Business law
Published on September 15th, 2026
If you run a business that uses AI tools without building them, the date you have probably heard, August 2nd, 2026, is not the whole calendar. The obligations started at different moments and ask for different things, and that date is not the one that creates most work.
It is the date of "general application" of the EU AI Act (Article 113 of Regulation (EU) 2024/1689), and it has been read as if everything arrived that day, when part of the Act applied earlier and part of what did arrive no longer follows the original calendar.
Position as of September 15th, 2026. This note relies on Regulation (EU) 2024/1689 (the EU AI Act) and on the so-called AI Digital Omnibus, which is now law in force: Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal of the European Union on July 24th, 2026, and in force since July 27th. What follows already incorporates its changes. Updated on October 9th, 2026 only as regards the Spanish organic law bill, which has lapsed.
For a business that merely uses AI, the centerpiece that became applicable on August 2nd, 2026, is the transparency duty of Article 50. The rest of what started that day, governance, registration and market surveillance, weighs on providers and public authorities instead. If your website has a chatbot, AI systems that interact directly with people must be designed to let the person know they are talking to a machine (Article 50(1)). The design duty falls on the provider, so if the chatbot is a third party's, now is the moment to check that it complies and to reflect that in the contract.
Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format, detectable as artificial (Article 50(2)). Whoever deploys a system that generates or manipulates a deepfake must disclose that the content is artificial, and so must whoever publishes AI-generated text to inform the public on matters of public interest (Article 50(4)), which is the part that concerns what you publish yourself.
The AI literacy duty of Article 4 has been binding since February 2nd, 2025, when the Act's first two chapters began to apply (Article 113(a)); those chapters also contain the prohibited practices of Article 5. On July 27th, 2026, the duty changed in intensity. Where the 2024 text asked providers and deployers to "ensure" that their staff had "a sufficient level of AI literacy", the wording now in force asks them to "take measures to support the promotion" of that literacy, and states expressly that it does not require any specific level to be guaranteed in any particular person. The duty remains and in practice still asks for the same thing, which is basic, documented training for the people who work with these tools.
The penalties chapter has applied since August 2nd, 2025 (Article 113(b)), so the fine ceiling predates the August date as well. Article 99 sets three tiers, from most to least serious: up to 35 million euros or 7 % of worldwide turnover for prohibited practices, up to 15 million or 3 % for most other obligations, the transparency duties of Article 50 among them, and up to 7.5 million or 1 % for supplying incorrect information. There is also a rule for SMEs that is rarely quoted, Article 99(6), under which the lower of the two references, percentage or amount, applies and not the higher.
Under the Digital Omnibus, the obligations for high-risk systems under Annex III, such as recruitment, access to credit or education, move to December 2nd, 2027, and those for systems embedded in regulated products under Annex I, to August 2nd, 2028 (point (c) of Article 113, as replaced). If your internal roadmap had "August 2026" pencilled in for this, change the date, but do not delete the entry.
Systems generating synthetic content placed on the market before August 2nd, 2026, have until December 2nd, 2026, to comply with the marking duty of Article 50(2) (new Article 111(4)). Two new points, (ba) and (bb), are added to Article 5, covering non-consensual intimate deepfakes and the material or performances referred to in Article 2(c) and (e) of Directive 2011/93/EU, and they apply from December 2nd, 2026.
The softening of AI literacy, by contrast, already applies, since Article 4 was replaced on July 27th, 2026, and "ensuring a sufficient level" became "taking measures to support the promotion" of AI literacy, without requiring any specific level to be guaranteed. Unlike the postponements above, this change has no future date attached and is the wording that binds today.
Spain has an agency that exists and is operating (AESIA, the Spanish agency for the supervision of artificial intelligence, created by Royal Decree 729/2023 of August 22nd). The Organic Law Bill on the sound use and governance of artificial intelligence lapsed when the Cortes were dissolved (Royal Decree 806/2026 of October 5th), and the new legislature would have to pick it up again, so as of today no such law has been published in the BOE (Spain's official State gazette). If it is revived, it will complete the designation of national authorities required by Article 70 of the Act and the domestic penalty regime.
In my view the absence of a Spanish statute does not suspend the European obligations, which are directly applicable, and that is also the prudent reading if you run a business in Spain from abroad.
In a field that changes every week I apply my usual method with all the more reason, which means checking the actual state of the rule at the date that matters, verifying every citation against the Official Journal and the BOE before relying on it, and taking none of them on memory. It is the same discipline I apply to artificial intelligence inside my own practice, under a written working method.
If your business uses AI, I can help you draw up that inventory and review the contract with your chatbot provider or with whoever supplies the tools you use. Write to me, or see first how I handle business law matters.
Editorial responsibility: Carles Jiménez, Spanish lawyer (Barcelona Bar No. 34.946). This note was prepared with the assistance of artificial-intelligence tools and reviewed and approved by the author before publication.
Tell me about your situation and I will tell you, frankly, how I can help.
Get in touch