The EU AI Act in Practice: New Obligations for Companies and Developers Starting in November 2026

The European Commission and national regulatory authorities are moving from theory to practice. Starting in November 2026, active enforcement of key chapters of the Artificial Intelligence Act (AI Act) will begin, focusing on transparency and high-risk systems. For Slovak companies, startups, and developers, this marks the end of the preparatory phase and the beginning of actual compliance monitoring.

New practical guidelines clearly define how the AI Act interacts with existing regulations, such as the GDPR and the Digital Services Act (DSA), and regulatory authorities have already begun sending the first requests for security evidence to developers.

Theoretical phase over; actual enforcement begins

Although the AI Act took effect earlier, November 2026 marks a turning point. Regulatory authorities in EU member states, including Slovakia, have been provided with the necessary capacity and methodologies to carry out oversight.

What’s new? The European Commission has published updated practical guidelines that address legal uncertainties. At the same time, national authorities have begun actively reaching out to providers of AI systems, requesting that they submit technical documentation and evidence of compliance, particularly in cases falling under the “high-risk” category.

Two key areas that also affect Slovakia

For most Slovak companies, two areas of the regulation—which are being strictly enforced starting this month—are particularly critical:

1. Transparency obligations

These apply to nearly everyone who uses or develops AI. If your company deploys an AI system that interacts with people (e.g., web chatbots), generates content (text, images, audio), or uses biometric categorization, you are required to clearly inform the user that they are communicating with a machine or that the content was generated by artificial intelligence. The covert use of AI without notification will be considered a direct violation of the regulation starting in November 2026.

2. High-Risk Systems

These include AI applications used in critical areas such as recruitment (AI resume screening), creditworthiness assessment, critical infrastructure management, or education. Providers of these systems must meet strict requirements for data quality, record-keeping, human oversight, and cybersecurity before placing the system on the market or putting it into use.

The AI Act, GDPR, and DSA: How These Regulations Work Together

Many companies fear that the AI Act introduces redundant bureaucracy. However, the new guidelines clearly explain that these three pillars of EU digital regulation complement, rather than exclude, one another:

• GDPR (General Data Protection Regulation): Addresses what data you can use to train or operate AI and how to protect individuals’ privacy.
• DSA (Digital Services Act): Addresses the liability of online platforms for the content circulating on them, including the obligation to flag deepfakes and manipulated content.
• AI Act: Addresses the lifecycle and safety of AI systems. It requires that systems be designed to be safe from the ground up, with clear documentation and risk mitigation mechanisms.

In practice, this means that if you operate an AI chatbot, you must comply with the GDPR when processing conversations, the DSA when labeling generated content on your platform, and the AI Act when ensuring that the chatbot model itself is robust and transparent.

Practical Checklist: What Slovak Companies and Developers Must Do

If your organization develops or deploys artificial intelligence tools, we recommend taking the following steps immediately:

1. Conduct an AI tool inventory: Map out all AI systems your company uses (including external SaaS solutions) or develops.
2. Classify them by risk level: Determine whether a system poses minimal, limited, high, or unacceptable risk according to the annexes of the AI Act.
3. Ensure transparency: Verify that your websites, apps, and marketing materials clearly indicate where AI is used (e.g., “This text was generated using artificial intelligence”).
4. Prepare technical documentation: For high-risk systems, you must have detailed documentation available regarding architecture, training data, accuracy testing, and human oversight mechanisms.
5. Designate a responsible person: Appoint an internal coordinator for AI Act compliance who will maintain contact with regulatory authorities and monitor updates to the guidelines.

Consequences of Noncompliance

Penalties for violating the AI Act are not symbolic. The most serious violations (e.g., the use of prohibited AI practices) are subject to fines of up to 35 million euros or 7% of the company’s global annual turnover.

For violations of transparency obligations or requirements for high-risk systems, fines are set at up to 15 million euros or 3% of turnover. Although European legislation promises proportionality in penalizing small and medium-sized enterprises (SMEs) and startups, the administrative burden and reputational damage resulting from non-compliance can be existential for smaller companies.

Conclusion

November 2026 is not a date to panic, but a date for concrete action. The EU AI Act is not a barrier to innovation, but a framework designed to build trust in technology. Companies that have already mapped out, documented, and made their AI processes transparent will gain a competitive advantage. Those who ignore the issue expose themselves to unnecessary financial and legal risks.