Navigating the EU Artificial Intelligence Act

Log in to listen to this article

If your organization uses Microsoft Copilot, ChatGPT, Gemini, Coral, or other AI-powered tools, the EU Artificial Intelligence Act may already matter to you.

Recent changes to the legislation have created confusion about when various requirements take effect. While some rules for high-risk AI systems have been delayed, key provisions on AI literacy, transparency, and general-purpose AI (GPAI) models are already in force. 

Canadian organizations doing business internationally should understand what these developments mean and how they may affect governance, procurement, contracting, and compliance practices.

What has changed?

The most significant development is the adoption of the Digital Omnibus on AI, which entered into force in July. It was introduced in response to concerns that the conformity assessment mechanisms and regulatory infrastructure necessary to implement the AI Act were not yet fully operational. 

As a result, the EU postponed several compliance deadlines for high-risk AI systems. Under the revised timeline:

• Requirements for stand-alone high-risk AI systems now apply beginning December 2, 2027.
• Requirements for AI systems embedded in regulated products, such as machinery and certain industrial equipment, now apply beginning August 2, 2028. The Omnibus also expanded certain compliance accommodations previously available only to small and medium-sized enterprises and strengthened the European AI Office's role in supervision and enforcement. 

Importantly, however, the Omnibus did not alter the fundamental architecture of the AI Act. The EU continues to regulate AI through a risk-based approach under which unacceptable risk systems are prohibited, high-risk systems are subject to extensive compliance obligations, and lower-risk systems remain subject to transparency and governance requirements. 

One of the most common misconceptions among businesses is that postponing high-risk obligations means AI Act compliance can wait. Several key provisions are already in force.

Prohibited AI practices

Since February 2025, organizations have been required to comply with the legislation's prohibitions on certain unacceptable risk AI practices. These include manipulative AI systems that materially distort behaviour and cause harm, certain forms of social scoring, certain biometric categorization systems, untargeted scraping of facial images to build facial recognition databases, and certain forms of real-time remote biometric identification by law enforcement. 

Organizations developing AI-enabled surveillance, facial recognition, employee monitoring, or customer analytics technologies should assess whether their systems could trigger concerns under the act. This is particularly relevant for security technology providers, defence contractors, infrastructure operators, employers deploying workplace monitoring technologies, and software developers serving European customers.

AI literacy requirements 

The AI literacy obligations became applicable at the same time, requiring organizations to ensure that employees working with AI possess an appropriate level of understanding of the systems being used. 

Organizations using AI-enabled tools should consider whether employees understand the capabilities and limitations of AI systems, the risks of hallucinations, bias and discrimination, privacy and confidentiality concerns, and human oversight expectations.

General-purpose AI rules 

In August 2025, the act introduced a distinct regulatory framework for GPAI models, which are AI models trained on large amounts of data and capable of performing a wide variety of tasks across different applications. Examples include the technologies underpinning ChatGPT (OpenAI), Gemini (Google), Claude (Anthropic), and Toronto-based Cohere's Command family of large language models. 

These models can be adapted to perform a wide range of tasks, from drafting documents and generating software code to powering customer service tools and enterprise knowledge systems.

Recognizing the potential impact of these technologies across various industries, the act imposes specific obligations on providers, including documentation, transparency, copyright-related requirements, and, for the most capable models, additional risk management and cybersecurity obligations.

As a result, Canadian companies may be affected indirectly by customers' procurement requirements, due diligence questionnaires, requests for information on AI governance practices, and expectations regarding responsible AI use.

Transparency obligations 

More recently, transparency requirements came into effect in August. They’re set out in article 50, which is likely the most immediately relevant provision for many Canadian businesses. It requires transparency in certain circumstances where people interact with AI systems or consume AI-generated content.

Requirements may include informing users when they are interacting with an AI system, disclosing AI-generated or AI-manipulated content in certain circumstances, identifying deepfakes and synthetic media, and implementing machine-readable labelling of certain AI-generated content.

Article 50 does not require a blanket disclosure for every use of AI-generated content. The obligations vary depending on the type of content and the context in which it is used. They focus on situations where individuals interact with AI systems or encounter AI-generated or AI-manipulated content that could reasonably be mistaken for authentic human-generated content. 

For Canadian businesses, the most relevant use cases are likely to involve customer-facing chatbots, virtual assistants, candidate-screening assistants, employee-monitoring technologies, and emotion-recognition systems.

AI governance and trade compliance

Like the General Data Protection Regulation (GDPR) before it, the AI Act has extraterritorial reach and applies not only to organizations established in the European Union but also, in many circumstances, to international organizations whose AI systems are placed on the EU market or whose AI-generated outputs are used within the EU. 

Consider a Canadian tech company that develops supply chain software and integrates a third-party large language model to provide automated recommendations and draft reports for customers. If that software is offered to customers in Europe, clients may increasingly ask the company to explain how AI is being used, what safeguards are in place, whether customer data is protected, and how the company manages AI-related risks. 

While the underlying legal obligations may apply primarily to the model provider, the practical compliance expectations are increasingly being transmitted through commercial relationships and supply chains.

The implications are particularly significant in sectors such as defence, aerospace, critical infrastructure, advanced manufacturing, and dual-use technologies, where AI systems may become embedded in products, operational processes, or decision-making frameworks. Organizations are increasingly being asked not only whether they use AI, but how they govern its use, assess risks, and maintain human oversight. This trend is likely to accelerate.

The result is a phenomenon familiar to Canadian lawyers who have advised clients on GDPR implementation: organizations often adopt European standards globally because maintaining separate compliance frameworks across jurisdictions is operationally inefficient and commercially unattractive. 

What Canadian counsel should be doing

The extension of implementation deadlines should not be viewed as an opportunity to defer action. Rather, it should be treated as a valuable preparation window. Legal departments should consider advising clients to:

1. Develop an AI inventory identifying AI systems used, procured, developed, or embedded within business operations.
2. Establish AI governance frameworks that address accountability, documentation, human oversight, and risk management.
3. Review procurement and supplier due diligence processes to evaluate AI-related risks and compliance commitments.
4. Update commercial contracts to address AI-related representations, warranties, transparency obligations, intellectual property issues, confidentiality protections, and allocation of liability.
5. Implement AI literacy and training programs for employees and management.
6. Monitor evolving international AI regulation, including developments in the EU, the United Kingdom, the United States, and Canada.  

Looking ahead

The EU AI Act is rapidly emerging as the global benchmark for AI governance. While implementation timelines have shifted, the strategic direction has not. Europe continues to pursue a model that balances innovation with safety, transparency, accountability, and the protection of fundamental rights. 

For Canadian companies, the question is no longer whether the act matters. The more relevant question is whether organizations are preparing early enough to meet the expectations that the legislation is already creating across international markets.
 

*Views expressed are not necessarily those of the Canadian Bar Association.