AI Act: what actually applies to your AI tools since 2 August 2026

2 August 2026 was the AI Act's big deadline. It has just passed, and two opposite stories have been circulating since, both of them wrong. The first says the AI Act has been postponed and there is nothing to do. The second announces an avalanche of obligations for any business that touches AI. The reality comes down to one distinction: what was postponed concerns high-risk systems; what applies concerns everyone.

This article sets out what the European AI Regulation actually requires of a professional using AI tools day to day, using voice dictation as a worked example. And, above all, what it does not settle at all, contrary to widespread belief.

One single regulation, applicable across all 27 Member States

First misconception to clear up: the AI Act is not a national law. It is Regulation (EU) 2024/1689, which entered into force on 1 August 2024. Two practical consequences follow:

• It is a regulation, not a directive. It applies directly in all 27 Member States, with no transposing law. There is therefore no national version of the AI Act: the text is identical from one Member State to the next. Each country merely designates its supervisory authorities and sets its penalty regime, within the limits laid down by the Regulation.
• Its reach is extraterritorial. Article 2 covers providers placing an AI system on the Union market irrespective of where they are established, as well as providers and deployers established in a third country where the output produced by the system is used in the Union. A provider established outside the Union that offers its tool in Europe is therefore covered.

Also worth noting: paragraph 10 of that same article carves out the obligations of deployers who are natural persons using an AI system in the course of a purely personal, non-professional activity. Dictating your shopping list engages nothing. Dictating your client notes does.

The real timeline, after the digital omnibus

On 8 July 2026 the Union adopted Regulation (EU) 2026/1744, known as the digital omnibus on AI, published in the Official Journal of the European Union on 24 July 2026 and in force since 27 July. This is what redrew the timeline, and it is the source of the rumour of a blanket postponement. Here is what it changes, and what it does not.

• 2 February 2025: the prohibited practices in Article 5 and the AI literacy obligation in Article 4 became applicable. Unchanged.
• 2 August 2025: obligations on general-purpose AI models, governance, and above all the penalty regime entering into force. Unchanged.
• 2 August 2026: general applicability of the Regulation, and the transparency obligations of Article 50. Unchanged.
• 2 December 2026: two new prohibited practices added to Article 5, covering systems that generate realistic intimate content depicting an identifiable person without their consent, and systems that generate child sexual abuse material. The same date ends the four-month transitional period given to providers of generative AI systems already on the market on 2 August 2026 to comply with the content marking requirement.
• 2 December 2027: obligations for high-risk systems under Annex III (employment, education, essential services, justice, migration, biometrics). Postponed from 2 August 2026.
• 2 August 2028: obligations for high-risk systems under Annex I, those embedded in already-regulated products. Postponed from 2 August 2027.

The figures, to put the stakes in perspective: up to 35 million euros or 7 % of total worldwide annual turnover for a prohibited practice, and up to 15 million or 3 % for breaching the obligations of providers or deployers, or the transparency rules in Article 50, whichever is higher. One nuance that matters for an SME or a start-up: Article 99(6) provides that in their case it is the lower of the two figures that applies, not the higher.

The four risk tiers, and where a dictation tool lands

The AI Act does not regulate AI as a block: it sorts systems by risk tier, and makes the obligations depend on that classification. Four levels, from the most constrained to the lightest: unacceptable risk (prohibited), high risk (heavily regulated), specific transparency risk (disclosure duty), minimal risk (no particular obligation).

The point almost everyone misses: it is the intended purpose of the system that determines its tier, not the technology inside it. The same speech recognition building block can be minimal risk or high risk depending on what it is intended for.

• A tool intended to turn speech into text appears in none of the eight areas of Annex III. It is minimal risk.
• The same speech engine intended to assess candidates in a job interview would fall under point 4 of Annex III (employment and workforce management): high risk.
• The same speech engine intended to recognise emotions would fall under point 1 of Annex III (biometrics): high risk, where it is not outright prohibited.

In other words, the question to put to a vendor is not "does your tool use AI?", but "what is your system intended for, and which risk tier do you place it in?". The answer should be reasoned, not decorative.

The real trap for voice tools: inferring emotions

For a tool that listens to humans speak, the provision that deserves the most attention is not the high-risk chapter, it is Article 5. Its paragraph 1, point (f), prohibits AI systems used to infer the emotions of a natural person in the areas of workplace and education institutions, except where the use is intended for medical or safety reasons.

This is not a future obligation: it is a prohibition in force since 2 February 2025, in the most heavily penalised category of the Regulation. And it does not target the vendor alone: a company that deploys such a tool among its staff is squarely concerned.

The line to hold is clear: transcribing is not inferring. A dictation tool turns what you say into text, it does not analyse your emotional state. Caution is warranted, however, around the features some meeting tools advertise: sentiment analysis of participants, engagement scoring, stress or tone detection. In a workplace setting, those marketing promises can tip into the prohibited zone.

Do you have to watermark text produced with AI?

This is the most widespread confusion since 2 August 2026. Article 50(2) requires providers of AI systems that generate synthetic audio, image, video or text content to mark those outputs in a machine-readable format. Many conclude that any text written with the help of AI must now carry a mark.

That is inaccurate, and the Regulation says so itself. The same paragraph specifies: "This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof."

A voice dictation tool sits squarely inside that exemption. It transcribes your words, then fixes punctuation, grammar and hesitations. It does not manufacture content on your behalf and does not change the meaning of what you said: it formats input data you provided. The text remains yours. The difference from a tool that drafts an article from a three-line prompt is one of nature, not of degree.

Two caveats, on the other hand, worth knowing:

• Article 50(1). Systems intended to interact directly with natural persons must inform them that they are dealing with an AI. That targets conversational agents, not a dictation tool, which holds no dialogue with anyone.
• Article 50(4). Text generated or manipulated by AI and published with the purpose of informing the public on matters of public interest must carry a disclosure. Important exemption: where the content has undergone human editorial review and a natural or legal person holds editorial responsibility. A journalist who dictates an article and then reviews it stays within the exemption.

What the AI Act requires of the professional user

The Regulation distinguishes two main roles. The provider develops the system and places it on the market. The deployer uses it under its own authority, in a professional capacity. If you equip your teams with an AI tool, or use one yourself in the course of your work, you are a deployer. Three things concern you in practice.

1. AI literacy (Article 4), softened by the omnibus. The original text required providers and deployers to ensure "a sufficient level" of AI literacy among staff. Regulation (EU) 2026/1744 replaced it with a markedly lighter formula: providers and deployers "shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", and the amended article adds that this obligation does not require them to guarantee any specific level of AI literacy for any individual. It moves from an obligation of result to an obligation of effort. Worth noting: Article 4 does not appear in the list of infringements subject to fines under Article 99. The obligation exists, but it carries no direct penalty at Union level.

2. Prohibited practices (Article 5). You must not use a tool that falls within the Article 5 blacklist, including the inference of emotions at work discussed above. It is the only genuinely heavy constraint on an ordinary user, and it is already in force.

3. Deployer obligations for high-risk systems (Article 26). These are substantial: human oversight, log retention, informing the workers concerned. But they only bite if you actually deploy a system classified as high risk, and not before 2 December 2027 for Annex III.

The crucial point: the AI Act says nothing about sovereignty

This is the costliest confusion, because it creates a false sense of security. The AI Act governs the placing on the market and the use of AI systems: what they are allowed to do, how they must be documented, what they must disclose. It contains no data localisation requirement.

Nowhere does the Regulation require your audio, your text or your documents to be processed in Europe. Nowhere does it neutralise the US Cloud Act. A tool can be beyond reproach under the AI Act and still route every one of your dictations to servers operated by a company subject to US law, and therefore compellable by a US order.

What governs those questions is the GDPR, and the GDPR alone: lawfulness of processing, retention periods, processors, and the framework for transfers outside the European Union under its Chapter V. The AI Act says as much itself, in Article 2(7): Union law on the protection of personal data continues to apply to personal data processed in the context of the Regulation. The two texts stack, one does not replace the other.

We go into that second question, by far the more decisive in practice, in our dedicated guide: voice dictation and GDPR, where does your voice go. It explains why server location is not enough, what the Data Privacy Framework is really worth, and why the jurisdiction a vendor answers to outweighs the address of its datacenters. For professions bound by confidentiality, the applicable framework is set out on our page on attorney-client privilege.

6 questions to ask any AI vendor

A simple way to decide, combining both regulations. The first questions come from the AI Act, the last ones from the GDPR, and those are often the ones that make the difference.

1. What is the declared intended purpose of your system, and which risk tier do you place it in? Expect an answer reasoned against Annex III, not a bare "we are compliant".
2. Does your tool infer emotions, or categorise people from their voice? In a workplace, the right answer is no, without ambiguity.
3. Do your outputs fall under the marking obligation in Article 50(2), or under the assistive editing exemption? A serious vendor knows where it stands and why.
4. Which AI models do you use, where are they run, and from which suppliers? It is the only way to know who really handles your data at the end of the chain. A vendor calling a third party's API exposes you to that third party, whatever else it may say.
5. Is my data used to train your models, and how long is it kept? The right answers: no, and zero retention.
6. Where is my data processed, by which company, and under which jurisdiction? Look for processing in the Union by a European company, not merely a "datacenter in Europe".

Where Fast Dictate stands

Fast Dictate is a European voice dictation tool. Here are our answers to the six questions above, in order:

• Intended purpose and classification: to turn speech into text and insert it into the application of your choice. None of the eight areas of Annex III applies: minimal risk.
• Emotions: no. Fast Dictate transcribes what you say and formats the text. It performs no speaker recognition, no sentiment analysis and no biometric categorisation.
• Content marking: the tool transcribes your own words and corrects punctuation and grammar, without substantially altering your input data or its semantics. That is precisely the exemption set out in Article 50(2).
• Models and where they run: on the Pro plan, transcription (Whisper Large V3) and language post-processing (GPT-OSS-120B) run on servers located in France. No call is made to any AI API outside France to process the content of your dictations, whether OpenAI, Anthropic, Google, AWS or Azure.
• Zero data retention on every plan. Your audio is processed in memory for the time it takes to transcribe, then deleted immediately, and is never reused to train a model.
• Pro plan: processing exclusively in France, on infrastructure certified ISO/IEC 27001:2022, outside the scope of the US Cloud Act, with an advanced GDPR data processing agreement available on request. The Free and Standard plans run on fast international infrastructure, still with zero data retention.

Beyond that, Fast Dictate works everywhere: Word, Gmail, Notion, your browser, any text field, with a single shortcut on Windows and Mac. The free plan gives you 2,000 words per week, no credit card.

This article is informational and does not constitute legal advice. The classification of an AI system depends on its intended purpose and its actual use: if you are in doubt about your own situation, seek professional advice. The official sources are available on EUR-Lex and on the European Commission page on the AI Act. Article current as of 15 August 2026.

Frequently asked questions