AI Act 2026: What Does Your Business Need to Document When It Uses AI?

AI Act 2026: What Does Your Business Need to Document When It Uses AI?

The EU AI Act is the world's first comprehensive AI law, and the first obligations take effect in August 2026. If your business uses AI tools such as Microsoft Copilot, ChatGPT or automated decision-making, you need to act. This isn't just about Big Tech: every organisation that uses AI will face documentation and transparency obligations.

Key points (TL;DR)

• The first AI Act 2026 obligations start on 2 August 2026 for limited-risk AI systems, including transparency requirements
• Four risk categories: unacceptable, high, limited and minimal risk determine which obligations apply
• Documentation duty: businesses must record where AI is used, what data is processed and who provides oversight
• Not just for tech companies: SMEs that use AI tools for customer service, recruitment or cybersecurity also fall under the rules
• Overlap with NIS2 and DORA: organisations already working within these frameworks have a head start on AI Act compliance
• Fines of up to €35 million or 7% of worldwide annual turnover for breaches in the most serious category
• Starting now is essential: an AI inventory and risk assessment take time, and the deadline is approaching fast

What is the EU AI Act and when does it apply?

The EU AI Act (Regulation (EU) 2024/1689) is a European regulation that sets rules for developing, supplying and using AI systems. The law entered into force on 1 August 2024, but its obligations are being phased in.

Timeline of the AI Act obligations:

For most Dutch businesses, 2 August 2026 is the critical date. From then on, the AI Act 2026 obligations for transparency, documentation and human oversight apply to the use of AI systems.

Why does this affect your small business too?

The AI Act doesn't only apply to companies that develop AI. Article 3 also defines the "deployer" (user) of AI systems. Do you use Microsoft 365 Copilot to answer emails, an AI chatbot for customer service, or automated screening in recruitment? Then you are a deployer, and you have obligations.

Concrete examples of AI use to which the AI Act applies:

• Microsoft Copilot for generating documents and analyses
• ChatGPT or similar tools for customer communication
• AI-driven security monitoring within your cybersecurity solutions
• Automated CV screening in recruitment and selection
• AI chatbots on your website for customer service
• Predictive analytics for business decisions

What matters isn't the size of your company, but the type of AI you use and the risk it carries.

What risk categories does the AI Act use?

At the heart of the AI Act is a risk-based approach. Article 6 and Annex III classify AI systems into four categories, which determine which AI Act 2026 obligations apply to your organisation.

Unacceptable risk (prohibited)

AI applications considered unacceptable have been banned since 2 February 2025. Think of social scoring by governments, manipulative AI that exploits vulnerabilities, and real-time biometric identification in public spaces.

High risk

These are AI systems that pose a significant risk to health, safety or fundamental rights. Examples include AI in recruitment, credit scoring, education and law enforcement. The heaviest obligations apply here: a risk management system, data quality requirements, technical documentation, logging, transparency and human oversight.

Limited risk

AI systems that interact with people, such as chatbots and AI-generated content. A transparency requirement applies: users must know they are dealing with AI. This affects many SMEs that use chatbots on their websites.

Minimal risk

AI applications without significant risk, such as spam filters and AI recommendations in entertainment. No specific obligations apply, although voluntary codes of conduct are encouraged.

What does your business need to document?

For businesses using high-risk or limited-risk AI systems, the AI Act prescribes specific documentation and governance obligations. These are the four core areas you need to record.

1. Where is AI used in the organisation?

Create a complete register of all AI applications in your business. For each system, document its purpose, the supplier, the risk category and the department that uses it. This AI register is the foundation for every further compliance action.

2. What data is processed?

For every AI system, record which personal data and business data is processed, where that data comes from and how data quality is assured. This ties in with the GDPR obligations you are probably already familiar with.

3. Who oversees AI decisions?

Article 14 of the AI Act requires human oversight of high-risk AI systems. You need to document who is responsible for monitoring AI output, who is authorised to overrule AI decisions and how the escalation process works.

4. What is the human role in AI processes?

You need to record how the interaction between people and the AI system works. Are AI suggestions adopted automatically, or is there a human review? How are errors detected and corrected? This is especially relevant if you use AI for decisions that affect people.

Practical examples: how does this play out for your business?

The AI Act 2026 obligations become concrete when you apply them to AI tools widely used by Dutch SMEs.

Microsoft Copilot in your Microsoft 365 environment: Using Copilot to write emails and documents falls under minimal risk. However, if you use Copilot to analyse employee data or make HR decisions, it may be classified as high risk. Document the intended use for each department.

ChatGPT for customer service: A chatbot that talks to customers falls under limited risk. You must inform customers that they are communicating with AI. Put a clear disclaimer on your website and record how the system is monitored.

AI in recruitment: Do you use AI tools to screen CVs or rank candidates? That is explicitly high risk under Annex III of the AI Act. You need a full risk assessment, data quality assurance and human oversight.

AI for cybersecurity monitoring: Security tools that use AI for threat detection generally fall under minimal risk. Still, document which systems take AI-driven decisions, such as automatically blocking network traffic.

How does the AI Act relate to NIS2 and DORA?

The AI Act doesn't stand alone. There is considerable overlap with other European regulation, which is both a challenge and an opportunity.

NIS2 Directive: NIS2 requires risk assessments and documentation of IT systems. AI systems that form part of your network and information security must be documented under both NIS2 and the AI Act. You can extend the risk assessment you carry out for NIS2 with AI-specific elements.

DORA: For financial institutions, AI systems used in operational processes also fall under DORA. DORA's ICT risk management framework provides a solid basis for AI Act compliance.

Organisations already working on NIS2 or DORA compliance have a head start. Many documentation and governance requirements overlap. An integrated approach saves time and avoids duplicate work.

What steps should you take now?

Don't wait until August 2026. The AI Act 2026 obligations call for preparation that takes months. Here is a practical step-by-step plan to get started now.

Step 1: AI inventory (this month)

Map every AI application in your organisation. Ask each department which AI tools they use, including shadow IT. Many employees use ChatGPT or other AI tools without IT knowing about it.

Step 2: Risk assessment (within 3 months)

Classify every AI system according to the AI Act's four risk categories. Determine which obligations apply to each system. An IT partner with security expertise can help you with this.

Step 3: Set up a documentation framework (within 6 months)

Create templates and processes for the required documentation: AI register, risk assessments, data quality reports and oversight procedures. Link these to your existing IT management processes.

Step 4: Governance and responsibilities (within 6 months)

Appoint someone responsible for AI within your organisation. Define who oversees which AI systems and how escalation works. Integrate AI governance into your existing IT governance.

Step 5: Training and awareness (ongoing)

Train employees in responsible AI use: not only the technical aspects, but also the legal framework. Employees need to know when they may use AI and which rules apply.

Step 6: Review and audit (quarterly)

Schedule quarterly reviews of your AI register and risk assessments. AI use changes quickly: new tools get adopted and existing tools gain new features. Keep your documentation up to date.

TRON Group: Your Partner for AI-Compliant IT

At TRON Group, we combine in-depth knowledge of managed IT, cybersecurity and Microsoft 365 with hands-on experience of compliance projects. We help businesses in the Netherlands use AI responsibly within the frameworks of the AI Act, NIS2 and DORA.

What we do for you:

• AI inventory and risk assessment of your current IT environment
• Setting up documentation frameworks that fit your existing processes
• Putting governance and oversight mechanisms in place
• Securing AI systems within your Microsoft 365 environment
• Training and awareness for your team
• Ongoing monitoring and quarterly reviews

Want to know where your organisation stands? Request a free Quick Scan and get insight into your AI use and compliance risks within a week. Or get in touch directly for a no-obligation conversation. Call +31 85 303 5869 or book an appointment via our contact page. You can also read more about who we are and how we work.