News
How the AI Act and Cyber Resilience Act ramp up in autumn 2026
The toughest AI rules are postponed to 2027, but several requirements already start this autumn. Two dates in August and September are the ones that actually matter for most companies.
The EU’s Digital Omnibus (finally approved in June 2026) postponed the most demanding AI rules, but several requirements already start this autumn. Here is how the nearest dates look.
AI Act: what applies soon
- 2 August 2026: transparency requirements (Article 50). You must inform when someone interacts with AI.
- 2 December 2026: extended deadline for labelling AI-generated content (Article 50) for systems that were on the market before August 2026. (The prohibitions on unacceptable-risk AI already apply, since 2 February 2025.)
- 2 December 2027: high-risk requirements for standalone systems (Annex III), postponed from earlier.
- 2 August 2028: high-risk AI embedded in already regulated products (Annex I).
For most small businesses this means: be open about using AI, but the heavy requirements rarely concern you. The common AI assistants – ChatGPT, Claude, Mistral and Microsoft Copilot – are covered primarily as user tools by the lighter transparency requirements.
More in our guide on AI Act for small businesses, and get ready with the checklist and the free AI policy template.
Cyber Resilience Act: from 11 September 2026
The CRA starts applying gradually. From 11 September 2026, the requirement to report actively exploited vulnerabilities and serious incidents for products with digital elements applies. It mainly concerns manufacturers of digital products, not those who merely use a tool.
What you should do
No panic. If you use AI towards customers: prepare a simple sentence stating that AI is used. Do you build or sell digital products: keep an eye on the CRA. We monitor and update as new dates approach.
Sources
Tools mentioned
ChatGPT
OpenAI
Writes quotes, emails and customer replies in seconds. The free version covers most everyday needs; the downside is that data is stored in the USA unless you have an Enterprise or Edu plan with EU data residency.
- The free version is enough for most small businesses
- Best in Swedish among the major AI tools
- Data is stored in the USA on Free, Plus and Business plans; EU data storage is only available for Enterprise and Edu
Best for: Everyday tasks like email, text, ideas and research.
Claude
Anthropic
Anthropic's AI, often best for longer and more nuanced text. Strong in Swedish.
- Excellent in Swedish and longer texts
- Usable for free via the free tier
- Anthropic sends the data to servers in the USA
Best for: Longer texts, analysis and nuanced answers.
Mistral (Le Chat)
Mistral AI
France's answer to ChatGPT: the AI chat Le Chat from Mistral AI in Paris, one of the few European models in the top class. Data is stored within the EU, with a GDPR data processing addendum and certifications for SOC 2 Type II as well as ISO 27001 and 27701. A free tier is available to start with.
- European model in the top class, developed by Mistral AI in Paris.
- Data storage within the EU, with a GDPR processing addendum and certifications for SOC 2 Type II as well as ISO 27001/27701.
- Does not quite reach the level of the largest American models.
Best for: A Swedish consultant or agency that wants a powerful AI chat for quotes and emails without handing data to an American provider.
Microsoft Copilot
Microsoft
Microsoft's AI built into Word, Excel and Outlook. Makes sense if the company already uses Microsoft 365; otherwise an expensive add-on for features you rarely use.
- Built directly into Word, Excel and Outlook
- EU data storage via Microsoft 365
- Expensive add-on, from approx. SEK 170/month per user
Best for: Companies that already live in Microsoft 365.
Related articles
This is general information, not legal advice. See How we review.