How changes to the regulation of artificial intelligence create security, transparency and growth opportunities?

Artificial intelligence is already present in every business process. Companies seek clarity, and consumers expect protection. The proposed amendments to the EU Artificial Intelligence Act deliver precisely that a predictable environment in which technology can evolve responsibly and with confidence.

The European Parliament has adopted a position for simplifying the rules on artificial intelligence, introducing specific deadlines for high-risk systems, greater flexibility for businesses, and new restrictions on sensitive applications. This article provides a comprehensive overview of the changes and their significance for businesses.

Contents

• New deadlines for applying the AI rules
• What constitutes a high-risk AI system
• Changes introduced for businesses and SMEs
• What transparency means for AI-generated content
• What the AI regulation comparison table shows
• Prohibited AI applications
• Integration of the new rules with sector-specific legislation
• Questions & Answers

What Are the New Deadlines for Applying the AI Rules?

The European Parliament proposes specific dates that provide clarity for businesses, enabling strategic planning and a more measured approach to technology deployment.

Two dates define the framework: 2 December 2027 for high-risk systems listed under Annex III, and 2 August 2028 for those falling under Annex I (sector-specific legislation). Additionally, by 2 November 2026, companies must implement labelling for AI-generated content.

This approach creates a clear rhythm. Businesses have time to analyse their systems, build internal compliance processes, and implement the required changes with confidence.

What Constitutes a High-Risk Artificial Intelligence System?

High-risk systems are those that directly affect individuals and society. They require more rigorous oversight and clearly defined standards.

This category includes AI solutions used in healthcare, education, employment, the justice system, and critical infrastructure. Systems that process biometric data also fall within this category.

When developing such technology, it is essential to focus on reliability, transparency, and ethics, building trust and positioning your organisation as a responsible market participant.

What Changes Are Being Introduced for Businesses and SMEs?

The proposed amendments grant companies greater flexibility, facilitating the adoption of innovations and reducing administrative burden.

One important provision is the ability to use personal data for detecting and correcting errors in AI systems under strictly defined conditions, allowing companies to improve their solutions more effectively.

The expansion of support to mid-cap companies (SMCs) also creates a smoother transition from small to growing businesses and opens the door to the European single market.

What Does Transparency Mean for AI-Generated Content?

Content generated by artificial intelligence must be clearly labelled. This requirement enters into force from November 2026 under the European Parliament's position.

Texts, images, and videos will carry a watermark or another form of designation, enabling users to identify the origin of the information they consume.

Such transparency builds trust. Brands that operate openly create stronger connections with their audiences.

What Artificial Intelligence Applications Are Prohibited?

The European Parliament proposes a ban on systems that generate non-consensual intimate imagery, including technologies capable of visually manipulating content to simulate or misrepresent real individuals.

This measure protects personal privacy and human dignity. It establishes clear boundaries and encourages the development of responsible AI technologies.

Systems with built-in safeguards to prevent misuse may continue to operate, allowing innovation to proceed within an ethical and legally compliant framework.

How Do the New Rules Integrate with Sector-Specific Legislation?

Where a product is already regulated by sector-specific legislation — such as in medicine or manufacturing — the requirements under the AI Act may be adapted accordingly, reducing duplication of compliance processes.

Companies can operate more efficiently and redirect resources towards product development. For businesses operating within the EU, this means a clearer framework and fewer administrative obstacles.

Your Next Step

If you are developing or deploying artificial intelligence solutions, now is the right moment to analyse your systems and processes. Consulting with experts and conducting an internal audit will help you build a solid foundation for compliance.

You can begin with a risk assessment, team training, and the introduction of transparent data-handling mechanisms — turning regulatory requirements into an opportunity for development and competitive advantage.

Conclusion

The amendments to the EU Artificial Intelligence Act bring clarity and direction. They establish an environment in which businesses can grow with confidence, innovate responsibly, and build lasting trust with customers and regulators alike.

Acting proactively and with strategic vision lays the foundations for sustainable success. Artificial intelligence is already part of our reality — your approach determines how effectively you leverage its potential.

Questions & Answers

Updated as of 26 March 2026, following the adoption of the European Parliament's official mandate for negotiations with the EU Council (569 votes in favour, 45 against, 23 abstentions). The texts below reflect the formally adopted Parliament position. The final law is expected once negotiations between Parliament and Council are concluded.

Q: What exactly did the European Parliament vote on 26 March 2026?

A: On 26 March 2026, the plenary session adopted by 569 votes in favour, 45 against and 23 abstentions the official mandate for negotiations on the so-called "Digital Omnibus", a simplification proposal amending the Artificial Intelligence Act (Regulation (EU) 2024/1689). The legislative initiative forms the seventh omnibus simplification package, proposed by the Commission on 19 November 2025. With the mandate adopted, Parliament is ready to enter trilogue negotiations with the EU Council. The Regulation is not final until those negotiations are concluded.

Q: When do the new obligations for high-risk AI systems enter into force?

A: The adopted mandate establishes two fixed dates, applicable regardless of whether harmonised technical standards are available: 2 December 2027 for systems specifically listed in Annex III of the Regulation (biometric identification, critical infrastructure, education, employment, access to essential services, law enforcement, administration of justice, and border management), and 2 August 2028 for systems covered by EU sectoral safety and market surveillance legislation under Annex I (medical devices, radio equipment, toy safety, and others). The fixed dates are a key achievement, as they eliminate the legal uncertainty created by the Commission's earlier proposal, which tied the deadlines to the availability of harmonised standards.

Q: What is the deadline for labelling AI-generated content?

A: The adopted mandate sets 2 November 2026 as the compliance date for the obligation under Article 50(2): providers of AI systems generating synthetic audio, images, video or text must ensure that outputs are technically marked (watermarked) to indicate their AI origin. This deadline is earlier than the February 2027 date proposed by both the Commission and the Council. Practical implication: businesses must have a functioning technical marking solution in place before 2 November 2026.

Q: Are so-called "nudifier" applications now prohibited?

A: With the adopted mandate, Parliament introduces a new prohibited AI practice: "nudifier" systems, AI systems that generate or manipulate sexually explicit or intimate imagery resembling an identifiable real person without that person's consent. The prohibition does not apply to AI systems that incorporate effective safety measures preventing users from generating such content. This category was introduced by Parliament itself and was not part of the Commission's original proposal. It directly affects all platforms and developers offering AI-powered image-editing or image-generation tools.

Q: Which AI systems are classified as high-risk?

A: The adopted mandate does not materially alter the existing classification framework. High-risk AI systems are those deployed in: biometric identification and categorisation of natural persons; management of critical infrastructure (energy, transport, water); education and vocational training assessment; employment, worker management, and access to self-employment (recruitment, performance evaluation, termination); access to essential private and public services (creditworthiness assessment, healthcare, social benefits); law enforcement and border control; administration of justice and democratic processes. Systems processing biometric data also fall within this category.

Q: Is the AI literacy obligation under Article 4 retained?

A: Yes, but in a softened form. The adopted mandate does not repeal Article 4; it reformulates it. Rather than requiring providers and deployers to ensure a "sufficient level of AI literacy" among their staff, the obligation becomes one to "support the improvement of AI literacy" without prescribing a specific, measurable standard. This is a significant departure from the Commission's proposal, which sought the outright deletion of Article 4.

Q: Can organisations process sensitive personal data to detect and correct bias in AI systems?

A: Yes, but subject to a retained safeguard threshold. The adopted mandate permits providers to process personal data to detect and correct bias in AI systems, but preserves the "strictly necessary" requirement as a protective condition. This is an important distinction from the Commission's proposal, which sought to lower the threshold to simply "necessary" and significantly broaden the scope. Parliament has explicitly added safeguards to protect against disproportionate processing of sensitive personal data.

Q: How does the mandate address the interaction between the AI Act and sector-specific legislation?

A: The adopted mandate confirms that obligations under the AI Act may be less stringent for products already regulated under EU sectoral product safety legislation, such as medical devices, radio equipment, and toy safety. The objective is to prevent overlapping and duplicative compliance requirements. Where sectoral legislation does not fully cover the requirements of the AI Act, the Commission is tasked with updating those sectoral rules accordingly. For businesses operating in regulated industries, this provides a meaningful reduction in administrative burden.

Q: Has support for small and medium-sized enterprises been extended?

A: Yes. The adopted mandate confirms the extension of support measures previously available only to SMEs to small mid-cap enterprises (SMCs), on an equivalent basis. Regarding sanctions, caps on maximum fines apply equally to SMEs and SMCs, with one significant exception: violations of prohibited AI practices, including the deployment of nudifier systems, are not subject to any cap. For the most serious infringements, uncapped penalties apply regardless of company size.

Q: What is the role of the EU AI Office under the adopted mandate?

A: The EU AI Office serves as the central supervisory authority for General-Purpose AI (GPAI) models. The adopted mandate introduces specific carve-outs limiting the expansion of its powers, notably for critical infrastructure and certain categories of AI systems. Parliament explicitly rejects the Commission's concept of "exclusive" competence, preserving a balanced role for national competent authorities alongside the EU AI Office.

Q: Are operators required to register "exempt" AI systems in the EU database?

A: Yes. The adopted mandate retains the obligation to register systems classified as "exempt" from high-risk status via the Article 6(3) derogation criteria in the EU public database, while reducing the volume of information required at the point of registration. This approach preserves traceability and market surveillance capacity in contrast to the Commission's proposal, which sought to eliminate the registration requirement entirely.

Q: What should businesses do now?

A: The mandate has been adopted; however, the final Regulation is not yet in force and trilogue with the Council is pending. Businesses should not wait: (1) conduct an internal audit and classification of all AI systems in use or under development; (2) determine which systems fall under Annex III or Annex I and plan compliance timelines accordingly; (3) assess whether any products are already governed by sectoral legislation, which may reduce AI Act obligations; (4) implement technical solutions for watermarking AI-generated content ahead of 2 November 2026; (5) review whether any image-editing or image-generation tools could be classified as nudifier systems under the new prohibition.