Alexandria – Belitsoft, a global AI consulting and development company with offices in North America and Europe, warns that the European Union’s AI Act will apply in its main part from 2 August 2026, and has a very broad extraterritorial reach. If your business offers AI tools to users in the EU, or produces outputs that are used in the EU, then the Act is likely to apply to you – whether you are based in Dublin, Delaware or Dubai. Whether it actually does depends on your role and the scope conditions of Article 2.
The prohibitions stipulated by Article 5 have applied since 2 February 2025. The transparency obligations stipulated by Article 50 apply from 2 August 2026. This means that anyone who believes that your AI system violates these articles can file a complaint against your company. As a result, the national market surveillance authority can take action.
This authority has the right to request your technical documentation, demand adjustments to your AI system, impose fines of up to €35 million or 7% of global turnover for violations of Article 5, up to €15 million or 3% for violations of Article 50, and even completely recall your product from the European market.
Under the new law AI is becoming a critical business system, failure of which could pose serious business risks. Your AI systems need evidence-based documentation to reduce them.
Your company must be able to provide evidence during the investigation. The authority may demand access to the documentation for its assessment. You’ll also be expected to show the measures you have taken. You should be prepared to quickly demonstrate that your AI system complies with the requirements.
If non-compliance is found, you may have only 15 working days to take the corrective actions the authority requires. Fines for giving false or misleading information can run to €7.5 million. To answer quickly, you need a current, complete list of all AI functions your company is implementing, plus written assessments that show how you are complying with the law, from avoiding the practices prohibited by Article 5 to ensuring the transparency required by Article 50.
A trusted AI consulting partner will help you inventory your AI systems, conduct a gap analysis in accordance with the new law, and develop the monitoring procedures. An experienced AI consulting firm views regulation as a foundation for responsible and trustworthy AI that protects your reputation with your clients. They will help you confidently respond to any complaint, so you can focus on your core business objectives.
What Happens After a Complaint Is Lodged
When a regulator receives a complaint about your company, you must be ready to demonstrate compliance. Article 79 of the EU Artificial Intelligence Act states that the national market surveillance authority has the right to initiate a formal assessment if it has reasonable grounds to believe that your system poses a risk. This means that the authority does not need to prove violations to initiate an investigation.Well-founded concerns are sufficient to initiate an investigation.
For Article 5 (Prohibited Practices)
Once the assessment process begins, the authority may require you to show compliance. Regarding the practices prohibited by Article 5, each AI system should have a written assessment of all eight prohibitions. You may have to explain to the regulator what data your AI system is using, where it is getting it from, how it interacts with users, and how it processes the dialogue. Also, you should maintain documentation of testing and ongoing monitoring.
The records are the most critical component of your defence. According to the Commission’s guidelines, if you can show that you took the necessary precautions, even if your AI system results in unintentional harm, this can weigh in your favour. The proof in guardrails, test findings, and monitoring protocols can be a deciding factor.
A top AI consulting firm will help you build and maintain the evidence package that regulators will expect.
For Article 50 (Transparency Obligations)
In June 2026, the European Commission published the Code of Practice on Transparency of AI-Generated Content, a voluntary instrument that translates three of the Article 50 duties into concrete measures.
One of the first things the regulator is likely to check is whether you have signed it. Your signature and compliance with this code will be treated by the regulator as evidence that you have met the labelling and disclosure requirements the Code covers (Articles 50(2), 50(4) and 50(5)). If this Code is not signed, you will need to show that your own protocol achieves the same compliance. You may need to check your strategy against the requirements of the Code to see if there are any gaps and how to address them.
The Commission has indicated that non-signatories may have to carry out this gap analysis, and their approach is likely to attract closer scrutiny from the authorities. Also, the competent authorities have the power to request more data and access to determine whether your marking is effective in real world situations. Your documentation needs to be complete, and your implementation needs to be verifiable.
There are two transparency obligations which fall entirely outside the scope of the Code. The authority will evaluate your adherence to the emotion recognition notice and the chatbot disclosure requirements separately. This means you need to have a documented plan of implementation for each of these duties.
A reputable AI consulting firm can help you understand these nuances by performing the gap analysis that the regulator may ask for. They can also develop solutions for obligations not covered by the Code. They will document, test and validate your transparency measures so you will have compelling evidence when the regulator examines your compliance.
EU AI Act Compliance Checklist: What to Do Before 2 August 2026
Each AI function must be systematically evaluated with regard to four criteria: whether it is within the scope of the official definition of an AI system, whether it is accessible to users in the EU, whether its output is used in the EU, and whether it is covered by Article 5 or Article 50.
Documentation is essential. Any person or organisation that considers that you have breached the AI Act may submit a complaint against your company under Article 85. There is little protection in conclusions that are not backed up by data. In other words, any oral or unsupported claim of exemption will be hard to defend before the authority.
The reach of the law is dynamic. You may see your first EU customer or your market presence may shift. Your feature can be repurposed in a way that makes it high-risk, which under Article 25(1)(c) makes you the provider of a high-risk system with all accompanying obligations. Your marketing team could change the purpose of the product and inadvertently bring it under the Act. Your previous judgement can be outdated overnight. If you do not update your evaluation, no one in your organisation may realise what the change means until a complaint is received or an investigation is conducted. This implies that the evaluation should be a continuous process and not a one-time exercise.
A reliable AI consulting and software development partner helps you build and maintain this assessment process. Top AI consultants set up a review cycle that takes inventory of your AI features, categorizes each according to the official definition, and identifies issues before they become problems.
About the author
Dmitry Baraishuk is a Partner and Chief Innovation Officer at Belitsoft. Belitsoft is a software engineering company specialising in DevOps, AI integration and enterprise application modernisation. The company serves healthcare, fintech and enterprise SaaS clients in the US, UK and Canada. Belitsoft publishes technology trend analyses to help business and technology leaders make informed decisions about software investment.
Media ContactCompany Name: BelitsoftContact Person: Dmitry BaraishukEmail: Send EmailCity: AlexandriaState: VACountry: United StatesWebsite: https://belitsoft.com/
