The EU AI Act reaches further than most companies realized. It applies not only to organizations that develop AI themselves, but also to those that use AI features embedded in off-the-shelf software. This includes HR systems with automated applicant screening, performance evaluations, and learning applications with biometric components.
The Core Misconception
Many organizations assume the AI Act mainly targets technology vendors. That is wrong. Any company using third-party AI software takes on concrete documentation, oversight, and accountability obligations. AI has long been embedded in business operations but is rarely treated as a regulatory risk.
Deadlines and Uncertainty
Transparency obligations apply from August 2, 2026. For standalone high-risk systems such as AI-based hiring tools, the current expected deadline is December 2027. For AI embedded in regulated products like medical devices or machinery, the deadline runs to August 2028.
The EU Digital Omnibus regulation has shifted some deadlines but not all. Companies that assume everything has been postponed are setting themselves up for compliance gaps. Violations can result in fines of up to 35 million euros or seven percent of global annual revenue.
What Companies Should Do Now
Start with a complete AI inventory that includes AI features in purchased software, then categorize systems by risk level. This requires close collaboration across legal, compliance, IT, procurement, and HR. Companies that build solid structures now will adapt far more easily once technical standards and national guidelines are published. FameSystems recommends not waiting until the last minute.