EU AI Act: the real calendar and what it means for Brazilian companies

The AI Act risk framework has four levels: unacceptable (prohibited — social scoring, subliminal manipulation), high (health, credit, HR, critical infrastructure — requires strict documentation, human oversight, activity logging), limited transparency (chatbots, deepfakes — requires labeling) and minimal (spam filters, games — no obligation).

For SMBs, direct impact comes through two paths: (1) if you operate or sell to the EU with any AI feature, you must classify risk and document; (2) if you're a B2B supplier to a European company, you'll receive their compliance questionnaire and must answer — without that, they won't contract you.

June 2026 update: the Digital Omnibus was approved (Parliament June 16, Council June 29) and deferred high-risk obligations — standalone Annex III to Dec 2027 and product-embedded systems to Aug 2028. But the August 2026 general applicability was upheld, including Article 50 transparency duties (labeling AI interaction and deepfakes). And 80% of required controls overlap with ISO 27001, GDPR and LGPD — instrument those and the path is largely paved.