The EU AI Act is the first comprehensive law on artificial intelligence. For most Austrian companies that use AI tools — rather than build high-risk systems — the obligations are manageable. But the rules have changed since they were first adopted: in 2026 the EU passed an amendment, the "Digital Omnibus on AI" (Regulation (EU) 2026/1744), which postponed several deadlines.
Note: this article is a practical overview, not legal advice. Check the current text on EUR-Lex or ask a lawyer for your specific case.
The timeline at a glance
- 1 August 2024 — the AI Act entered into force.
- 2 February 2025 — bans on prohibited AI practices apply, as does the AI literacy duty (Article 4).
- 2 August 2025 — rules for general-purpose AI models (the large models behind tools like ChatGPT) apply to their providers.
- 2 August 2026 — transparency duties under Article 50 apply, for example making clear when people interact with an AI or see AI-generated content. Systems already on the market get until 2 December 2026 for machine-readable labelling of AI-generated content.
- 2 December 2027 — obligations for stand-alone high-risk systems (Annex III, such as AI used in recruitment, credit scoring or education). This was originally 2 August 2026.
- 2 August 2028 — high-risk AI built into regulated products such as machinery or medical devices (Annex I). Originally 2 August 2027.
What this means for a typical SME
Most companies use AI for writing, research, customer service, automation or analysis. That is usually not high-risk under the AI Act. In practice three topics matter most:
1. AI literacy (Article 4)
Companies that use AI must take measures to build the AI skills of the staff who work with it. The 2026 amendment rewrote this article: it is now an obligation to take appropriate measures, not to guarantee a particular level of knowledge — and the Commission and member states are tasked with supporting smaller companies. Sensible steps:
- An internal guideline on which AI tools may be used for what
- A short training for everyone who uses AI at work
- Clear rules on personal data and business secrets in AI tools
2. Transparency
If customers chat with an AI assistant on your website, or you publish AI-generated images or text that could be mistaken for real, people need to be able to tell. These duties have applied since 2 August 2026, so check now which of your touchpoints are affected.
3. Know when you are in high-risk territory
If you use AI to screen job applicants, assess creditworthiness or make decisions in education or access to essential services, you are likely dealing with a high-risk use case. The extra time until December 2027 is a chance to prepare properly — not a reason to wait.
Where to get help in Austria
The KI-Servicestelle at RTR (the Austrian regulator for broadcasting and telecoms) informs companies about the AI Act and has published guidance on AI literacy. The WKO also offers information and example AI guidelines for SMEs.
How we handle it in projects
In every project we document which data goes where, keep a human in the loop for anything customer-facing, and train the people who will use the system — which also covers the AI literacy duty in practice.
Want a quick check of where your company stands? Book a free 30-minute call.