For months, many companies have felt reassured by the timetable of the European Union\u2019s Artificial Intelligence Regulation, the AI Act.
\u2018This will take years.\u2019 \u2018We\u2019ll see in 2027.\u2019 \u2018It doesn\u2019t affect us yet.\u2019
Nothing could be further from the truth.<\/p>\n
If 2025 has been the year of prohibitions and 2027 will mark full harmonisation, 2026 is the decisive year<\/strong>: the moment when artificial intelligence stops being an experimental matter and becomes a regulatory, strategic and genuine business risk issue<\/strong>.<\/p>\n At Certus Legal Firm<\/span><\/span><\/strong>, we are seeing this clearly. Many companies use AI on a daily basis \u2014 in recruitment, scoring systems, customer service, data analysis, marketing or process automation \u2014 without yet having a clear understanding of what type of AI they are using, which risk category it falls into, and what specific obligations will apply from August 2026 onwards<\/strong>.<\/p>\n This article is not intended to alarm. Its purpose is to bring order, clarity and practical insight<\/strong> to the AI Act: what is coming, who it affects, and what companies that do not want to be chasing the regulator in two years\u2019 time should already be doing.<\/p>\n The EU Artificial Intelligence Act introduces a paradigm shift in how technology is regulated in Europe. Rather than focusing on the tool itself, it focuses on the risk generated by its use<\/strong>.<\/p>\n The approach is reminiscent of the General Data Protection Regulation<\/span><\/span> (GDPR)<\/strong>, but with a crucial difference: here, the regulation is less about data and more about the potential impact of AI systems on individuals, organisations and the market itself<\/strong>.<\/p>\n The starting point of the AI Act is therefore very clear: not all artificial intelligence is the same<\/strong>, and consequently not all AI should be treated the same from a legal perspective<\/strong>.<\/p>\n On this basis, the Regulation classifies AI systems into four main risk categories:<\/p>\n Prohibited AI<\/strong>, banned outright due to its unacceptable impact on fundamental rights<\/p>\n<\/li>\n High-risk AI<\/strong>, permitted but subject to strict controls<\/p>\n<\/li>\n Limited-risk AI<\/strong>, primarily subject to transparency obligations<\/p>\n<\/li>\n Minimal-risk AI<\/strong>, freely usable, although subject to voluntary codes of conduct<\/p>\n<\/li>\n<\/ul>\n The key point \u2014 and where many companies misjudge the situation \u2014 is that the AI Act does not remain at the level of abstract principles or ethical statements. It introduces very specific technical, organisational and documentary obligations<\/strong>, backed by a sanctions regime that can reach tens of millions of euros or significant percentages of global turnover<\/strong>.<\/p>\n In other words, this is not a best-practice guide. It is binding EU law<\/strong>, with direct implications for how companies design, purchase and use AI-based solutions.<\/p>\n One of the most common errors we encounter is reading the AI Act timeline \u2018diagonally\u2019. The Regulation does not<\/strong> enter into force all at once.<\/p>\n The key milestones are as follows:<\/p>\n The full prohibition of certain AI practices begins, including:<\/p>\n Generalised social scoring, in the style of the Chinese system<\/p>\n<\/li>\n Subliminal manipulation causing harm<\/p>\n<\/li>\n Large-scale scraping of biometric data<\/p>\n<\/li>\n Real-time remote biometric identification in public spaces (with very limited exceptions)<\/p>\n<\/li>\n<\/ul>\n If detected, these practices may lead to immediate sanctions<\/strong>.<\/p>\n Obligations for general-purpose AI (GPAI) providers<\/strong>, including foundation models, come into force. These include duties relating to:<\/p>\n Transparency<\/p>\n<\/li>\n Training data documentation<\/p>\n<\/li>\n Risk management<\/p>\n<\/li>\n Enhanced obligations where the model is deemed to pose systemic risk<\/p>\n<\/li>\n<\/ul>\n By this point, Member States must also have fully operational national authorities<\/strong> in place.<\/p>\n This is when the core obligations for high-risk AI systems<\/strong> begin to apply, particularly those listed in Annex III of the Regulation<\/strong>.<\/p>\n And this is where many companies will find themselves affected \u2014 often without realising it.<\/p>\n Full application for high-risk systems embedded in regulated products (Annex I): machinery, medical devices, industrial products, and similar.<\/p>\n If you use high-risk AI in 2026, you already have full legal obligations<\/strong>, even if you do not develop technology yourself or consider your organisation to be \u2018tech-focused\u2019.<\/p>\n A common misconception is that the AI Act is aimed solely at major technology companies or advanced model developers. This is not the case.<\/p>\n The Regulation follows a clear logic: AI is regulated where it is used and where it produces effects<\/strong>, not only where it is developed. As a result, its scope extends across the entire AI value chain<\/strong>, covering a wide range of business profiles.<\/p>\n In practice, the AI Act distinguishes between several legal roles, each with specific obligations:<\/p>\n Providers<\/strong>, who develop an AI system and place it on the market or put it into service under their own name or brand<\/p>\n<\/li>\n Deployers<\/strong>, meaning organisations that use AI systems in their internal processes or services (for example, in HR, financial scoring, customer service, marketing or data analytics)<\/p>\n<\/li>\n Importers and distributors<\/strong>, who facilitate the entry and commercialisation of AI systems in the EU market<\/p>\n<\/li>\n Manufacturers<\/strong>, who integrate AI systems into regulated products or broader technological solutions<\/p>\n<\/li>\n<\/ul>\n The direct consequence for many businesses is clear: using AI also creates legal obligations<\/strong>, even where the technology has not been developed in-house.<\/p>\n In addition, the AI Act adopts an extraterritorial approach<\/strong>, similar to that of the GDPR. It also applies to providers and users located outside the EU where:<\/p>\n The AI system is used within EU territory, or<\/p>\n<\/li>\n Its outputs produce effects on individuals located in the EU<\/p>\n<\/li>\n<\/ul>\n This so-called \u2018Brussels effect\u2019<\/strong> turns the AI Act into a de facto global standard. For international companies, globally minded startups or non-EU technology providers, ignoring this dimension may represent a significant legal risk.<\/p>\n The true impact of the AI Act does not lie in generic chatbots, but in high-risk AI systems<\/strong>.<\/p>\n Primarily, systems listed in Annex III<\/strong>, used in areas such as:<\/p>\n Biometrics<\/p>\n<\/li>\n Critical infrastructure<\/p>\n<\/li>\n Education and vocational training<\/p>\n<\/li>\n Employment and human resources<\/p>\n<\/li>\n Access to essential services (credit, insurance, housing)<\/p>\n<\/li>\n Justice and administrative processes<\/p>\n<\/li>\n Migration and border control<\/p>\n<\/li>\n<\/ul>\n Many companies already use such tools without labelling them as \u2018high-risk AI\u2019, including:<\/p>\n Automated CV screening<\/p>\n<\/li>\n Internal scoring systems<\/p>\n<\/li>\n Performance evaluation tools<\/p>\n<\/li>\n Customer or user prioritisation systems<\/p>\n<\/li>\n Fraud detection tools<\/p>\n<\/li>\n<\/ul>\n In 2026, these uses will no longer be experimental<\/strong>.<\/p>\n From August 2026, providers must have in place:<\/p>\n A formal risk management system<\/p>\n<\/li>\n Guarantees on data quality and representativeness<\/p>\n<\/li>\n Traceable technical documentation<\/p>\n<\/li>\n Human oversight measures<\/p>\n<\/li>\n Cybersecurity and robustness safeguards<\/p>\n<\/li>\n Post-market monitoring<\/p>\n<\/li>\n In many cases, conformity assessment by a notified body<\/p>\n<\/li>\n CE marking as a high-risk AI system<\/p>\n<\/li>\n Registration in the EU AI database<\/p>\n<\/li>\n<\/ul>\n These are legal obligations<\/strong>, not optional best practices.<\/p>\n This is the blind spot for many organisations.<\/p>\n From 2026, companies using high-risk AI must:<\/p>\n Use the system in accordance with the provider\u2019s instructions<\/p>\n<\/li>\n Ensure effective human oversight<\/p>\n<\/li>\n Guarantee the adequacy of input data<\/p>\n<\/li>\n Monitor system performance<\/p>\n<\/li>\n Suspend use where serious risks are detected<\/p>\n<\/li>\n Report incidents to the provider and the competent authority<\/p>\n<\/li>\n<\/ul>\n In practice, this requires internal AI governance<\/strong>, not simply purchasing a tool and letting it run.<\/p>\n Unlike some Member States, Spain has not adopted a wait-and-see approach to the AI Act. Its strategy has been clearly anticipatory, with direct consequences for businesses.<\/p>\n Since 2024, the Agencia Espa\u00f1ola de Supervisi\u00f3n de la Inteligencia Artificial<\/span><\/span> (AESIA)<\/strong> has been fully operational. Its role goes beyond enforcement; at this early stage, the focus has been on identifying problematic practices, guiding operators and developing interpretative criteria ahead of full enforceability.<\/p>\n This has materialised, among other initiatives, in the launch of a national regulatory sandbox involving real-world projects in particularly sensitive AI Act areas such as employment, biometrics and financial services.<\/p>\n This is complemented by increasing coordination with other authorities, including the Agencia Espa\u00f1ola de Protecci\u00f3n de Datos<\/span><\/span> (AEPD)<\/strong> and the Comisi\u00f3n Nacional de los Mercados y la Competencia<\/span><\/span> (CNMC)<\/strong>, reinforcing a cross-cutting supervisory approach that links AI with data protection, competition, consumer law and fundamental rights.<\/p>\n In parallel, Spain\u2019s forthcoming national AI legislation is expected to align fully with the AI Act\u2019s sanctions regime, with fines of up to \u20ac35 million or 7% of global annual turnover<\/strong> for the most serious infringements.<\/p>\n The message is clear: Spain is positioning itself as one of the first environments where AI Act compliance will be closely scrutinised<\/strong>. For companies operating here \u2014 or whose AI systems impact the Spanish market \u2014 early action and specialised advice represent a strategic advantage, not a cost.<\/p>\n From a practical perspective, several lines of action should be addressed without delay.<\/p>\n First, companies need a clear overview of their actual AI uses<\/strong>, both internal and external. Many obligations arise from tools embedded in HR, data analysis, marketing or customer service processes that are often overlooked.<\/p>\n Second, these uses must be classified by risk level<\/strong>. Identifying which systems may qualify as high-risk under the AI Act is essential to understanding which obligations will apply from August 2026.<\/p>\n Next, relationships with AI providers should be reviewed. The Regulation introduces contractual implications relating to documentation access, usage instructions, allocation of responsibilities, incident notification mechanisms and system withdrawal in the event of serious risks.<\/p>\n Internal governance is another key pillar. The AI Act assumes that organisations have clearly designated oversight responsibilities<\/strong>, with real authority to intervene, suspend or correct AI systems. This connects directly with compliance, technology, HR and senior management.<\/p>\n Finally, AI use requires ongoing monitoring and response procedures<\/strong>. Compliance is not a one-off exercise, but a continuous process of detecting deviations, incidents or unforeseen impacts and responding with speed and traceability.<\/p>\n All of this leads to a central conclusion: the AI Act is not merely a technical regulation<\/strong>. It is a strategic decision about how a company integrates artificial intelligence into its business model without assuming unnecessary legal, reputational or economic risks<\/strong>.<\/p>\n","protected":false},"excerpt":{"rendered":" For months, many companies have felt reassured by the timetable […]<\/p>\n","protected":false},"author":2,"featured_media":16134,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[225,64,63],"tags":[358,418,273,415],"class_list":["post-16575","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-new-technologies","category-legal","category-startups","tag-artificial-intelligence-act","tag-eu-regulation","tag-european-union","tag-ia-act"],"yoast_head":"\nThe AI Act in plain terms, without unnecessary jargon<\/strong><\/h2>\n
\n
The real timetable: why waiting until 2027 is a mistake<\/strong><\/h2>\n
February 2025<\/strong><\/h3>\n
\n
August 2025<\/strong><\/h3>\n
\n
August 2026 \u2013 the critical moment<\/strong><\/h3>\n
August 2027<\/strong><\/h3>\n
Who does the AI Act really affect?<\/strong><\/h2>\n
\n
\n
The real issue: high-risk AI<\/strong><\/h2>\n
What qualifies as high-risk AI?<\/strong><\/h3>\n
\n
\n
What does the AI Act require from 2026 onwards?<\/strong><\/h2>\n
For high-risk AI providers<\/strong><\/h3>\n
\n
For user companies (deployers)<\/strong><\/h3>\n
\n
Spain as a regulatory testing ground: why the AI Act will be felt earlier here<\/strong><\/h2>\n
So\u2026 what should companies be doing now?<\/strong><\/h2>\n