The European Union’s AI Act is the first broad law on artificial intelligence, and a 2026 update changed its timeline. I expect most U.S. community organizations are not directly covered, but the Act is shaping what AI vendors build and what good practice looks like. Information current as of October 7, 2026. I will update this post if dates change.
This is general education, not legal advice.
The basic idea: rules scale with risk
The Act sorts AI into four groups. Prohibited uses are banned outright. High-risk uses face strict requirements. Some systems, such as chatbots and AI-generated content, carry transparency duties, mainly telling people they are dealing with AI. Everything else is minimal risk and has no specific rules beyond general duties such as AI literacy.
What changed in 2026
According to the European Commission’s AI Act page, the “AI Omnibus,” which entered into force on July 27, 2026, delayed the high-risk rules. The key dates now are:
- Banned practices, and a duty on covered organizations to build AI literacy, began on February 2, 2025.
- Rules for the companies that build the large AI models behind tools like chatbots began on August 2, 2025.
- Transparency rules apply from August 2026.
- High-risk uses, such as AI that helps decide hiring or school placement, moved from August 2026 to December 2, 2027. High-risk AI built into regulated products moved from August 2027 to August 2, 2028.
The Commission’s page also lists a new ban on AI that creates intimate images without consent. Law-firm summaries add two details: that ban has a transition period to December 2, 2026, and generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to meet the rule on marking AI-generated content. Summaries also report that the Omnibus softens the AI literacy duty, from ensuring staff have enough AI knowledge to taking measures to support it. Summaries differ on details, so check the official text before relying on any single point. (I offer AI literacy training, so weigh my view on that duty accordingly.)
Does it apply to a U.S. organization?
It can. According to the Commission and public summaries, the Act covers providers that sell AI into the EU and organizations that use AI professionally in the EU, and it also reaches organizations outside the EU whose AI systems’ outputs are used there. In my view, a Baltimore nonprofit with no EU programs, staff, participants or users of its AI tools’ outputs is unlikely to be covered directly, but I cannot make that call for you. If you have EU partners, donors or users, ask counsel.
Why it still matters here
This section is my analysis. Even if the Act never applies to you, three things are worth taking from it:
- Vendors may change what they offer. Some companies that sell worldwide build to the strictest rule, so you may see more AI disclosures from tools you already use. Ask for them.
- Risk tiers are a useful habit. Asking “how much harm could this use cause if it goes wrong?” helps you decide where to be careful. Drafting a newsletter is not the same as screening applicants.
- Telling people when AI is involved is becoming normal. Plain disclosure to families, participants and funders is good practice whatever the law says.
My AI readiness checklist and AI readiness assessment use the same risk-based thinking.
Join the conversation
Has a vendor or an EU partner mentioned the EU AI Act to you? Tell me through the contact page, in general terms. Please do not include names, contact details or any information about children or families. I may share common themes, without naming anyone, in a future post.
Sources (all free to read)
- European Commission: AI Act (official)
- Future of Life Institute: High-level summary of the AI Act (nonprofit summary, general background)
- Gibson Dunn: EU AI Act omnibus agreement (law-firm summary, not official)
This post is general education, not legal advice. Jackson Allen LLC is not a law firm. For questions about your organization’s obligations, talk to a qualified attorney.
