Core transparency obligations apply: when people interact with chatbots or AI agents, they should be told they are engaging with AI; certain AI‑generated content, such as deepfakes and public‑facing informative text, must be clearly identified. Providers and deployers should maintain documentation, logging, and human oversight appropriate to their systems. The AI Office and national authorities can request information, evaluate models, and coordinate corrective actions. Practically, this means having a single source of truth for policies, technical documentation, and telemetry that connects user disclosures to system behavior.

If you provide a general‑purpose AI model, your obligations include transparent documentation, a public summary of training content sources, and appropriate risk assessment and mitigation—stepping up when models may present systemic risks. Teams should operationalize model cards, evaluation reports, safety red‑team findings, and content identification features. Copyright and training‑data handling must be documented, with clear pathways to respect opt‑outs and lawful use. Use the Commission’s templates and voluntary codes as scaffolding to institutionalize repeatable releases, clear change logs, and defensible alignment testing across versions.

High‑risk obligations cover risk management, data governance, logging, technical documentation, human oversight, robustness, accuracy, cybersecurity, and post‑market monitoring. Even if your system won’t classify as high‑risk until 2027–2028, the cheapest path is to adopt these disciplines now. Establish a cross‑functional governance forum, define risk acceptance thresholds, implement dataset documentation and quality gates, and build continuous evaluation pipelines. Select standards and controls you can scale with—anticipating harmonised standards as they become available—and align procurement to require suppliers to provide compatible artifacts and test evidence.

Prohibited AI practices—such as manipulative systems, exploitative targeting of vulnerabilities, social scoring, certain biometric uses, and untargeted scraping for facial databases—are enforceable. An additional prohibition on generating non‑consensual sexually explicit and intimate content and CSAM‑related outputs activates in December 2026. Builders should implement abuse‑prevention layers now: safety classifiers, restricted outputs, user reporting, traceable content provenance, and rapid takedown/incident workflows. Audit your product and marketing features to ensure they do not inadvertently enable or incentivize prohibited uses.

Prioritize composable controls you can ship quickly. For transparency: implement user‑visible AI indicators and deepfake labels; adopt content provenance standards and watermarking where feasible. For governance: maintain a model registry with versioned evaluations, policy gates, and release sign‑offs. For data: capture lineage, consent status, and license metadata; enforce dataset versioning and access controls. For monitoring: centralize inference logs, bias/robustness metrics, and incident tickets with on‑call rotations. For oversight: define clear human‑in‑the‑loop checkpoints and document when escalation occurs. Treat each artifact as evidence for future audits.