# The AI Act: what your company already has to comply with (and the deadline that moved) ![Visual representation of European artificial intelligence regulation applied to businesses](/_next/image?url=%2Fimages%2Fblog%2Fai-act-empresas.jpg&w=3840&q=75) If you've been hearing that "in August 2026 the AI Act comes into force and your company has to be compliant", I have two pieces of news for you. The first is that this deadline has, in practice, shifted. The second, and more important, is that there are AI Act obligations that have already applied to your company since 2025, and almost nobody in Portugal knows about them. Let's bring some order to this. No legalese, no scaremongering, but with the right facts, because on this topic the misinformation is as loud as the hype around AI itself. ## What the AI Act is, in two lines The AI Act is the European regulation that sets rules for the use of artificial intelligence in the European Union. It came into force in August 2024, but the obligations didn't all arrive at once, they were, and still are, phased in over several years. The core logic is simple: not all AI is equal, so not all of it is regulated the same way. The AI Act classifies systems by **level of risk** and demands more from those using more dangerous AI. ## The risk pyramid (and where your company probably sits) There are four tiers: **Unacceptable risk, banned.** Systems considered a clear threat to fundamental rights. For example, "social scoring" systems that rank citizens, behavioural manipulation that exploits people's vulnerabilities, or certain uses of biometric identification. They are simply prohibited. **High risk.** AI used in sensitive areas: recruitment and hiring, credit scoring, biometrics, education, critical infrastructure. It isn't banned, but it carries the heaviest obligations, technical documentation, human oversight, risk management, record-keeping. **Limited risk, transparency obligations.** This is where things like chatbots and AI-generated content sit. The essential rule: people must know they're interacting with an AI, or that a piece of content was generated by AI. **Minimal risk.** The overwhelming majority of everyday uses, spam filters, suggestions, simple internal automations. No specific obligations. The good news for most SMEs If you use AI for internal tasks, writing text, analysing spreadsheets, automating processes, handling customers with a clearly labelled chatbot, you're almost certainly in the **minimal or limited risk** tiers. The heavy "high risk" obligations are for specific cases, such as using AI to decide who you hire or who you grant credit to. ## What already applies to your company TODAY (and you didn't know) This is the part everyone ignores because they were fixated on the 2026 deadline. There are two obligations **in force since 2 February 2025**: **1\. The prohibited practices.** Unacceptable-risk systems can no longer be used. For most companies this isn't a problem, because they're not running "social scoring". But it's worth knowing the line exists. **2\. The AI literacy obligation (Article 4).** This is the genuinely surprising one. The AI Act requires **any organisation that uses AI**, regardless of risk level, to ensure that the people using it have a sufficient level of AI literacy. In other words: if your team uses ChatGPT, Copilot or any AI tool at work, you have a legal obligation to ensure those people understand what they're doing, the limits and the risks of the tool. You don't need a university course. "Sufficient literacy" is proportional to the use and the context. But it's a real obligation, already in force, that applies to virtually every company in Portugal that has touched AI. The cheapest and most ignored step The AI literacy obligation requires no technology and no investment. It requires training. An internal session explaining to your team what AI tools do, what they should never put into them (customer data, sensitive information) and how to review what AI produces is already a big step, and leaves a record that you've met Article 4. ## The August 2026 deadline that moved after all Here's the part that demands precision, because it's changing as I write. The most talked-about deadline was **2 August 2026**, the date on which the heavy obligations for **high-risk** systems (Annex III, such as AI in recruitment or credit) were due to start applying. Much of the scaremongering was built around this date. But through a package known as the **Digital Omnibus**, the European Union decided to postpone this deadline. A provisional agreement was reached on **7 May 2026** and the European Parliament formally endorsed it on **16 June 2026**. The result: the high-risk obligations for Annex III systems move from August 2026 to **2 December 2027**, roughly 16 months later. Watch the status of this postponement As of this article (June 2026), this postponement still **awaits formal adoption by the EU Council** and publication in the Official Journal, expected in July 2026. Until that is official and final, the original 2 August 2026 deadline is technically still on the table. If your company operates high-risk systems, confirm the current status before making decisions, don't take this postponement as guaranteed just because you read it on a blog. What this means in practice: most companies bought time. But buying time isn't the same as having nothing to do. It's the window to do things properly, instead of in a rush. ## What if my company only *uses* third-party AI tools? Good question, and it's the situation most are in. If you use ChatGPT, Gemini, Copilot or another tool, you're typically a **"deployer"** (professional user), not the "provider" (the one who builds the model). Most of the more technical obligations fall on those who develop the models, not on those who use them. The rules for general-purpose models (the GPAI models, like those behind ChatGPT) have already applied to their providers since **2 August 2025**. That's their problem. Your responsibility as a user is lighter, but not nil: team literacy, transparency when you expose AI to customers, and not using the tool for prohibited or high-risk purposes without meeting what applies. ## The fines are to be taken seriously The AI Act doesn't mess around on penalties. There are three tiers: - **Prohibited practices:** up to **€35 million or 7% of annual worldwide turnover**, whichever is higher. - **Other obligations** (high risk and transparency): up to **€15 million or 3%**. - **Misleading information to authorities:** up to **€7.5 million or 1%**. Before you panic: for SMEs and startups, the regulation provides for proportionality, the fine applied is the **lower** of the percentage and the fixed amount, not the higher. Even so, these are figures that justify taking the topic seriously rather than ignoring it. ## What to do now, without panic and without sky-high consultants The postponement gave you room. Use it wisely. Here's a realistic plan: **1\. Inventory the AI you use.** List the AI tools your company uses and what for. You can't comply with rules about something you don't even know exists. Half of companies discover, at this stage, tools being used by staff without anyone knowing. **2\. Sort out literacy, now.** It's the obligation in force, it's cheap and it delivers immediate results. Train your team in the basics: what AI does, the limits, what never to put into it. **3\. Check whether you have any "high-risk" use.** Do you use AI to filter job candidates? To decide on credit or insurance? For biometrics? If so, that's where the heavy obligations sit, and where you need to plan seriously towards December 2027. **4\. Ensure transparency.** If you have a customer-facing chatbot or generate content with AI, make sure it's clear that people are talking to (or seeing) something AI-generated. **5\. Cross-reference it with what you already do for GDPR.** Much of the discipline the AI Act demands, knowing what data you touch, documenting, having oversight, you should already have because of GDPR. Whoever has their data-protection house in order is halfway there. ## Where this stops being reading and starts needing hands For most SMEs, AI Act compliance is more a matter of organisation and training than of technology. But there are situations where you need real help: when you operate, or want to build, a high-risk system; when you embed AI into your products and have to ensure transparency and records; when AI processes personal data and the AI Act intersects with GDPR and, depending on the sector, with NIS2. That's where a partner like Sparksoft makes the difference. We don't sell you fear or a generic "compliance package". We look at what your company does with AI, see where you're genuinely exposed and where you're not, and help put the pieces in place, from the inventory to the technical implementation, with compliance designed in from the start rather than patched on at the end. ## The golden rule: the right information, not panic The AI Act sparked a wave of fear, much of it fuelled by those selling compliance solutions. The reality is calmer: for the overwhelming majority of Portuguese companies, complying with the AI Act is feasible, phased and, to a large extent, overlapping with practices they should already have. The real danger isn't the regulation. It's acting on bad information, whether panicking over a deadline that was actually postponed, or ignoring obligations that have been in force since 2025. The right path is in the middle: knowing exactly what applies to you, and dealing with it calmly. Consider this article your starting point with the right facts. #### Not sure where your company stands on the AI Act? We help companies understand, without scaremongering, which AI Act obligations genuinely apply to their case, sort out literacy and transparency, and implement AI in compliance with GDPR and NIS2. One conversation is enough to know where to start. [Talk to Sparksoft](/en/contact) ### Need help with your project? Sparksoft helps companies turn ideas into digital products. Let's talk about your next step. [Get in Touch](/en/contact) ### Related Articles [ ![Visual representation of artificial intelligence agents coordinating business tasks](/_next/image?url=%2Fimages%2Fblog%2Fagentes-ia-empresas.jpg&w=3840&q=75) ](/en/blog/agentes-ia-empresas-portugal) 11 June 2026·8 min read ### [AI agents: the next leap for businesses (and what changes in 2026)](/en/blog/agentes-ia-empresas-portugal) Chatbots answer. AI agents do. That's the difference that will separate the companies that gain time from those that keep losing it. [Artificial Intelligence](/en/blog/tag/artificial-intelligence)[AI Agents](/en/blog/tag/ai-agents) [Read more →](/en/blog/agentes-ia-empresas-portugal) [ ![Visual representation of artificial intelligence applied to a business context](/_next/image?url=%2Fimages%2Fblog%2Fia-pme-portugal.jpg&w=3840&q=75) ](/en/blog/inteligencia-artificial-pme-portugal) 16 April 2026·8 min read ### [AI for SMEs: how artificial intelligence is changing the game in Portugal](/en/blog/inteligencia-artificial-pme-portugal) Artificial intelligence isn't just for tech giants. Portuguese SMEs that adopt it now will have a huge advantage in the coming years. [Artificial Intelligence](/en/blog/tag/artificial-intelligence)[SMEs](/en/blog/tag/smes) [Read more →](/en/blog/inteligencia-artificial-pme-portugal) [ ![Illuminated electronic circuit representing cybersecurity and digital infrastructure](/_next/image?url=%2Fimages%2Fblog%2Fnis2-ciberseguranca.jpg&w=3840&q=75) ](/en/blog/nis2-ciberseguranca-portugal-o-que-muda) 24 March 2026·8 min read ### [NIS2 in Portugal: what changes for your company](/en/blog/nis2-ciberseguranca-portugal-o-que-muda) The new cybersecurity law comes into force on 3 April 2026. If you have more than 50 employees and operate in a critical sector, this is for you. [Cybersecurity](/en/blog/tag/cybersecurity)[NIS2](/en/blog/tag/nis2) [Read more →](/en/blog/nis2-ciberseguranca-portugal-o-que-muda)