In this article (9 sections)
The EU regulation on artificial intelligence, Regulation (EU) 2024/1689 (the AI Act, also called the Artificial Intelligence Act), entered into force on 1 August 2024 and applies in phases. On 24 July 2026 the EU published the Digital Omnibus on AI, Regulation (EU) 2026/1744, in the Official Journal. It postpones the application dates for high-risk AI and amends more than ten provisions. This article sets out the AI Act’s risk structure, the new timeline after the amendment, and the changes Taiwanese companies should look at first.
Key takeaways
- The AI Act has four risk levels: prohibited, high-risk, transparency obligations and other. How many obligations apply depends on what the AI is used for, not on the technology itself.
- After the Omnibus, the high-risk rules for uses listed in Annex III apply from 2 December 2027; high-risk AI built into products covered by the Annex I product legislation applies from 2 August 2028.
- Not everything has been postponed: AI literacy and the prohibited practices have applied since 2025, the Article 50 transparency obligations have applied since 2 August 2026, and two new prohibited practices apply from 2 December 2026.
- If the output of an AI system is used in the EU, the AI Act applies even if the provider is established in Taiwan (Article 2(1)(c)).
Does the AI Act apply to Taiwanese companies?
The scope set out in Article 2(1) of the AI Act does not depend on whether a company is established in the EU. The following Taiwanese companies are all within scope:
- Providers that place an AI system on the EU market under their own name, wherever they are established;
- Third-country providers and deployers whose AI system output is used in the EU;
- Product manufacturers that place an AI system on the EU market together with their own product, under their own name or trademark;
- Companies with an EU subsidiary that uses AI in its operations, where the subsidiary itself is a deployer.
As with other EU regulations, the first sign of the AI Act for many Taiwanese companies is a questionnaire from a European customer: does the product use AI, which risk level does it fall into, and can you provide technical documentation?
How are the AI Act’s four risk levels defined?
The AI Act does not care which model or algorithm an AI system uses. It looks at what the system is used for.
| Risk level | Main provisions | Examples | Consequence |
|---|---|---|---|
| Prohibited | Article 5 | Manipulation, social scoring, inferring emotions in the workplace and education institutions (except for medical or safety reasons) | May not be placed on the market or used |
| High-risk | Article 6, Annex I, Annex III | Safety components of products; recruitment, task allocation and performance evaluation; credit scoring; assessment in education | Must meet the full set of Chapter III requirements |
| Transparency obligations | Article 50 | Chatbots, generative AI, deep fakes | Inform, mark, disclose |
| Other | Articles 4 and 95 | Most internal business tools | AI literacy; voluntary codes of conduct |
In addition, providers of general-purpose AI (GPAI) models have their own chapter (Chapter V). Taiwanese companies mostly “use” these models rather than provide them. This is covered later in the series.
There are two routes to high-risk, and they are the basis for the later articles:
- The Annex I route (Article 6(1)): the AI is a safety component of a product, or is itself the product, and that product must undergo third-party conformity assessment under the EU product legislation listed in Annex I. Examples are medical devices, toys, lifts and radio equipment.
- The Annex III route (Article 6(2)): the AI is used in one of the eight areas listed in Annex III, such as biometrics, critical infrastructure, education, employment and workers management, access to essential services, law enforcement, migration, and the administration of justice.
What did the Digital Omnibus change?
Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July. The changes most relevant to Taiwanese companies are:
| Change | Provision | In plain terms |
|---|---|---|
| High-risk application dates postponed and split | Article 113, third paragraph, point (c) | Annex III uses: 2 December 2027; Annex I products: 2 August 2028 |
| Two new prohibited practices | Article 5(1)(ba) and (bb) | Generating intimate images of identifiable persons without consent, and generating child sexual abuse material, prohibited from 2 December 2026 |
| Grace period for marking generative AI output | Article 111(4) | For systems placed on the market before 2 August 2026, the Article 50(2) marking obligation is deferred to 2 December 2026 |
| AI literacy rewritten | Article 4 | Changed from “ensure a sufficient level” to “take measures to support the development of”, stating expressly that a specific level is not required to be guaranteed |
| Machinery moved to Annex I Section B | Annex I, Article 2(2) | Requirements for high-risk AI built into machinery are taken over by the Machinery Regulation |
| Narrower definition of safety component | Article 3(14), Article 6(1a) to (1c) | AI used only for non-safety purposes such as quality control, performance optimisation or user assistance is not a safety component |
| Written agreements in the supply chain now subject to penalties | Article 25(4), Article 99(4)(da) | Breaches of the written agreements between high-risk AI providers and their suppliers of AI, models and tools can be penalised |
| Small mid-cap enterprises (SMCs) | Article 3, Article 99(6a) | New SMC definition; maximum fines are the lower of the amount and the percentage |
Does the postponement affect you?
Only the "high-risk" part has been postponed. If any of the following applies, you already have obligations that apply now:
- Your website, app or customer service uses a chatbot
- Your marketing materials, product images or videos are made with generative AI
- Staff at your European subsidiary use AI tools every day
The new prohibited practices and the end of the grace period for marking generative AI output both fall on 2 December 2026.
See the full AI Act timeline and milestones in the Regulatory Radar →
When does each AI Act obligation apply?
The table below is based on the consolidated text (version of 27 July 2026).
| Date | What applies | Provision |
|---|---|---|
| 1 August 2024 | AI Act enters into force | Article 113 |
| 2 February 2025 | Chapter I (including definitions and AI literacy) and the Chapter II prohibited practices | Article 113, third paragraph, point (a) |
| 2 August 2025 | Notified bodies, GPAI model obligations, governance, penalties | Article 113, third paragraph, point (b) |
| 27 July 2026 | Omnibus enters into force; Articles 102 to 110 (amendments to other product legislation) apply | Article 113, third paragraph, point (d) |
| 2 August 2026 | General date of application, including the Article 50 transparency obligations | Article 113 |
| 2 December 2026 | Two new prohibited practices; the marking grace period for existing generative AI systems ends | Article 113, third paragraph, point (a); Article 111(4) |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply; at least one AI regulatory sandbox operational in each Member State | Article 111(3), Article 57(1) |
| 2 December 2027 | Chapter III, Sections 1 to 3 apply to Annex III high-risk AI | Article 113, third paragraph, point (c)(i) |
| 2 August 2028 | Chapter III, Sections 1 to 3 apply to Annex I high-risk AI | Article 113, third paragraph, point (c)(ii) |
| 2 August 2030 | Existing high-risk AI intended for use by public authorities must comply | Article 111(2) |
One transitional rule is often overlooked: high-risk AI placed on the market before the high-risk rules apply only falls under the AI Act if its design changes significantly after that date (Article 111(2), with an exception for deployers that are public authorities). This means both “when it was placed on the market” and “how it is updated afterwards” affect the scope of your obligations, so look at them together with your product roadmap.
The dates have been postponed. Can we wait?
We do not recommend it, for three reasons:
- What was postponed is the application date, not the content of the obligations. High-risk systems need risk management, data governance, technical documentation, record-keeping, human oversight, accuracy and cybersecurity. These have to be built in from the design stage, not added as paperwork just before launch.
- Customers will arrive before the authorities. European brand owners and system integrators must be compliant by their own application date, so they will ask their upstream suppliers for information. The Omnibus has made the written agreements in the supply chain subject to penalties, so this pressure will only come sooner.
- Obligations that already apply are not postponed. The Article 50 transparency obligations, AI literacy and the prohibited practices all apply already.
Take stock first, then decide how urgent it is
Within the same company, some AI falls under the transparency obligations, some may be high-risk, and some requires nothing at all. Which to tackle first and which can wait until 2027 depends on the use and on your role in the supply chain.
Annex III high-risk: 2 December 2027; Annex I products: 2 August 2028.
Bring a list of the AI tools used in your company and book a 30-minute online consultation →
What will this series cover?
| Part | Topic |
|---|---|
| Part 2 | AI-generated marketing materials and customer service chatbots: the Article 50 transparency obligations |
| Part 3 | Are you a provider or a deployer? Determining your AI Act role |
| Part 4 | AI in machinery: what changes after the move to Annex I Section B |
| Part 5 | Is AI for quality inspection or performance optimisation high-risk? Assessing AI built into products |
| Part 6 | European customers asking for AI documentation: Article 25(4) written agreements in the supply chain |
| Part 7 | Using AI to schedule after-sales service engineers may be high-risk AI |
| Part 8 | European subsidiaries using AI to screen CVs: deployer obligations |
| Part 9 | “We are not high-risk”: the Article 6(3) exception and the evidence behind it |
| Part 10 | What changed in the AI literacy obligation |
FAQ
What is the AI Act?
The AI Act is the EU Artificial Intelligence Act, Regulation (EU) 2024/1689. It is a cross-sector AI law that, as an EU regulation, applies directly in all Member States. It sorts AI by use into four levels (prohibited, high-risk, transparency obligations and other) and sets obligations for providers, deployers, importers, distributors and product manufacturers. Maximum fines are EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
Did the Digital Omnibus postpone the whole AI Act?
No. What was postponed is Chapter III, Sections 1 to 3 (high-risk classification, requirements and the obligations of each party). The prohibited practices, AI literacy, GPAI models and the Article 50 transparency obligations all keep their original timeline, and two new prohibited practices were added that apply from 2 December 2026.
We only develop AI in Taiwan and sell it to European customers. Do we have to comply?
Yes. Providers that place an AI system on the EU market under their own name are covered wherever they are established (Article 2(1)(a)), and so are third-country providers whose AI output is used in the EU (Article 2(1)(c)).
Does the Commission offer official tools I can use to check for myself?
Yes. The Commission’s AI Act Service Desk offers a browser for the legal text (AI Act Explorer), a compliance checking tool (Compliance Checker, beta version) and FAQs. The official tools are good for a first understanding; determining the role and risk level of a specific product still depends on its actual use and the supply chain arrangements.
Next in the series
Need help?
ZC Zeelandia Consulting has an office in Amsterdam and can help you take stock of your AI use, confirm AI Act applicability and your role, and set your priorities up to 2027.
- Book a 30-minute online consultation: calendly.com/zc-meeting/30min
- EU Regulatory Radar: AI Act page
- Follow ZC on LINE: lin.ee/QKV5RTE
Legal sources and references
- Regulation (EU) 2024/1689 (Artificial Intelligence Act): EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 2026/1744, 24.7.2026: EUR-Lex
- AI Act consolidated text (27 July 2026): EUR-Lex
- European Commission, AI Act Service Desk, AI Act Explorer and Compliance Checker: ai-act-service-desk.ec.europa.eu
This article provides general information, updated to November 2026, and does not constitute legal advice. Whether a specific product is affected depends on the actual facts and the latest Official Journal texts.
Next step: have you considered these three options?
Sources · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · Regulation (EU) 2026/1744 (Digital Omnibus on AI) · AI Act consolidated text (27 July 2026) · European Commission, AI Act Service Desk. This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
AI ActEU AI ActArtificial Intelligence Act2024/1689Digital Omnibus2026/1744high-risk AIAI Act explained
