top of page

EU AI Act: what firms need to do, and when

Writer: Alexandre KOERFER
Alexandre KOERFER
9 hours ago
5 min read
Row of European Union flags in front of the European Commission headquarters in Brussels

Since 2 August 2026, most of the EU Artificial Intelligence Act (the AI Act) has applied. The regulation known as the ‘Digital Omnibus on AI’, published in July 2026, postponed the rules on high-risk systems, but not the rest. Here is what already applies to a law firm, an accountancy firm or a notarial office, and what is coming.

Your firm is usually a ‘deployer’

Regulation (EU) 2024/1689 distinguishes two main roles. The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. The deployer is the person ‘using an AI system under its authority’, except in the course of a personal non-professional activity [3].

A firm that uses a general-purpose chat assistant such as ChatGPT, Claude or Gemini, a document research tool or software for analysing case documents is therefore a deployer. Its obligations are more limited than the provider's, but they do exist.

A firm that puts a tool into service under its own name, for example a chatbot on its website, should check whether it comes close to the definition of a provider [3].

A timetable amended by the Digital Omnibus

Regulation (EU) 2026/1744 of 8 July 2026, known as the ‘Digital Omnibus on AI’, was published in the Official Journal of the European Union on 24 July 2026 [2]. It entered into force on 27 July 2026 [2]. The timetable published by the European Commission now stands as follows [1]:

  • 1 August 2024: entry into force of the AI Act.

  • 2 February 2025: application of the general provisions, including AI literacy, and of the prohibitions on certain practices.

  • 2 August 2025: application of the rules on general-purpose AI models and establishment of governance.

  • 2 August 2026: application of most of the rules, including the transparency obligations in Article 50. Enforcement begins, in particular on prohibitions, transparency and AI literacy.

  • 2 December 2026: new prohibitions targeting systems that generate non-consensual sexual deep fakes and child sexual abuse material. End of the transitional period granted to certain providers of systems generating synthetic content, already on the market before 2 August 2026, to comply with Article 50(2).

  • 2 December 2027: application of the rules on Annex III high-risk systems, originally scheduled for 2 August 2026.

  • 2 August 2028: application of the rules on high-risk systems embedded in regulated products under Annex I.

The rules on general-purpose AI models are aimed at their providers. They create no direct obligation for the firm that uses them.

AI literacy: an obligation relaxed, not removed

In its original version, Article 4 required providers and deployers to take measures to ensure, ‘to their best extent’, a sufficient level of AI literacy [4]. Since the Omnibus, they must take measures to support the development of AI literacy among their staff and the persons using the systems on their behalf [4]. The text specifies that this obligation does not require a specific level to be ensured for each individual [4].

The obligation remains, and enforcement began on 2 August 2026 [1]. The measures must take into account the technical knowledge, experience and training of the persons concerned, the context of use and the persons on whom the systems are used [4]. The Commission is to publish practical examples of compliance [4].

For lawyers, the Conseil national des barreaux (CNB, the French national bar council) adopted a guide on professional ethics and artificial intelligence on 17 March 2026. It highlights in particular professional secrecy, compliance with the GDPR, competence, prudence and the duty to inform [8].

Transparency: what is owed to clients and the public

Article 50 has applied since 2 August 2026 [1]. It distinguishes several situations [6]:

  • systems intended to interact directly with people must be designed so that those people know they are interacting with an AI, unless this is obvious. This obligation falls on the provider;

  • the deployer of a system that generates or manipulates image, audio or video content constituting a deep fake must disclose that the content has been generated or manipulated by AI;

  • the deployer of a system that generates or manipulates text published to inform the public on matters of public interest must disclose this. The obligation does not apply where the text has undergone human review or editorial control and a person holds editorial responsibility for the publication.

This information must be provided in a clear and distinguishable manner, at the latest at the time of the first interaction or exposure [6].

A realistic AI-generated image or video posted on your website or social media requires a disclosure. A legal or regulatory update written with AI, then reviewed and published under a partner's responsibility, would appear to fall within the exception, provided that the review is genuine and traceable. Outside these cases and high-risk systems [5], informing clients about the use of AI on their matter is mainly a question of professional ethics and the GDPR.

High risk and the GDPR: what is coming, what does not change

A firm's everyday uses rarely qualify as high-risk. Some internal uses may do so: the CNIL (the French data protection authority) cites automated CV sorting [7]. The corresponding rules will apply from 2 December 2027 [1]. The deployer of such a system will, in particular, have to [5]:

  • use it in accordance with the provider's instructions for use;

  • assign human oversight to people who are competent, trained and have the necessary authority;

  • monitor its operation and keep the logs under its control for at least six months;

  • inform workers' representatives and the employees concerned before putting it into service in the workplace;

  • inform the people who are subject to decisions made or assisted by the system.

The GDPR, on the other hand, applies now. The CNIL points out that the AI Act ‘does not replace the requirements of the GDPR’ and that the two texts apply together when a system processes personal data [7]. For high-risk systems, a data protection impact assessment (DPIA) will be presumed to be required. It may draw on the documentation required by the AI Act [7].

Our recommendations

  • List the AI tools used in the firm, including undeclared individual use, and determine your role for each.

  • Formalise a usage policy: permitted and prohibited uses, data that must never be entered, mandatory review. For lawyers, align it with the CNB guide.

  • Document your AI literacy actions: training, materials, dates, participants.

  • Check your publications: a disclosure for generated images and videos, a record of human review for texts.

  • Identify now any use likely to fall under Annex III, particularly in recruitment, and prepare the impact assessment before December 2027.

To review your firm's position, Tao Sense offers a free assessment.

Sources

Comments

Commenting on this post isn't available anymore. Contact the site owner for more info.
bottom of page