EU AI Act Readiness: A Practical Guide for Mid-Market Companies

The EU AI Act applies to your company if you provide or use AI systems in the EU, or if the output of an AI system you provide or use is used in the EU, even if you have no office there. For most mid-market companies the obligations that matter today are AI literacy and the banned practices, both in force since February 2025, and the transparency rules that apply from 2 August 2026. The heavier high-risk obligations now start on 2 December 2027 after the EU's Digital Omnibus pushed them back, so readiness means knowing what AI you use, what role you play for each system and which risk tier each one falls into.

This guide is for executives and boards of mid-market companies, including those outside Europe that sell into it, and reflects the law as at 30 October 2026.

This is general guidance, not legal advice. For decisions about a specific system, talk to a lawyer who works on the AI Act.

Does the EU AI Act apply to companies outside the EU?

Often, yes. Article 2 covers:

• Providers that place an AI system or general-purpose AI model on the EU market, or put one into service there, wherever they are established.
• Deployers of AI systems that are established or located in the EU.
• Providers and deployers outside the EU where the output of the AI system is used in the EU.
• Importers and distributors that bring AI systems into the EU market.

So a US or Australian software company with an AI feature used by European customers is in scope as a provider. Non-EU providers of high-risk systems must also appoint an authorised representative in the EU.

Provider or deployer: which one are you?

A provider develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority in a professional context. You can hold different roles for different systems.

Most mid-market companies are deployers for most of their AI, such as the AI features in their CRM or HR platform. If you ship AI features in your own product, you are very likely the provider of that system, even when it is built on someone else's model. Article 25 also makes you the provider of a high-risk system if you put your name on it, substantially modify it, or repurpose a system so that it becomes high-risk, such as using a general tool to screen job applicants.

What are the risk tiers in the EU AI Act?

The Act sorts AI by how it is used, not by the technology, into four tiers: unacceptable risk (banned), high risk (sensitive uses such as hiring or credit decisions, with the heaviest obligations), transparency risk (chatbots and synthetic content, which must be disclosed) and minimal risk (everything else, with no new obligations beyond AI literacy).

Which AI practices are prohibited?

Since 2 February 2025, the Act has banned AI systems that:

• Manipulate people or exploit vulnerabilities such as age or disability in ways that cause significant harm.
• Score people on social behaviour or personal traits, leading to unjustified detrimental treatment.
• Predict individual criminality based solely on profiling or personality traits.
• Build facial recognition databases by untargeted scraping of images.
• Infer the emotions of people in the workplace or in education, except for medical or safety reasons.
• Use biometric data to infer sensitive traits such as race, religion, political opinions or sexual orientation.
• Use real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.

The Digital Omnibus adds bans on AI that generates non-consensual intimate imagery of identifiable people or child sexual abuse material. For a typical mid-market company, the ban most likely to bite is emotion recognition at work: any tool that claims to read the emotions of employees or job candidates deserves a close look.

What does the AI literacy obligation mean in practice?

Article 4 has applied since 2 February 2025 to every provider and deployer, whatever the risk tier. The Digital Omnibus reworded it: providers and deployers must take measures to support the development of AI literacy among staff and others who operate or use AI on their behalf, and the text now makes clear this does not require a specific level for any individual.

Softer wording is not the same as no obligation, and stricter training duties still apply to people overseeing high-risk systems.

What do the general-purpose AI rules mean if you build on someone else's model?

Providers of general-purpose AI models, the large foundation models behind most AI products, must keep technical documentation, give downstream providers the information they need, maintain a copyright policy and publish a summary of training content. Most mid-market companies are downstream: collect the documentation your model provider makes available, and remember that a chatbot or content generator you build on top brings transparency duties of your own.

Which transparency rules apply from 2 August 2026?

• Chatbots and other interactive AI must tell people they are dealing with AI, unless it is obvious.
• Providers of generative AI must mark synthetic audio, images, video and text in a machine-readable way.
• Deployers of emotion recognition or biometric categorisation must inform the people exposed to it.
• Deployers of deepfakes, and of AI-generated text published to inform the public on matters of public interest, must disclose it, with an exception for text under human editorial responsibility.

What counts as high-risk AI, and what does it require?

There are two routes into high risk: AI used as a safety component of products already regulated under EU law (Annex I, such as medical devices or toys), and the use cases listed in Annex III. The Annex III uses that matter most for mid-market companies are:

• Employment: recruitment, CV filtering, decisions on promotion or termination, task allocation and performance monitoring.
• Access to essential services: credit scoring of individuals, and risk assessment and pricing for life and health insurance.
• Education and vocational training: admissions, assessment and proctoring.

An Annex III system is not high-risk if it poses no significant risk of harm, for example because it performs a narrow procedural task. That exception never applies to systems that profile individuals, and a provider relying on it must document its assessment.

Providers of high-risk systems need risk management, data governance, technical documentation, logging, human oversight, a quality management system, conformity assessment, CE marking, EU database registration and post-market monitoring.

Deployers must follow the provider's instructions, assign competent human oversight, keep logs for at least six months, report risks, and inform workers before using a high-risk system at work. Deployers using AI for credit scoring or life and health insurance pricing, among others, must also complete a fundamental rights impact assessment.

EU AI Act timeline: what is in force, scheduled and proposed

Already in force

• 1 August 2024: the AI Act entered into force.
• 2 February 2025: AI literacy and prohibited practices apply.
• 2 August 2025: general-purpose AI model obligations apply.
• 2 August 2026: most remaining rules apply, including transparency, and the Commission can begin fining general-purpose AI model providers. National penalties, including for the prohibited practices, have applied since 2 August 2025.
• Digital Omnibus on AI: adopted as Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and now in force.

Scheduled

• 2 December 2026: the Omnibus prohibitions apply, and generative AI systems already on the market before 2 August 2026 must meet the content-marking rule.
• 2 August 2027: general-purpose AI models placed on the market before 2 August 2025 must comply.
• 2 December 2027: high-risk obligations apply to Annex III systems. The original date was 2 August 2026.
• 2 August 2028: high-risk obligations apply to AI in Annex I regulated products.

Still draft or proposed

• The Commission's guidelines on classifying high-risk systems were published in draft in May 2026, with final guidelines expected by the end of 2026.
• A separate Digital Omnibus proposal covering GDPR, cookies and data rules was still going through the EU legislative process at the time of writing. It does not change the AI Act dates above.

The Omnibus deferred the high-risk obligations; it did not remove them. Treat the extra time as runway, not a reason to wait.

What are the penalties under the EU AI Act?

Fines are a fixed amount or a percentage of worldwide annual turnover, whichever is higher:

• Up to €35 million or 7% for prohibited practices.
• Up to €15 million or 3% for most other obligations, including those on providers, deployers and transparency.
• Up to €7.5 million or 1% for giving authorities incorrect or misleading information.

For SMEs, the lower figure applies. The Omnibus extends that to small mid-caps (broadly, non-SMEs with fewer than 750 staff and turnover up to €150 million) for the second and third bands.

How do you get ready for the EU AI Act? A step-by-step plan

1. Build an AI inventory

List every AI system you build, buy or use: product features, internal tools, AI features switched on inside SaaS platforms you already pay for, and tools staff use without approval. Record its owner, purpose, data and whether its output reaches the EU.

2. Classify each system and record your role

Check each against the prohibited list, then Annex III and Annex I, then the transparency rules. Mark whether you are provider, deployer or both, and check the Article 25 triggers. Write down your reasoning, especially where you conclude something is not high-risk.

3. Make AI literacy something you can evidence

Match training to the role (a developer needs something different from a recruiter using an AI screening tool), publish an acceptable use policy that says which tools are approved and with what data, and keep a record of who was trained and when.

4. Set up governance with a named owner

Give one executive accountability for AI risk, agree how new AI use is approved before it goes live, and report AI risk to the board as part of technology governance rather than as a one-off project.

5. Document as you go

Keep decisions, risk assessments, vendor documentation and incident records in one place. If you provide a high-risk system, start the technical documentation and quality management system now; December 2027 is closer than it looks.

6. Ask your vendors the right questions

• Do you consider yourself the provider of this system, and do you classify it as high-risk?
• What documentation and instructions for use will you give us as a deployer?
• Which general-purpose AI model is underneath, and what documentation does its provider supply?
• How will you tell us about serious incidents or model changes?
• Is our data used to train your models, and can we opt out?

Use ISO/IEC 42001 and NIST AI RMF as your operating framework

The Act sets the outcomes; two established frameworks help with the how. ISO/IEC 42001 is a certifiable standard for an AI management system, and will feel familiar if you already run ISO 27001. The NIST AI Risk Management Framework is voluntary and organised around four functions (Govern, Map, Measure and Manage), which suit the inventory, risk assessment and monitoring the Act expects. Neither makes you compliant alone, but both structure the evidence.

Where StackUp fits

StackUp's AI Maturity Assessment takes about thirty minutes and is free to start, with no credit card. Alongside an AI Maturity Score out of 100 and a separate AI Risk Rating, the free report gives readiness percentages against NIST AI RMF, the EU AI Act and ISO 42001. Premium opens each percentage up into a per-control gap analysis, so you can see which specific controls are behind the number. It is a baseline for planning, not a legal determination of your obligations.

If the inventory is where you are stuck, Discovery Agents run shadow IT and AI discovery by contacting staff directly. The AI Leadership Skills Assessment shows where your leaders' confidence in their AI judgement outruns their measured capability.

Readiness starts with a clear picture of what you already have. Run the free AI Maturity Assessment to get yours.