EU AI Act 2026: The New Rules for Trustworthy AI
RedHub AI Editorialupdated July 23, 20263 min read
In short
A plain-language orientation to the EU AI Act: risk tiers, prohibited uses, and transparency duties. Dates and obligations in this area have shifted more than once since this was written, so treat it as background for asking better questions rather than a current statement of the law. Not legal advice.
Jump to a section8
The Rule Book Nobody Wanted (But Everyone Needs)
There's a moment in every industry when the rules change. It's usually messy. It's usually frustrating. But it's always important.
That moment just arrived for artificial intelligence.
On the other side of the Atlantic, Europe did something bold. They said, "We're not waiting to see what happens. We're writing the rules now." And those rules are starting to matter—not just in Europe, but everywhere.
Here's what you need to know: The EU AI Act (opens in a new tab) is real, it's happening, and it's changing how companies build AI.
Let's Start with the Basics
Most rules are boring. Not these. These rules make sense if you think about them.
Europe decided that not all AI is equal. Some AI is dangerous. Some is just annoying. Some is fine. So they created a system: High-risk AI (the kind that could hurt you) needs serious safeguards. Limited-risk AI (like a chatbot that answers questions) mostly just has to say what it is. And a few types of AI? They banned them completely.
Banned. As in, you can't build them, period.
What gets banned? AI that uses manipulative or deceptive techniques to distort your behavior in ways that cause real harm. AI that secretly scores your social value. AI that creates databases of faces without permission to hunt people down. Those are gone. Finished. Not allowed.
Now Here's Where It Gets Real
If you build AI—and companies like OpenAI (opens in a new tab), Google (opens in a new tab), Meta (opens in a new tab), all of them do—you have rules now. Big rules.
Most of that weight lands on high-risk systems rather than on everything you build. That is the column where you have to explain where your AI learned, show you have tested it for bias against particular groups, keep detailed records, and put humans in a position to check the work.
One duty is far broader, and it is the one arriving first: you have to be honest when AI is what someone is talking to, or when AI generated what they are looking at. That is the Article 50 transparency obligation, and it applies from 2 August 2026.
The high-risk deadline moved after this was written. The Digital Omnibus on AI—Regulation (EU) 2026/1744, in force 27 July 2026—pushed the Annex III high-risk obligations back to 2 December 2027. Deferred, not cancelled. Dates here have shifted more than once, so check the current position before planning around any of them.
And if you break the rules? The fines are tiered, and the top tier is reserved for the practices that are banned outright: up to €35 million or 7% of total worldwide annual turnover, whichever is higher — and that is revenue, not profit. Lower ceilings apply to everything else. For a company like Google (opens in a new tab), that's billions of dollars.
Why Does This Matter to You?
Because AI is everywhere now. It's writing emails. It's making hiring decisions. It's creating videos. It's recommending what you should buy. It's writing code. You're using it even when you don't know you are.
Europe decided that when something this powerful affects your life, there should be rules about how it works.
Think of it like car safety. We don't just let car manufacturers build whatever they want. We have rules about brakes and airbags and crash testing. Not because cars are evil. But because cars are powerful, and power needs guardrails.
The Pattern Nobody Talks About
Here's the pattern nobody talks about:
When Europe makes a rule, the world follows. Not because everyone loves Europe, but because companies would rather have one set of rules than fifty different sets. So the EU AI Act (opens in a new tab) becomes the global AI Act. China watches. America watches. Everyone watches.
The Uncomfortable Truth
Companies building AI wanted more time. They said the rules are too strict. They said they need to move faster. They said compliance is expensive.
All of that is true.
All of it misses what we already know: Rules exist because someone got hurt.
The EU looked at the internet, social media, and previous technologies, and said, "We're not doing that again. We're not going to wait five years to regulate something powerful. We're doing it now."
Is It Perfect?
Is it perfect? No. Will it slow some innovation? Probably. Will it make AI safer and more trustworthy? Absolutely.
And as these rules land—some in 2026, the heaviest now in 2027—and companies scramble to comply, one thing becomes clear:
The age of "move fast and break things" is over. The age of "move thoughtfully and build trust" has begun.
That's not boring. That's the future.
About RedHub AI
At RedHub.ai, we help organizations navigate AI compliance, AI governance, and responsible AI development. Whether you're preparing for the EU AI Act (opens in a new tab), implementing AI governance frameworks, or ensuring your AI systems meet transparency and safety standards, we provide the strategic guidance and technical expertise to build trustworthy AI.
The era of responsible AI isn't coming—it's here. Let us help you succeed.
Frequently Asked Questions
What is the EU AI Act?
A European regulation that sorts AI systems by risk rather than by technology. A small set of practices is prohibited outright, a defined high-risk category carries the heaviest obligations, systems that interact with people or generate content carry transparency duties, and most everything else carries little or nothing. The post's car-safety comparison is the intuition: the obligations scale with how much harm the system can do.
Which AI practices does the Act prohibit?
The prohibited list includes manipulative or deceptive techniques that materially distort behavior, social scoring by public or private actors, and untargeted scraping of facial images to build recognition databases, among others. These are bans rather than requirements — no amount of documentation makes a prohibited practice permitted.
How large are the penalties under the Act?
The Act sets tiered maximums, with the highest reserved for prohibited practices: up to €35 million or 7% of total worldwide annual turnover, whichever is higher. Lower ceilings apply to other breaches. The figure the post highlights is measured against turnover — revenue, not profit — which is what makes it consequential for large firms.
Do the high-risk obligations apply from August 2026?
Not on the original calendar, and this post was written against that calendar. The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force 27 July 2026 — deferred the Annex III high-risk obligations to 2 December 2027. The Article 50 transparency obligations, which cover AI that interacts with people or generates content, still apply from 2 August 2026. Dates in this area have moved more than once; verify the current position before planning around it.
Why would a company outside Europe care?
For two reasons the post raises. The Act reaches providers placing systems on the EU market regardless of where they are established; and separately, firms tend to standardize on the strictest regime they have to meet rather than maintain parallel builds. The second is the pattern the post describes — an observation about corporate behavior, not a legal rule.
Is this a compliance assessment?
No. This is a plain-language orientation. It is not legal advice and not a conformity assessment of any AI system. Scope, classification, and deadlines are fact-specific and actively moving; confirm your own position with qualified counsel.