Skip to content
Auf Deutsch ansehen

AI · AI at work

The EU AI Act in November 2026: What changes on 2 December

Who explains a chatbot, who labels a deepfake, and which older systems face the December deadline? A practical guide to assigning AI Act duties at work.

By Boaz Lichtenstein Prefer us on Google

Article image: The EU AI Act in November 2026: What changes on 2 December
In this article
  1. Which date applies to your use case?
  2. Three questions before you sign off
  3. What AI literacy looks like in practice
  4. Who can produce the evidence?

Reviewed on 4 November 2026. A retailer buying a customer-service chatbot and the company supplying that system have different duties. That distinction matters ahead of 2 December. The transition period concerns a technical requirement for certain providers. It does not postpone information that people should already receive when they open a chat.

Which date applies to your use case?

Date Who is affected What to check
Since 2 August 2026 Providers and deployers of certain AI systems Article 50 transparency rules apply. The required information or technical marking depends on what the system does and who is using it.
2 December 2026 Providers of systems that generate synthetic text, images, audio or video and were placed on the market before 2 August 2026 The transition period under Article 50(2) ends. These existing systems must also meet the applicable machine-readable marking requirement.
2 December 2026 Systems covered by the new prohibitions under Article 5 The prohibitions concerning certain systems for generating non-consensual intimate material or child sexual abuse material become applicable. The amendment sets out the precise conditions and exceptions.
2 December 2027 High-risk systems under Article 6(2) and Annex III The relevant sections of Chapter III apply to uses such as certain recruitment systems. Check the intended purpose and any applicable exceptions.
2 August 2028 High-risk systems under Article 6(1) and Annex I The corresponding requirements apply to covered products and safety components. Classification also depends on the relevant product legislation.

The dates come from the regulation as amended in July. The Commission has also published guidelines on the transparency obligations. Consolidated AI Act · Digital Omnibus on AI · Article 50 guidelines

Three questions before you sign off

What does the customer see at first contact? A provider must design a system that interacts directly with people so they are informed they are dealing with AI. An exception applies if that is already obvious under the conditions set out in the law. Open the actual support chat, including on a phone. A clear notice at the top reaches the customer before they describe their problem.

What survives in the file? Providers of systems generating synthetic content must implement applicable technical marking and enable detection. There are exceptions for standard editing assistance and changes that do not substantially alter the input or its meaning. Ask an image provider for an original file from the production system. Find out which markings survive the export you use. A disclosure on the product page and a machine-readable mark in the file serve different purposes. EU code on marking and labelling

What do you publish yourself? A deployer using a deepfake generally has to disclose its artificial origin. Artistic and satirical works have specific disclosure arrangements. For text on matters of public interest, human review and editorial responsibility also matter. Record who checked and approved the piece. The exception for reviewed text does not automatically extend to an image or a voice recording.

What AI literacy looks like in practice

Article 4 requires measures to support AI literacy. A support team reviewing suggested replies needs different skills from a recruitment team screening candidates. Give the support team a plausible but invented returns policy. Can they find the mistake in the approved policy and correct the reply before it goes out? Record who practised and who handles uncertain cases. Experience, people affected and the setting all shape what is appropriate. Commission questions and answers on AI literacy

Who can produce the evidence?

For each use, start with its purpose, the people affected, your role, a named owner and a piece of evidence someone else can inspect. For a chatbot that could be the first screen. For a synthetic video, keep the version actually published. If buying a potentially high-risk system, ask the supplier to explain its classification and provide the relevant documentation. The deployer needs to decide who oversees its operation and who can intervene. The provider ordinarily handles conformity assessment. A substantial modification or sale under your own name can change that division of responsibilities.

Germany’s Federal Network Agency provides a central complaints service. Assessing a specific product or deployment calls for its precise intended use. Federal Network Agency complaints service · A practical guide to AI adoption at work

FAQ

Frequently asked questions

Does our company have to buy a specific AI training course?

Article 4 requires providers and deployers to take measures to support AI literacy. Choose measures that suit the work, the people affected and the team's experience. The law does not prescribe a course or certificate or require you to guarantee each individual's level of proficiency.

What changes on 2 December 2026?

The transition period for technical marking ends for providers of certain systems that generate synthetic content and were on the market before 2 August 2026. The new prohibitions covering certain systems for non-consensual intimate material and child sexual abuse material also start to apply.

Must editors label every piece of AI-assisted writing?

For text, Article 50(4) addresses publication intended to inform the public about matters of public interest. It makes an exception where the content has undergone human review or editorial control and a person or organisation holds editorial responsibility for the publication.

Where can someone report a suspected breach in Germany?

The Federal Network Agency has a central complaints service. Identify the provider, the function, the date and what happened. Include an example that does not expose unnecessary personal information. The competent authority may depend on the sector.

On this learning path

Running agentsStation 6 of 7

Next station

Adopting AI at work: From a pilot to a service you can run

You set up a pilot so that its result supports a decision – even if that decision is “stop”.

12 minArticle