The EU AI Act in Late 2026: What Applies Now, What Comes Next, and What Canadian Businesses Should Check

The EU's Artificial Intelligence Act, Regulation (EU) 2024/1689 is no longer a future concern. According to the European Commission, the AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions.

The main development of 2026 is that the EU has amended the Act's timeline. The amendment is not a proposal any more: Regulation (EU) 2026/1744, the Digital Omnibus on AI, is a Regulation of the European Parliament and of the Council of 8 July 2026, according to its EUR-Lex record. According to the European Commission, the amendments entered into force on 27 July 2026.

For Canadian companies that sell into the EU, serve EU customers, or produce AI output that is used in the EU, this post sets out what applies as of November 2026, what is scheduled next, and a checklist tied to the Articles of the Regulation. It is general information, not legal advice; confirm your own position with EU counsel.

Prohibited practices and AI literacy. According to the European Commission, prohibited AI practices and AI literacy obligations entered into application from 2 February 2025. Article 5 of the Regulation lists the prohibited AI practices.

AI literacy, as amended. The original Article 4 required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff. The Digital Omnibus on AI replaced that text: providers and deployers now shall take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. The amended Article 4 also states that the obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual. The obligation remains, so a documented training program is one practical way to show you have taken measures. HCC's corporate AI training can help you build and record that program, and our guide to building an AI-literate workforce covers the planning side.

General-purpose AI (GPAI) models and governance. According to the European Commission, the governance rules and the obligations for GPAI models became applicable on 2 August 2025. Under Article 53(1), GPAI model providers must draw up and keep up to date technical documentation of the model, make information available to downstream providers, put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training.

The general application date. The Commission's AI Act Service Desk timeline states that from 2 August 2026 the transparency rules in Article 50 start to apply, and that enforcement starts at national and EU level concerning general-purpose AI models. Article 50(1) requires providers to ensure that AI systems intended to interact directly with people are designed so those people are informed they are interacting with an AI system, unless that is obvious.

Recital 40 of Regulation (EU) 2026/1744 explains the reason for the change: the delayed availability of standards, common specifications and alternative guidance, and the delayed establishment of national competent authorities. According to EUR-Lex, the recital states that the initial date of application for the high-risk obligations, 2 August 2026, was no longer justified.

The amended Article 113 of the AI Act, as published on EUR-Lex in Regulation (EU) 2026/1744, now sets these dates:

2 December 2026: according to EUR-Lex, two new prohibitions in Article 5(1), points (ba) and (bb), apply. They cover AI that generates or manipulates intimate imagery of a person without that person's explicit consent, and AI that generates child sexual abuse material. According to the European Commission's AI Act Service Desk, the same date is a transitional deadline for certain providers of AI systems that generate synthetic content. According to EUR-Lex, the amended Article 111(4) requires providers of AI systems, including general-purpose AI systems, that generate synthetic content and were placed on the market before 2 August 2026 to comply with the content-marking rule in Article 50(2) by 2 December 2026.

2 December 2027: according to EUR-Lex, the high-risk rules in Chapter III, Sections 1, 2 and 3, apply to AI systems classified as high-risk under Article 6(2) and Annex III (the listed sensitive use cases).

2 August 2028: according to EUR-Lex, the same high-risk rules apply to AI systems classified as high-risk under Article 6(1) and Annex I, which the European Commission describes as high-risk AI systems embedded in regulated products.

The Digital Omnibus also amended Article 99. Its EUR-Lex text adds a new paragraph 6a so that, for small mid-cap enterprises (SMCs), each fine in paragraphs 4 and 5 is capped at the percentage or amount set there, whichever is lower. It also adds a new point (da) to paragraph 4, covering obligations under Article 25(2) and (4).

This post covers only the AI Act amendments made by Regulation (EU) 2026/1744. It does not cover any other Digital Omnibus files on data or privacy law.

Article 2 of the Regulation does not limit the Act to EU-based companies. Two provisions matter most for Canadian businesses.

Article 2(1)(a) covers providers placing on the market or putting into service AI systems, or placing on the market general-purpose AI models, in the Union, irrespective of whether those providers are established or located within the Union or in a third country. A Canadian software company that sells an AI product to EU customers can fall under this wording.

Article 2(1)(c) covers providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union. This can reach Canadian firms that never sell an AI product into the EU but whose AI-generated output, such as a score, a recommendation or generated content, is used there.

The Act also expects a local point of contact. Under Article 22(1), providers established in third countries shall, by written mandate, appoint an authorised representative established in the Union before making their high-risk AI systems available on the Union market. Article 54(1) sets a parallel requirement for providers of general-purpose AI models established outside the EU.

Article 99 of Regulation (EU) 2024/1689 sets three tiers of administrative fines:

Prohibited practices (Article 99(3)): according to the Regulation on EUR-Lex, up to EUR 35 000 000 or, if the offender is an undertaking, up to 7 % of its total worldwide annual turnover for the preceding financial year, whichever is higher.

Listed operator and notified-body obligations (Article 99(4)): according to the Regulation on EUR-Lex, up to EUR 15 000 000 or up to 3 % of total worldwide annual turnover, whichever is higher, for listed provisions including the obligations of providers (Article 16) and deployers (Article 26) and the Article 50 transparency rules.

Misleading information (Article 99(5)): according to the Regulation on EUR-Lex, supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities can bring fines of up to EUR 7 500 000 or up to 1 % of total worldwide annual turnover, whichever is higher.

For SMEs, including start-ups, Article 99(6) applies the lower of the percentage or the amount, and the new paragraph 6a does the same for SMCs. According to the EUR-Lex text of Regulation (EU) 2026/1744, the Digital Omnibus did not change the fine amounts or percentages in paragraphs 3, 4 and 5. Fines on GPAI model providers are set separately: according to the Regulation on EUR-Lex, Article 101(1) allows fines not exceeding 3 % of annual total worldwide turnover in the preceding financial year or EUR 15 000 000, whichever is higher.

If your company develops or fine-tunes a general-purpose AI model and places it on the EU market, the General-Purpose AI Code of Practice is relevant. According to the European Commission, the code is a voluntary tool prepared by independent experts, and it was published on July 10, 2025.

The Commission describes three chapters. The Transparency and Copyright chapters offer GPAI model providers a way to demonstrate compliance with Article 53. The Safety and Security chapter, according to the Commission, is only relevant to the small number of providers of the most advanced models that are subject to the Article 55 obligations for models with systemic risk. The Commission states that signing the code will reduce signatories' administrative burden and give them more legal certainty than proving compliance through other methods.

If your company builds on top of models supplied by others rather than providing a GPAI model itself, your obligations come mainly from your role for the AI system you place on the market or use, covered in the checklist below.

1. Do you use or supply an AI system as the Act defines it? (Article 3(1)) The Act defines an AI system as a machine-based system designed to operate with varying levels of autonomy. Start with an inventory of every tool and feature that may meet this definition, including AI features inside software you buy.

2. Are you a provider or a deployer? (Article 3(3) and 3(4)) A provider develops an AI system or GPAI model, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether for payment or free of charge. A deployer uses an AI system under its authority, except for personal non-professional activity. Many firms are both, for different systems.

3. Is your product placed on the EU market, or is its output used in the EU? (Article 2(1)(a) and 2(1)(c)) Map where your customers are and where your AI output ends up, including EU subsidiaries of Canadian clients.

4. Does any use fall under a prohibition? (Article 5) Compare each use against the Article 5 list, including the two new points (ba) and (bb) that, under the amended Article 113, apply from 2 December 2026 according to the EUR-Lex text of Regulation (EU) 2026/1744.

5. Is any system high-risk? (Article 6) Under Article 6(2), systems referred to in Annex III are high-risk; under Article 6(3), an Annex III system is not considered high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights. Article 6(1) covers AI tied to products under the EU legislation in Annex I.

6. If you are a high-risk provider, what documentation applies? (Articles 16, 18 and 22) Article 16 lists provider obligations, including a quality management system (Article 17), documentation (Article 18), conformity assessment (Article 43), an EU declaration of conformity (Article 47), CE marking (Article 48) and registration (Article 49(1)). Under Article 18(1), documentation must be kept for a period ending 10 years after the system is placed on the market or put into service, according to the Regulation on EUR-Lex.

7. If you are a high-risk deployer, what applies? (Article 26) Use the system in line with its instructions for use (Article 26(1)), assign human oversight to people with the necessary competence, training and authority (Article 26(2)), and, according to the Regulation on EUR-Lex, keep the automatically generated logs under your control for at least six months unless other law provides otherwise (Article 26(6)).

8. Do transparency rules apply? (Article 50) If a system interacts directly with people, they must be informed they are dealing with an AI system unless that is obvious (Article 50(1)). If you generate synthetic content, check the Article 50(2) marking rule and, for systems placed on the market before 2 August 2026, its 2 December 2026 transitional deadline under the amended Article 111(4), as published on EUR-Lex.

9. Have you taken AI literacy measures? (Article 4) Record what training and guidance staff who operate or use AI systems have received.

10. Are you a GPAI model provider? (Articles 53 and 54) If so, review the Article 53(1) documentation and copyright duties, the Article 54(1) authorised representative requirement, and whether to rely on the Code of Practice.

HCC's AI governance and compliance service can help you work through this inventory, classify your systems and organize the documentation, alongside your legal counsel.

EUR-Lex — Regulation (EU) 2024/1689 (Artificial Intelligence Act) EUR-Lex — Regulation (EU) 2024/1689, HTML text EUR-Lex — Regulation (EU) 2026/1744 (Digital Omnibus on AI) European Commission — AI Act (Regulatory framework for AI) European Commission — The General-Purpose AI Code of Practice European Commission AI Act Service Desk — Timeline for the implementation of the EU AI Act