This regulatory framework establishes clear rules for the development and implementation of AI systems and seeks to build trust among citizens, consumers and businesses. But beyond the statement of intent, it imposes specific deadlines and penalties that companies need to know about now.
The deadlines every company should have in its calendar
The application of the AI Act is phased. These are the main milestones, according to the European Commission:
Since 2 February 2025, the prohibitions on AI practices posing an unacceptable risk have applied, together with the AI literacy obligation for all staff who use AI systems (Article 4 of the Regulation). Since 2 August 2025, the governance rules and the obligations for general-purpose AI (GPAI) models have applied. 2 August 2026 is the date of full application for most obligations, including those for the high-risk systems in Annex III. High-risk systems embedded in products covered by sector-specific legislation have an extended period until 2 August 2027.
The four risk levels in the AI Act
The core of the Regulation is the classification of AI systems according to their level of risk:
Minimal or no risk. The vast majority of AI systems. They have no specific obligations under the Regulation, although they may voluntarily adopt codes of conduct. Examples: content recommendation systems, spam filters.
Limited risk. Transparency is required: users must know that they are interacting with an AI system. Examples: commercial chatbots, virtual assistants, synthetic content generators.
High risk. These require strict assessments before being put into service: training data management, explainability, governance, human oversight, traceability and record-keeping. Examples: AI used in recruitment processes, credit scoring, medical or safety systems, management of critical infrastructure.
Unacceptable risk. Prohibited in the European Union since 2 February 2025. Examples: cognitive manipulation systems, indiscriminate mass biometric surveillance in public spaces (with very narrow exceptions for law enforcement), social scoring.
What obligations the AI Act brings for companies
The obligations vary according to the level of risk, but the most relevant requirements for high-risk systems include:
Data governance. Use of quality, representative datasets free from unjustified bias.
Human oversight. High-risk systems cannot operate fully autonomously without effective control mechanisms exercised by people.
Documentation and traceability. Recording of decisions, processes, data sources and operating logs.
Transparency. Informing people when they are interacting with an AI system, and labelling artificially generated content (images, audio, video).
AI literacy (Article 4). An obligation in force since February 2025: every company that uses AI systems must ensure that its staff have a sufficient level of training to operate them safely.
Safety and compliance. Systems must not pose threats to fundamental rights or to people's safety.
In practice, this means that companies must adapt internal processes, appoint people responsible for AI and apply technical and organisational controls in order to comply with the regulation before 2 August 2026.
Penalties for non-compliance
The AI Act's penalty regime is even more severe than that of the GDPR. According to Article 99 of the Regulation:
The use of prohibited AI practices can result in fines of up to 35 million euros or 7% of total worldwide annual turnover, whichever is higher. Non-compliance with obligations relating to high-risk systems can lead to fines of up to 15 million euros or 3% of turnover. Supplying incorrect or misleading information to the authorities is punishable by up to 7.5 million euros or 1%.
Penalties for SMEs are proportionate, but there is no full exemption. Furthermore, where the same infringement also falls under the GDPR, the fines under both regulations can be cumulative.
In Spain, the body responsible for supervising compliance is the Spanish Agency for the Supervision of Artificial Intelligence (AESIA), based in A Coruña and created by Royal Decree 729/2023.
From obligation to competitive advantage
Although it may seem like a regulatory burden, the AI Act also represents a strategic opportunity. Companies that take a proactive approach can turn regulation into a differentiating factor:
Customer and user trust. Compliant solutions generate more credibility and reduce reputational risk.
Access to new markets. The European standard is being watched by regulators around the world. Complying with the AI Act opens doors in markets that will adopt similar frameworks.
Internal efficiency. The requirement for traceability and governance helps companies improve data management and reduce legal and operational risks.
Responsible innovation. Regulation encourages projects that combine powerful AI with safety and ethics, creating more sustainable and competitive products.
How to prepare before 2 August 2026
The date is imminent. These are the most urgent actions for organisations:
- Take an inventory of current AI use in the company and classify each system according to the Regulation's risk levels.
- Ensure staff AI literacy, documenting the training carried out. This obligation has been in force since February 2025.
- Define a governance framework with a clear owner for the oversight of AI systems.
- Audit the data and sources used to train or feed the models, especially if they operate in high-risk categories.
- Ensure the traceability and documentation of decisions and automated processes.
- Review technology suppliers and partners, verifying that the systems you acquire or integrate meet the Regulation's requirements. The deployer has its own obligations even if the provider declares conformity.
At LurNova we help you turn the challenge into an opportunity
At LurNova we support companies in adapting to the AI Act, integrating AI solutions that are secure, transparent and aligned with the regulation. Our goal is for your organisation not only to comply with the law before 2 August 2026, but to use the regulation as a seal of trust and responsible innovation.
Because the future of artificial intelligence in Europe will be measured not only by the power of the models, but by the security, traceability and trust they are able to generate.
CEO of LurNova, with extensive experience in technology and digital transformation. Involved in developing technology projects and applying artificial intelligence in organisations, he combines technical knowledge with business vision.
