What the amended EU AI Act means for businesses

The EU AI Act is the European Union’s risk-based law for AI systems: an organization’s duties depend on the system’s intended purpose and the organization’s role. For organizations within its scope, Regulation (EU) 2026/1744 creates a conditional simplification for certain SME quality-management requirements, sets a context-sensitive AI-literacy duty and requires Member States to have national AI regulatory sandboxes operational by August 2, 2027. The amendment entered into force on July 27, 2026, according to the European Commission.

Three amended provisions at a glance

Which SMEs can use the simplified quality-management route?

The option is limited to eligible SMEs, including start-ups without partner or linked enterprises under the referenced EU definition. It applies to certain elements of Article 17’s quality-management-system requirements, not to every obligation in the Act. Article 17 concerns providers of high-risk AI systems, as set out in Regulation (EU) 2024/1689; the amendment permits qualifying businesses to meet some of those elements in a simplified manner.

That makes the company’s role and the system’s classification important before relying on the option. A business that uses an AI system under its authority in a professional context can be a deployer. Developing a system, placing it on the market under the company’s own name, substantially modifying it or changing its intended purpose can affect whether provider duties apply under the Act.

AI literacy is a measures duty, not an individual score

Amended Article 4 requires providers and deployers to take measures supporting AI literacy. Those measures should account for people’s technical knowledge, experience, education and training, as well as the context in which they use AI. The law does not require organizations to guarantee a specific literacy level for every individual, and the amended provision does not prescribe a universal certificate or score.

For a business, that points toward literacy measures suited to the people and AI uses involved: staff working with different systems or responsibilities may need different kinds of preparation. The legal duty is to take appropriate measures, not to promise the same test result for every employee.

The high-risk timetable has two dates

The amended law sets separate main application dates for two groups of high-risk AI systems. Regulation (EU) 2026/1744 assigns the dates by legal scope:

Annex III covers specified uses, including employment, education, biometrics, migration and certain essential services. Annex I addresses AI systems connected to products covered by EU harmonization legislation. The dates are not interchangeable: identifying the relevant use and legal category is part of determining which timetable applies.

High-risk requirements include risk management, data governance, technical documentation and record-keeping, information for deployers, human oversight, robustness, accuracy and cybersecurity. The Act’s risk-based structure also includes prohibited practices, transparency-related requirements and systems classed as minimal or no risk; general-purpose AI models have a separate framework for provider duties and systemic risk.

Start by mapping the AI your organization uses

Ingo Bednarz’s corporate-readiness guide recommends beginning with an inventory. Include AI features built into ordinary software and tools employees have adopted, then record each system’s purpose, provider, internal owner, data, users, affected people and oversight arrangements. That gives the organization a practical basis for assessing its role and the system’s risk category before assigning controls.

The amended law also requires each Member State to have at least one national AI regulatory sandbox operational by August 2, 2027. Eligible SMEs, start-ups and small mid-cap enterprises receive priority access to the Union-level sandbox under Regulation (EU) 2026/1744.