News
How the AI Act and Cyber Resilience Act ramp up in autumn 2026
The toughest AI rules are postponed to 2027, but several requirements already start this autumn. Here are the dates that actually matter for companies.
The EU’s Digital Omnibus (finally approved in June 2026) postponed the most demanding AI rules, but several requirements already start this autumn. Here is how the nearest dates look.
AI Act: what applies soon
- 2 August 2026: transparency requirements (Article 50). You must inform when someone interacts with AI.
- 2 December 2026: extended deadline for labelling AI-generated content (Article 50) for systems that were on the market before August 2026. (The prohibitions on unacceptable-risk AI already apply, since 2 February 2025.)
- 2 December 2027: high-risk requirements for standalone systems (Annex III), postponed from earlier.
- 2 August 2028: high-risk AI embedded in already regulated products (Annex I).
For most small businesses this means: be open about using AI, but the heavy requirements rarely concern you. The common AI assistants – ChatGPT, Claude, Mistral and Microsoft Copilot – are covered primarily as user tools by the lighter transparency requirements.
More in our guide on AI Act for small businesses, and get ready with the checklist and the free AI policy template.
Cyber Resilience Act: from 11 September 2026
The CRA starts applying gradually. From 11 September 2026, the requirement to report actively exploited vulnerabilities and serious incidents for products with digital elements applies. It mainly concerns manufacturers of digital products, not those who merely use a tool.
What you should do
No panic. If you use AI towards customers: prepare a simple sentence stating that AI is used. Do you build or sell digital products: keep an eye on the CRA. We monitor and update as new dates approach.
Sources
Tools mentioned
ChatGPT
OpenAI
Writes quotes, emails and customer replies in seconds. The free version goes a long way for everyday use; the downside is that data is stored in the USA unless you have an Enterprise or Edu plan with EU data residency.
- The free version is enough for most small businesses
- Best in Swedish among the major AI tools
- Data is stored in the USA on Free, Plus and Business plans; EU data storage is only available for Enterprise and Edu
Best for: Everyday tasks like email, text, ideas and research.
Claude
Anthropic
Anthropic's AI, often best for longer and more nuanced text. Strong in Swedish.
- Excellent in Swedish and longer texts
- Free tier available
- Data is stored in the USA
Best for: Longer texts, analysis and nuanced answers.
Mistral (Le Chat)
Mistral AI
France's answer to ChatGPT and one of the few European AI models in the top class, with EU data storage.
- European model in top class
- EU data storage
- Slightly weaker than the largest American ones
Best for: Those who want a powerful AI chat within the EU.
Microsoft Copilot
Microsoft
Microsoft's AI built into Word, Excel and Outlook. Makes sense if the company already uses Microsoft 365; otherwise an expensive add-on for features you rarely use.
- Built directly into Word, Excel and Outlook
- EU data storage via Microsoft 365
- Expensive add-on, around SEK 220/month per user
Best for: Companies that already live in Microsoft 365.
Related articles
This is general information, not legal advice. See How we review.