EU AI Act 2026 for Ukrainian IT companies: what applies

The AI Act for Ukrainian IT companies: what applies from 2 August 2026 and what was postponed to 2027

In short

The EU did not postpone the AI Act, it stretched it out over time. We explain when the regulation applies to a company from Ukraine, what has to be done right now under Article 50, what was moved to 2027 and where to look for support.

In the summer of 2026 a convenient idea spread through Ukrainian IT: the EU has postponed the AI Act, so everyone can relax. That is only half true. The Digital Omnibus package of amendments did move the heaviest requirements for high-risk systems to December 2027. But 2 August 2026 was the regulation’s general date of application, and from that day the transparency obligations for chatbots, generated content and deepfakes apply. For Ukrainian product businesses and outsourcing companies working with clients in the EU, this is no longer theory.

In this article we explain when the AI Act applies to a company from Ukraine, which obligations apply already, what was postponed and for how long, what fines are provided for, and where to look for support and funding for compliance. The dates were checked against the text of the regulations on EUR-Lex as of 10 October 2026.

Short answer

The AI Act applies extraterritorially. If a Ukrainian company supplies an AI system to the EU market, or the output of that system is used in the EU, the regulation covers it.
From 2 August 2026 the transparency obligations under Article 50 apply: informing users that they are interacting with AI and labelling generated content. Generative AI systems that were already operating before that date have until 2 December 2026.
The requirements for high-risk systems under Annex III, that is HR tech, education, credit scoring and biometrics, were moved from 2 August 2026 to 2 December 2027. For AI embedded in regulated products the new deadline is 2 August 2028.
Prohibited practices and the obligation to ensure staff AI literacy have applied since February 2025. From 2 December 2026 new prohibitions are added, including on systems for creating intimate images without a person’s consent.
Fines reach €35 million or 7% of worldwide turnover. For SMEs and, after the 2026 amendments, for small mid-cap companies, the lower of the two amounts applies.

What the Digital Omnibus changed

The European Commission proposed simplifying the AI Act in November 2025. The Council and the European Parliament reached a political agreement on 7 May 2026, the Parliament voted on 16 June, and the Council gave its final approval to the amendments on 29 June. Regulation (EU) 2026/1744 was published in the Official Journal of the EU on 24 July and entered into force on 27 July 2026.

AI Act application timeline after the Digital Omnibus amendments: prohibitions, GPAI, Article 50, high risk in 2027 and 2028 — Fig. 1. AI Act application timeline as amended by Regulation (EU) 2026/1744.

The main changes for business:

The deadlines for high-risk systems were moved: those under Annex III to 2 December 2027, those embedded in products to 2 August 2028. These are fixed dates and do not depend on whether the standards are developed in time.
New prohibitions were added from 2 December 2026: systems for creating intimate or sexual images of real people without their consent, and systems that generate child sexual abuse material. There are no grace periods here for systems already on the market.
The AI literacy obligation was softened. Companies must take measures to develop staff literacy, but the regulation does not require them to guarantee a particular level for each employee.
The reliefs for SMEs were extended to small mid-cap companies: simplified technical documentation, a proportionate quality management system and the lower of the two fine amounts.
Registration of systems that the provider itself has assessed as not high-risk was kept, but with a simplified data set.
The deadline for national regulatory sandboxes was moved to 2 August 2027.

“We are making innovation easier without lowering the bar on safety.”

Henna Virkkunen, Executive Vice-President of the European Commission, on the agreement on the AI Act amendments, 7 May 2026.

When the AI Act applies to a Ukrainian company

Article 2 of the regulation extends its scope to providers that place AI systems on the EU market, regardless of where they are established. It also covers providers and deployers from third countries where the output of the system is used in the EU. For typical Ukrainian companies this means the following:

A SaaS product with AI features that is bought by clients from the EU falls under the regulation.
An outsourcing company that develops an AI system to order for a European client is usually not the provider if the product goes to market under the client’s brand. But the client will pass the requirements on to it through the contract and the technical specification.
A company that uses AI only for internal processes in Ukraine has no direct obligations under the AI Act.

Does the AI Act apply to a Ukrainian IT company: prohibited practices, high risk, Article 50 transparency, minimal risk — Fig. 2. A simplified scheme for assessing whether the AI Act applies to your system and which category it falls into.

What needs to be done right now: Article 50

The transparency obligations concern the most widespread products of Ukrainian IT:

Chatbots and virtual assistants. A person must know that they are interacting with an AI system, unless this is obvious from the context.
Generative AI. Generated text, images, audio and video must be marked in a machine-readable format. In June 2026 the European Commission published a voluntary Code of Practice on marking and labelling, which recommends at least two layers of marking, for example metadata and watermarks.
Deepfakes. A deployer that creates or distributes realistic synthetic content about real people or events must disclose its artificial origin.
Emotion recognition and biometric categorisation. People must be informed that such systems are in operation.

On 20 July 2026 the European Commission published guidelines on the transparency obligations, and on 31 July it updated them. This is the document to start a product check with. A breach of Article 50 is punishable by a fine of up to €15 million or 3% of worldwide turnover.

High-risk systems: a year and a half to prepare

Annex III covers AI systems that affect people’s access to work, education, credit and public services. For the Ukrainian market this means above all HR tech with candidate selection, educational platforms with assessment, fintech with scoring, and products with biometrics. From 2 December 2027 the providers of such systems must have in place a risk management system, data quality, technical documentation, logging, human oversight, a conformity assessment and registration in the EU database.

For a company from Ukraine there is one more requirement: before entering the EU market it must appoint, in writing, an authorised representative in the EU. The same applies to providers of general-purpose models, for which this requirement already applies now.

A year and a half seems like a long time, but for a high-risk system it is one or two development cycles. It is better to build the documentation, data and processes now than to rebuild the product in 2027.

Fines

For large companies the higher of the two amounts applies: the fixed sum or the percentage of worldwide turnover. For SMEs, startups and small mid-cap companies it is the other way round, the lower one. Fines for providers of general-purpose models are imposed directly by the European Commission, and since 2 August 2026 it has had the powers to apply them.

What is happening with AI regulation in Ukraine

Ukraine has chosen a step-by-step path. In 2023 the Ministry of Digital Transformation presented a roadmap: first voluntary tools for business, including the HUDERIA methodology, codes of conduct and a regulatory sandbox, then a law modelled on the AI Act. In its first year the Ministry’s sandbox received 90 applications, and 15 products passed an audit.

In 2026 a working group of more than 100 participants under the relevant parliamentary committee is working on the AI law. As of mid-September two chapters and 15 articles had been considered, and work on the chapter on high-risk systems is under way. The draft provides for a list of prohibitions modelled on Article 5 of the AI Act, a list of high-risk areas modelled on Annex III, and a separate approach to defence applications. The bill has not yet been submitted to the Verkhovna Rada.

For business the conclusion is simple: the future Ukrainian law will almost certainly follow the logic of the AI Act. A company that sets up its processes for the European regulation now will not have to rebuild twice.

Where to look for support and funding

We did not find any separate EU grants specifically for AI Act compliance for SMEs. But there are instruments that help cover part of the costs:

European Digital Innovation Hubs. There are six of them in Ukraine, and they are part of the EU network. The Kyiv hub EUnited explicitly lists help with compliance with EU standards, including the AI Act, among its services.
Grants for developing AI products. Programmes of the EBRD, the EIC and national funds allow the costs of documentation, testing and legal support to be included in the budget if they are linked to market entry.
European Commission tools. The AI Act Service Desk, the AI Pact and the single information platform are free of charge and available to Ukrainian companies.

Checklist for an IT company

Draw up a list of all AI systems and features in your products, including third-party APIs.
For each one, determine the company’s role, provider or deployer, and the risk category.
Check your products for compliance with Article 50 right now: notices to users, content labelling, deepfake disclosure.
Document your staff AI literacy measures.
For systems close to Annex III, start collecting technical documentation and planning the conformity assessment before December 2027.
If the product is sold in the EU, decide on an authorised representative.
Include compliance costs in the budgets of grant applications for 2027.

Conclusion

The AI Act was not postponed, it was stretched out over time. Ukrainian IT companies that work with the EU market need to meet the transparency requirements already now, and developers of products for HR, education, finance and biometrics should use the year and a half until December 2027 to prepare. AI Act compliance is gradually becoming not only a legal obligation but also a competitive advantage in negotiations with European clients and donors.

The GetGrant team helps IT companies find grants for developing AI products and entering the EU market, and prepare applications to the EIC, Horizon Europe and EBRD programmes. Current calls are collected in the GetGrant catalogue, and a tailored selection can be ordered on the services page. This article is not legal advice.

Sources

Frequently asked questions

Does the AI Act apply to a company registered in Ukraine?

Yes, if it supplies an AI system to the EU market or the output of the system is used in the EU. A company that uses AI only for internal processes in Ukraine has no direct obligations.

What applies from 2 August 2026?

The Article 50 transparency obligations: informing users that they are interacting with AI, labelling generated content, disclosing deepfakes, and informing people about emotion recognition and biometric categorisation. Existing generative AI systems have until 2 December 2026.

What was postponed and for how long?

Requirements for high-risk systems under Annex III were moved from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products to 2 August 2028.

What fines does the AI Act provide for?

Up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for breaches of other obligations, including Article 50, and up to €7.5 million or 1% for incorrect information. For SMEs and small mid-cap companies the lower of the two amounts applies.

Are there EU grants for AI Act compliance?

The authors found no separate EU grants specifically for AI Act compliance for SMEs. Help is available from European Digital Innovation Hubs, grants for developing AI products from the EBRD, the EIC and national funds, and free European Commission tools.

GetGrant editorial team 16 October 2026