The AI Act distinguishes providers and deployers, system purposes and application dates. For an ordinary business, the first step is to map actual AI uses; purchasing a licence does not determine every obligation.
This is a practical overview for an ordinary Czech company, not a bank, not a medical device manufacturer. I'm not a lawyer and this isn't legal advice; every claim links to a source so you can verify it.
AI literacy (Art. 4) has applied since 2 February 2025, and transparency under Art. 50 applies from 2 August 2026. Under Regulation (EU) 2026/1744 of 24 July 2026, high-risk systems moved to 2 December 2027 and 2 August 2028. Article 50 is not a blanket duty to label every AI-assisted text: it covers chatbots, machine-readable marking, deepfakes and selected public-interest texts. I run AI training from €1,000, with a two-hour intro from €240.
What the AI Act is and why the deadlines cause such confusion
The AI Act (Regulation (EU) 2024/1689) is a directly applicable European regulation, it applies in Czechia regardless of whether parliament manages to pass the accompanying national act. Obligations phase in over several waves, and that's exactly where the confusion comes from: each wave has a different date, and one of them moved in 2026.
The timeline after the changes:
| Date | What applies | Who it concerns |
|---|---|---|
| 2 Feb 2025 | Prohibited practices + AI literacy obligation (Art. 4) | providers and deployers within the regulation's scope |
| 2 Aug 2025 | GPAI rules; transitional provisions for earlier models | developers of large models (OpenAI, Google…) |
| 2 Aug 2026 | Transparency (Art. 50): chatbots, AI content, deepfakes | providers and deployers within Article 50's scope and exceptions |
| High-risk systems (Annex III: hiring, credit, education…) | companies deploying AI in sensitive areas | |
| High-risk AI embedded in products (medical, machinery) | manufacturers of regulated products |
The postponement is news from 2026: the European Commission proposed the Digital Omnibus package in November 2025, the Council gave final approval on 29 June 2026 and it was published in the Official Journal of the EU on 24 July 2026 as Regulation (EU) 2026/1744. The high-risk deadlines moved by 16 and 12 months respectively. The relevant provision and transitional rules matter; not all high-risk obligations share one start date.
Obligation no. 1: AI literacy, in force for a year and a half already
Read Article 4 in its current version. Following Regulation (EU) 2026/1744, providers and deployers must take measures supporting AI literacy among staff and other people acting on their behalf, considering knowledge, experience and use context. It explicitly does not require guaranteeing a particular level for every individual. Published amendment, Article 1(5), checked 3 October 2026.
What that means concretely:
- It covers ordinary ChatGPT use at work. You don't have to develop your own AI, it's enough that employees use it for company tasks.
- No mandatory certificate, no prescribed number of hours. The scope follows from how and for what the company uses AI and who works with it.
- Fit measures to the work. Practical exercises, rules and support should reflect actual AI use.
Practical training topics selected for the team's use cases:
Five training topics
- What to put into AI and what not personal data, trade secrets, client data
- How to verify outputs a model may state false information, identify who checks it before use
- Where the risks are copyright, GDPR, confidentiality, discrimination
- Internal rules which tools the company allows, for what, with what data
- Evidence a record of who was trained, when and in what; without a record, fulfilment is hard to prove
A tool inventory, rules and training records show what the company did. A document or one training session alone does not establish compliance with every obligation; actual purpose and operation matter.
Worked example: AI training: what happens to the attachment?
ORIGINAL EXAMPLE · FICTIONAL DATA
| Situation | Decision |
|---|---|
| Input | Complaint containing a customer address. |
| Unsuitable action | Paste the entire email into an unapproved tool. |
| Safer approach | Use an approved tool and only necessary information. |
| Check | A person reviews the reply before sending. |
One training scenario does not establish legal compliance.
Obligation no. 2: transparency, applies from 2 August 2026
This is the part that is not postponed and touches a surprising number of ordinary companies. From 2 August 2026, Article 50 requires four things:
- AI interaction. A provider of a system intended for direct interaction must arrange user information unless the AI interaction is obvious; the article contains exceptions. A company deploying a chatbot should verify with its supplier how the notice works.
- Synthetic content must be machine-labelled. Article 50(2) addresses providers generating synthetic audio, images, video or text: machine-readable, detectable marking subject to technical feasibility and specified exceptions. A visible watermark alone is not a universal substitute. For systems already on the market before 2 August 2026, the Digital Omnibus gives a grace period for machine labelling until 2 December 2026.
- Deepfakes must be visibly disclosed. Whoever publishes AI-generated content depicting real people, places or events as genuine must state that the content is artificial.
- AI text published to inform the public (news, public-information texts) must carry a notice that it was generated, unless it went through human editorial review with responsibility.
Sanctions depend on the breached provision, the actor's role and other circumstances. A statutory maximum is not a prediction of a particular company's fine. Small businesses are not automatically outside the prohibited-practice rules.
What it means in practice for a Czech website or e-shop:
Three situations on a Czech website or e-shop
- AI chatbot on the site add a clear "I'm an AI assistant" notice at the start of the conversation
- Image, audio or video meeting the deepfake definition assess disclosure under Article 50(4) and its exceptions
- Blog articles written with AI help for public-interest text, assess the exception under Article 50(4)
Not every illustrative AI image automatically falls into the same category as a deepfake. For blog articles that went through your editing and you stand behind them, the exception requires human review or editorial control and a person holding editorial responsibility for publication. This is not a blanket exemption from every AI-content rule.
What got postponed: high-risk systems
"High-risk" in the AI Act is a legal category, not a feeling. Subject to Article 6 and the annexes, it can cover AI for recruiting and evaluating job candidates, credit scoring, access to education, biometrics, critical infrastructure or law enforcement (Annex III), plus AI embedded in regulated products, medical devices, machinery, toys (Annex I).
Duties differ by role and system. The amendment postpones Chapter III, Sections 1-3, except Article 6(5); it does not postpone the entire regulation. The relevant dates are:
- standalone high-risk systems (Annex III): 2 December 2027
- AI in products (Annex I): 2 August 2028
Beware of two common misunderstandings. First: using ChatGPT to write emails is not a high-risk use. Second: if you use AI for, say, pre-screening job applicants, you can fall into the category even as a small company, and the postponement to 2027 is time to prepare, not a reason to ignore it.
Who will police it in Czechia
Determine the competent authority from the specific field and current Czech implementing legislation. Data protection and sectoral rules also apply; a general institution list does not determine jurisdiction in an individual case. Follow official ČTÚ information and published Czech legislation.
Checklist for an ordinary company
Practical records and checks (3 October 2026; not a universal statutory document list):
- An inventory of AI tools the company uses, and for what.
- Internal rules, allowed tools, forbidden data, output checks.
- AI-literacy measures, such as documented training (Art. 4, applies since 2/2025).
- A labelled chatbot, if one runs on your site (Art. 50, from 2 Aug 2026).
- Assessment of AI visuals, including whether they are deepfakes and what Article 50 requires.
- If AI touches hiring, credit or evaluating people → map whether it's a high-risk use and start preparing for 12/2027.
Article 4 does not prescribe universal employee certification. Measures must nevertheless reflect the role and use; a list of tools alone is insufficient.
Worked example: A register of three AI uses
illustrative example
| Use | Data | Owner and review |
|---|---|---|
| Article drafts | Public sources | Editor: verify claims |
| Meeting notes | Test transcript | Manager: approve input |
| CV screening | No data yet | HR: assess the use first |
Record purpose, data and responsibility separately for every tool.
Summary
Start by inventorying AI uses: who provides the system, who deploys it, for what purpose and with what impact. Use that to determine literacy, transparency and any additional duties. One training session or chatbot wording change does not establish compliance for every use. See the European Commission's Article 50 FAQ, checked 2 October 2026.
I run AI training for companies and schools, from a two-hour intro to a transformation programme, always on the tools your team actually uses, with a record of the training delivered. The measures required under Article 4 need to be assessed against your actual AI use. If you're not sure what exactly applies to your company, get in touch, we'll go through it on concrete tools, not paragraphs.
Sources and links
- Regulation (EU) 2024/1689, the AI Act, consolidated text, EUR-Lex
- Article 4, AI literacy and Article 50, transparency, artificialintelligenceact.eu
- Digital Omnibus on AI, state of the legislative process, European Parliament
- EU agrees Digital Omnibus deal, White & Case on the new 2027/2028 deadlines
- ČTÚ press release on 2 August 2026, the Czech supervisory authority
- Deepfakes, Chatbots, AI-Generated Text, Art. 50 obligations in detail, Greenberg Traurig
A practical overview, not legal advice. For borderline cases, hiring, credit, biometrics, regulated products, consult a technology lawyer.