Generative systems placed on the market before 2 August 2026 must also mark their output under Article 50(2) by this date. | Article 113(a) and Article 111(4), as amended in 2026 |
| 2 December 2027 | High-risk obligations (Chapter III, Sections 1–3) for the Annex III use cases, such as employment, education and biometrics. Originally 2 August 2026. | Article 113(c)(i), as amended in 2026 |
| 2 August 2028 | High-risk obligations for AI in products covered by the EU legislation listed in Annex I. Originally 2 August 2027. | Article 113(c)(ii), as amended in 2026 |
Sources: Regulation (EU) 2024/1689, Articles 111 and 113, as amended by Regulation (EU) 2026/1744, Article 1.
Two of those dates moved in 2026. Regulation (EU) 2026/1744, the "Digital Omnibus on AI", followed the European Parliament's position of 16 June 2026 and the Council's decision of 29 June 2026, and was published in the Official Journal on 24 July 2026. The European Commission states that it "entered into force on 27 July 2026". Its recitals explain that the delayed availability of standards and of national authorities created challenges that "risk a significant increase in implementation costs in a way that does not justify maintaining their initial date of application, namely 2 August 2026" (Recital 40).
The same Regulation rewrote the AI-literacy duty in Article 4. Providers and deployers must now "take measures to support the development of AI literacy" of their staff, and the duty "does not require providers or deployers to guarantee any specific level of AI literacy of any individual".
What the Delay Does and Does Not Change
The EU legislature itself recorded "a compliance burden that is heavier than expected" (Regulation (EU) 2026/1744, Recital 2). The extra time is for building documentation, testing and human oversight into high-risk systems, not for skipping them: Chapter III still applies from the new dates.
Illustrative Example: A Compliance-Scan Checklist Mapped to Articles
Assumptions: a hypothetical US software company sells a CV-screening feature that ranks job applicants. Some customers are employers in the EU; the company has no EU establishment. This is not a client case. The European Commission itself gives "CV-sorting software for recruitment" as an example of a high-risk use.
Is it an AI system? Article 3(1)
The Act covers “a machine-based system … that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions”.
In this scenario: A model that infers a ranking of applicants from their CVs fits the shape of this definition.
Does the Act reach a non-EU company? Article 2(1)(a) and (c)
It applies to providers placing AI systems on the EU market “irrespective of whether those providers are established or located within the Union or in a third country”, and to third-country providers and deployers “where the output produced by the AI system is used in the Union”.
In this scenario: Selling the feature to EU employers puts the company in scope as a provider.
Is any feature prohibited? Article 5(1)(f)
Prohibited since 2 February 2025: AI systems used “to infer emotions of a natural person in the areas of workplace and education institutions”, except for medical or safety reasons.
In this scenario: Ranking CVs is not on the Article 5 list. A video-interview add-on that inferred candidates’ emotions would be.
Is it high-risk? Article 6(2)–(4) and Annex III, point 4(a)
Annex III lists “AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates”. Article 6(3) allows narrow exceptions, but such a system “shall always be considered to be high-risk where the AI system performs profiling of natural persons”.
In this scenario: Filtering and ranking applications is listed. If the ranking profiles applicants, the exception is unavailable. A provider that concludes otherwise must “document its assessment before that system is placed on the market” (Article 6(4)).
What must the provider build? Articles 9, 10, 13 and 14 (from 2 December 2027)
A risk management system “established, implemented, documented and maintained” (Article 9); data governance for training, validation and testing data (Article 10, amended in 2026); operation “sufficiently transparent to enable deployers to interpret a system’s output and use it appropriately” (Article 13); and design that lets the system “be effectively overseen by natural persons” (Article 14).
In this scenario: Each of these needs evidence on file before the system is sold into the EU after the deadline.
What must the customer do? Article 26(1), (2) and (7)
Deployers must use the system in line with its instructions, “assign human oversight to natural persons who have the necessary competence, training and authority”, and employers “shall inform workers’ representatives and the affected workers” before using a high-risk system at the workplace.
In this scenario: These duties fall on EU employer customers, so they belong in the onboarding pack.
Transparency and AI literacy Article 50(1) and Article 4
Since 2 August 2026, people using a system “intended to interact directly with natural persons” must be informed that they are interacting with an AI system, unless that is obvious. Under Article 4 as rewritten in 2026, providers and deployers must “take measures to support the development of AI literacy” of their staff.
In this scenario: A candidate-facing chatbot would need an AI notice. Internal training records cover Article 4.
GDPR and US overlays GDPR Articles 22 and 35; Colorado SB26-189
GDPR gives a right “not to be subject to a decision based solely on automated processing, including profiling” that has legal or similarly significant effects, and requires an impact assessment “prior to the processing” where processing is likely to be high-risk. In Colorado, SB26-189 sets duties for developers of automated decision-making technology used in consequential decisions, starting 1 January 2027.
In this scenario: Check whether any rejection happens with no meaningful human involvement, whether a DPIA exists, and whether hiring counts as a consequential decision under the Colorado act.
Quotations are from Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, Regulation (EU) 2016/679 and the Colorado General Assembly's SB26-189 summary. The "in this scenario" notes are illustrative reasoning, not legal conclusions.
Using AI to Manage AI Compliance
Software can carry part of the load in the checklist above. No tool makes a system compliant on its own, but each of these supports a specific duty.
Continuous Monitoring
An AI-system inventory checked against a register of obligations, so new systems and new rules are flagged for review.
Explainability Tools
Readable explanations of outputs help deployers interpret them, which Article 13 requires providers to enable.
Bias Detection & Audit
Bias testing feeds the risk and data-governance work in Articles 9 and 10. It does not replace the legal assessment.
Data Lineage Tracking
Records of how data flows through a system support GDPR accountability and data subject requests.
Building a Compliance-First AI Strategy
Treating compliance as a design input means the evidence the rules ask for is produced as the system is built, not reconstructed afterwards.
Four Pillars of AI Compliance:
- Governance Architecture: Establish clear ownership of AI systems, data flows, and compliance obligations with cross-functional accountability structures.
- Risk Classification: Map every AI use case against the regulatory risk tiers, so governance effort is proportional and low-risk applications are not held up.
- Documentation Standards: Maintain model cards, data provenance records, and impact assessments as living documents that evolve with system changes.
- Regulatory Intelligence: Treat regulatory monitoring as a standing function that tracks legislative developments in every operating jurisdiction. For market context, see our artificial intelligence market briefing.
Key Takeaways
- ✓ The EU AI Act applies in stages: prohibitions from February 2025, general-purpose AI rules from August 2025, most other rules from 2 August 2026
- ✓ The 2026 Digital Omnibus moved high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I)
- ✓ Fines for prohibited practices reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher
- ✓ GDPR still governs personal data in AI systems, including automated decisions and impact assessments
- ✓ In the US, the FTC applies existing law to AI, and state AI laws such as Colorado's are still changing
The VIDANALYTICA INC Perspective
At VIDANALYTICA INC, our Compliance Quick Scan ($249, typically delivered in 5–7 days) gives compliance teams a framework-aligned analysis with gap and control highlights — sources cited inline and a sample of key claims fact-checked before delivery. Like the checklist above, it is research to inform your counsel, not a legal opinion.
In the age of intelligent automation, compliance isn't a constraint — it's a foundation.