News in Practice

Artificial intelligence and lawyers: what the AI Act has required since August 2, 2026

Three obligations are enforceable. The heaviest were postponed six weeks before the deadline, and confusing the two is now the common mistake.

For law firms and in-house legal departments using artificial intelligence in production. What remains owed since August 2, what was postponed, and what needs deciding this autumn.

Next review: February 2027

A lawyer using artificial intelligence to produce legal work has been required, since August 2, 2026, to meet three obligations: to avoid prohibited practices, to take measures supporting the competence of their teams, and to comply with the transparency requirements of Article 50. The heavy obligations attached to the high-risk regime, however, do not apply: they were postponed to December 2027 by a regulation adopted at the end of June. Many firms registered the postponement and concluded they had nothing to do. That is the most common error of this autumn.

Artificial intelligence and lawyers: the three enforceable obligations

None is strictly new, and that is what makes this period deceptive. Two have applied since February 2025; what changed on August 2, 2026 is the supervision and enforcement regime that accompanies them, with the designation of competent national authorities.

The first is the prohibition of certain practices under Article 5. It concerns legal production very little, though it may intersect with a firm's internal management, particularly around emotion-recognition systems in a workplace context.

The second is AI literacy under Article 4. Its wording was amended in June: it now requires taking measures to support the development of a sufficient level of competence, rather than ensuring that level. This is an obligation of means, it remains binding on any deployer, and it must be documented. A training session held, an internal note circulated, a record of who was trained and when will suffice to account for it.

A practical note: documenting this obligation is worth more than an untraced one-off session. A firm that has trained its teams without keeping a record stands, in the event of an inspection, in the same position as one that has not trained them at all.

The third is transparency under Article 50, which calls for closer reading in a law firm and is the subject of the next section.

One clarification on the scope of these three obligations: they fall on the firm as a deployer, that is to say a professional user of a system, and not as a provider. The distinction is structural, because the regulation places the bulk of its requirements on the provider. A firm that merely uses a system developed by a third party falls under a markedly lighter regime than one developing its own.

Article 50 applied to a law firm

This is the most frequently cited and most poorly characterised article. Three distinct situations arise in a firm, and they do not call for the same response.

A conversational system installed on the firm's website falls squarely within the text: a person interacting with it must know they are addressing a machine. This is the simplest obligation to satisfy and the most visible in the event of an inspection, since it is public.

Deliverables addressed to clients — opinions, instruments, pleadings — do not constitute content published to inform the public on matters of public interest. The labelling obligation provided for that category does not cover them. What governs them falls under professional secrecy and the lawyer's own responsibility, not Article 50.

That leaves the firm's editorial output: articles, legal notes, newsletters. This may fall within scope. The text provides, however, that the obligation does not apply where the content has undergone human review and a person assumes editorial responsibility for its publication. Compliance is therefore obtained through precisely what already gives a firm's work its value.

One practical consequence follows from these three situations: the dividing line does not run between assisted and unassisted uses, but between what is published and what is not. A firm that exposes no conversational system and publishes no generated content has, on this ground, no new obligation.

What was postponed, and until when

The amending regulation, adopted by Parliament on June 16, 2026 and by Council on June 29, moves two deadlines without touching the rest of the framework or its risk-based approach.

The timetable as at September 1, 2026

Regulation (EU) 2024/1689, as amended by the regulation adopted in June 2026.

One point is worth noting: these are fixed dates, not triggers conditional on the availability of harmonised standards, which had been contemplated. The December 2027 and August 2028 deadlines will not move with the progress of standardisation work.

It is worth adding what the postponement does not cover, because that is where the confusion originates. The obligations attaching to general-purpose models, in force since August 2025, are unchanged. The Article 5 prohibitions are unchanged. The transparency obligations are unchanged. The postponement bears exclusively on the high-risk regime, which is the one concerning the fewest firms.

Put differently: the part of the text that was pushed back is the part that, for most firms, did not apply in any event. And the part that does apply came into force as planned.

The penalty regime, which changes in nature

What takes effect on August 2, 2026 is not merely a set of obligations: it is the national machinery that enforces them. Each Member State designates the authorities competent for market surveillance and endows them with investigative powers.

Penalty ceilings are set by the regulation and vary with the nature of the breach, the highest amounts attaching to prohibited practices. For a deployer, financial exposure is markedly lower than for a provider, and it is not nil.

For a firm, however, the stake lies less in the amount than in the nature of the scrutiny: an authority questioning a firm on its uses expects a documented answer, and the absence of documentation is itself a signal, regardless of substantive compliance.

What arrives on December 2, 2026

Two further practices enter the scope of prohibitions: the production of non-consensual intimate imagery and of AI-generated child sexual abuse material.

Neither concerns legal production. They do concern firms advising content-distribution businesses, and they constitute a date to enter in the compliance calendar.

A postponement moves a deadline. It does not remove a requirement, and it suspends none of those already in force.

What the postponement does not suspend

Three pieces of work depend on no timetable and are better undertaken now than in 2027.

They also share a property that distinguishes them from the obligations proper: they produce value independently of the regulation. A firm that carries them out gains a view of its own practices, which it needs in order to govern, whether or not the text exists.

An inventory of uses. A firm cannot characterise what it does not know it is using, and experience shows that undeclared uses outnumber declared ones, often because they are embedded in software already in place. This inventory depends on no standard and could have been carried out as early as 2024.

The inventory benefits from distinguishing three categories: systems acquired as such, AI functions embedded in existing software, and undeclared individual use. The third is the hardest to establish and the most instructive.

Characterisation. Determining whether a use falls within Annex III is a matter of a few hours. Done now, it avoids being done under pressure in the autumn of 2027, and it produces a dated document, which is worth more than a later reconstruction.

These first two tasks take a day in a mid-sized firm, provided one asks the teams rather than reasoning from purchased licences. The difference between the two methods is considerable: licences describe what the firm has acquired, teams describe what they actually use.

Governance. Who may use which system, on which matters, under what controls: these questions arise independently of European law, since they already arose under professional secrecy.

These three tasks share one feature worth underlining: none concerns the choice of a tool. All concern the firm's ability to describe what it does. That is a governance requirement before it is a compliance requirement, which is why it will outlast the next changes to the timetable.

This article sets out the state of the law at its review date. It does not constitute legal advice and does not replace a professional's analysis of a specific situation.