EU AI Act 2026 for listed companies

The EU’s regulation on artificial intelligence has been rolled out in stages since it entered into force on 1 August 2024. The latest stage, the transparency requirements for AI that generates text, images, audio and video, began to apply on 2 August 2026 and is the one that affects the most companies in practice. Which requirements apply to a company depends on how risky its use of AI is and what role the company plays in relation to it. In this article, we go through the regulation’s four risk levels, who is covered, and which rules apply now and which will apply later.

Risk levels determine who is covered

The AI Act is built on the principle that the greater the harm an AI system can cause, the stricter the rules it should be subject to. All AI systems are therefore divided into four risk levels, from prohibited to essentially unregulated. The level is determined by what the system is used for. The same AI tool can, however, end up at different levels depending on how it is used. For example, the same system could write product copy and also process applications and select suitable candidates for a position within the company. For a company, the first step is to establish which level each type of AI use falls into.

Unacceptable risk: prohibited

AI that threatens people’s safety, rights or livelihoods is prohibited in the EU. This includes, among other things, manipulation of people’s behaviour, social scoring and emotion recognition in workplaces and schools. For a listed company, this could be a tool that analyses employees’ facial expressions in video meetings to measure engagement, or a consumer app that uses AI to exploit customers’ vulnerabilities. In summer 2026, the EU also added prohibitions on creating intimate material without consent and several further points linked to sexual offences. The new prohibitions take effect on 2 December 2026.

High risk: extensive requirements

High-risk AI systems, for example those used to diagnose diseases, in self-driving vehicles or for biometric identification, must meet strict requirements before they can be placed on the European market. The requirements include rigorous testing, transparency and human oversight. In a listed company, it might instead be AI that sorts CVs during recruitment, a bank that lets AI assess individuals’ creditworthiness, or a medtech company with AI built into its products. The requirements apply from 2 December 2027, and for AI in regulated products from 2 August 2028.

Limited risk: transparency requirements

Limited-risk AI, such as chatbots and AI that generates content, is subject to transparency requirements. Users must be told that content is AI-generated, so that they can make informed decisions about how to use it. One exception is AI-generated text that has been carefully reviewed by an editor who takes responsibility for its publication; it does not need to be labelled. For a listed company, the requirements apply to, for example, an AI chatbot on the investor relations website that answers questions about reporting dates and dividends, AI-generated images in the annual report, or an AI-created video in which the CEO appears to speak. The requirements have applied since 2 August 2026.

Minimal risk: no specific requirements

Most AI systems pose no risk. AI in video games or spam filters can be used freely without specific requirements. In a listed company, examples include a tool that sorts incoming investor enquiries, AI that helps the finance department reconcile invoices, or a writing assistant that produces internal drafts. The only requirement is that the company works to ensure that staff understand the AI tools they use.

Good to know

The levels are not mutually exclusive. The transparency requirements apply regardless of risk class, so even a simple IR chatbot must disclose that it is an AI. The large AI models behind today’s AI assistants are also regulated separately. Models without systemic risk have limited requirements, for example on transparency, while models with systemic risk must follow stricter rules. The risk level shows which rules apply to a particular use of AI. Who must comply with them is determined by the company’s role.

Responsibility is distributed via roles

Each risk level allocates responsibility differently across five defined roles.

• Provider: develops an AI system, or has it developed, and places it on the market under its own name or trademark.

• Deployer: uses an AI system in the course of its professional activities.

• Importer: brings AI systems into the EU from non-EU countries.

• Distributor: resells AI systems without being the provider or importer.

• Authorised representative: handles a non-EU provider’s obligations within the EU.

The prohibitions apply to all roles, since no one may place prohibited AI on the market or use it. For high risk, the burden lies with the provider, which must build in the requirements before the system is sold, while the deployer is responsible for how the system is used. The transparency requirements at the second-lowest level are split. The provider ensures that a chatbot discloses that it is an AI and that AI-generated content is marked in a machine-readable format. The deployer must disclose AI-generated content and AI text on matters of public interest. For minimal risk, there are no specific requirements for any role, other than that both providers and deployers must promote AI literacy among their staff.

For most listed companies, it is the difference between the first two roles that matters. A company that buys a ready-made AI service is a deployer, while the company that developed the service is the provider. What the roles mean in practice, and when a company can change role, is covered later in the article.

What applies now

The AI Act has more than a hundred articles, but most of them are not aimed at ordinary listed companies that use AI in their operations in one way or another. Instead, the regulation is aimed at those who develop the large AI models and at the authorities of the EU and its Member States, describing how supervision is to be organised. That leaves eight articles that are important for listed companies to know about, four of which already apply. The other four concern high-risk systems and apply from December 2027 onwards.

The four that apply now are presented below, but in short they can be summarised as follows: Article 4 requires the company to work to ensure that staff understand the AI tools they use. Article 5 sets out which AI is prohibited. Article 50 contains the transparency requirements, and Article 99 sets out the penalties if the requirements are not met.

Article 4: AI literacy

All companies that use AI in their operations must work to ensure that staff understand the tools they use. The level of knowledge should be adapted to what the person already knows and the context in which the AI tools are used. The requirement applies regardless of risk level, but the company does not need to guarantee that every employee reaches a particular level. In practice, internal training and simple documentation of what has been done is usually sufficient.

Article 5: prohibited AI

The prohibitions on manipulative AI, social scoring and emotion recognition in the workplace, among others, already apply. Few listed companies are affected, but it is worth checking that no tools in the business do any of these things. In summer 2026, a further prohibition was added to Article 5: the previously mentioned ban on AI that creates material linked to sexual offences, which applies from 2 December 2026.

Article 50: transparency requirements

Article 50 is the part of the regulation that affects the most listed companies today. The requirements are divided between whoever makes the AI tool and whoever uses it:

·       Chatbots on the website (50.1). Anyone using an AI chatbot, for example on the investor relations website, must be told that they are talking to an AI, unless this is already obvious.

·       Machine-readable marking (50.2). AI-generated text, images, audio and video must be marked so that it can be detected as AI-generated, for example with a watermark or metadata. The requirement is aimed at the tool provider, not at the company. Generative tools that were on the market before 2 August 2026 have until 2 December 2026 to comply. Simple editing, such as spell-checking, is not covered.

·       Deepfakes (50.4). AI images, audio and video that depict real people, places or events and could be perceived as authentic must be labelled by the company that publishes them. If the content is evidently artistic or satirical, a discreet disclosure is sufficient.

·       AI text (50.4). AI-generated text published to inform the public on matters of public interest must be labelled. This does not apply if an editor has reviewed the text and the company or a person holds editorial responsibility.

·       How disclosure is given (50.5). The disclosure must be clear, be given no later than when the reader or user first encounters the content, and work for people who, for example, use screen readers.

·       Emotion recognition (50.3). Anyone who uses AI to interpret people’s emotions or categorise them based on biometric data must inform the people concerned. This is rarely relevant for listed companies.

The purpose of Article 50 is that anyone who interacts with the company’s AI, or with material created using AI, should not be misled by the material or the conversation. The company needs to keep track of where its use of AI is visible externally, for example a chatbot on the website, AI-generated images and videos, or texts produced with AI support. A chatbot needs a clear disclosure as soon as it is opened, for example by being called an “AI assistant”. For texts, it is sufficient that a designated person reviews and approves them before publication, and that this review can be demonstrated afterwards.

Images and videos that depict real people or events and could be perceived as authentic need a visible label close to the content, for example a caption. It is not enough for the label to exist only in the file’s metadata. Other AI images, such as illustrations or stylised cover images, do not need a visible label. For these, it is sufficient that the tool has marked the image in a machine-readable way. It is also wise to check that the AI tools the company uses mark their content. Such marking is sometimes lost when images are uploaded to a publishing system.

Article 99: penalties

Article 99 sets out the maximum fines a company can face if it breaches the regulation. The fines are divided into three tiers according to the seriousness of the infringement. For a listed company that uses AI in its communications, it is mainly the middle tier that is relevant, as it covers the transparency requirements.

The amounts are ceilings. For most large companies, the higher of the fixed amount and the percentage is expected to apply, while for small and medium-sized enterprises the fines may be lower. When determining the fine, the authority takes into account, among other things, the seriousness of the infringement, its duration and how well the company cooperates.

What will apply in the future

In addition to the requirements that already apply, there are rules that will start to apply in the coming years. They concern high-risk systems, the risk level with the most extensive requirements. For most listed companies this is not urgent, but an AI system bought or built today may still be in operation when the rules take effect.

Article 6: high-risk systems

Article 6 refers to two annexes that determine whether an AI system is high-risk. A system can become high-risk in two ways:

• Annex I: AI in regulated products. AI that is a safety component of, or is itself, a product already covered by EU product safety legislation and required to undergo third-party assessment, for example medical devices, machinery or lifts.

• Annex III: AI in sensitive areas. AI used in areas where decisions can affect people’s lives and rights. These include recruitment and personnel decisions, credit assessment of individuals, pricing of life and health insurance, education and critical infrastructure.

For a listed company, this could be a tool that ranks job applicants, a bank that lets AI decide who gets a loan, or a medtech company with AI in its products. A system in an Annex III area may nevertheless be exempted if it only performs a narrow or preparatory task and does not influence the outcome of the decision. The exemption never applies to systems that profile individuals, and anyone relying on the exemption must document their assessment. The requirements apply from 2 December 2027 for Annex III and from 2 August 2028 for Annex I.

Articles 16 and 26: obligations for high-risk systems

With high-risk systems, the difference between the roles is at its clearest. The provider is the company that develops the AI system and sells it under its own name, for example a software company selling a recruitment tool. Under Article 16, the provider must ensure that the system meets the requirements before it is placed on the market. This includes:

• having a system for managing risks throughout the system’s lifecycle

• ensuring that the data the system has been trained on is relevant and sufficiently representative

• producing technical documentation and instructions for use

• building in logging and the capability for human oversight

• having a quality management system

• undergoing a conformity assessment, affixing the CE marking and registering the system in the EU database

The deployer is the company that purchases the system and uses it in its operations, for example a listed company that has the recruitment tool sort its job applications. Under Article 26, the deployer is responsible for how the system is used. Among other things, the company must:

• use the system in accordance with the provider’s instructions for use

• assign staff with the necessary competence and authority to oversee the system

• ensure that the data the company itself inputs is relevant to the intended purpose

• retain the system’s logs for at least six months

• inform employees before the system is put into use in the workplace

• inform the people affected by decisions the system contributes to

• contact the provider and the market surveillance authority if the system gives rise to risks or serious incidents

Article 25: when a company becomes a provider

The roles are not fixed, however. Under Article 25, a deployer is considered a provider, and takes over the full provider responsibility, if the company:

• puts its own name or trademark on a high-risk system developed by someone else

• makes a substantial modification to a high-risk system such that it remains high-risk

• uses an AI system for a new purpose that makes it high-risk, for example a general AI assistant that starts being used to assess job applicants or creditworthiness

The rule only applies to high-risk systems. A company that puts its brand on an ordinary IR chatbot does not become a provider in this sense. The original developer of the system is no longer considered the provider of the modified version, but must assist the new provider with information and documentation. The role is determined by what the company actually does, so a contract stating otherwise does not change the role in the eyes of the supervisory authority. It is therefore worth clarifying roles as early as when an AI system is purchased or built, even if the requirements only take effect in a few years.

How to prepare for the requirements

The transparency requirements already apply, and the high-risk requirements are approaching. Below, we list five actions listed companies should take today:

• Map where AI is used. Review the business, with particular focus on material that becomes public: chatbots, images, video and texts.

• Determine the role for each use. Establish whether the company is a provider or a deployer, and where responsibility lies in the contracts. Pay extra attention if a high-risk system is launched under the company’s own name or used for a new purpose.

• Set up routines for labelling and review. Ensure that chatbots disclose that they are AI, that AI-generated material is clearly labelled and that AI-assisted texts are reviewed and approved by a designated person.

• Check the tools. Make sure that the AI tools mark their content and that the marking is retained all the way through to publication.

• Document AI literacy. Train staff in the tools they use and keep simple documentation of what has been done.

For most listed companies, the AI Act today mainly concerns how AI is used in communications, for example in chatbots, images and texts. Companies that clarify roles and routines now will also be better prepared when the high-risk requirements take effect.

AVA Corporate Communications helps listed companies translate new regulations into concrete ways of working, from AI tools and advisory services to financial communications and IR. Contact us to discuss how we can support you in your work with the AI Act.