The AI Act and the Processing of Business Documents—What Can Companies Expect in 2026?

Artificial intelligence has long ceased to be a technological novelty - it is now an everyday tool for working with documents, data, and communication in companies of all sizes. As its use becomes more widespread, the EU’s “AI Act” is coming into effect, establishing the rules for the use of such solutions. For companies that work with large volumes of documents - financial, legal, and transaction-related - on a daily basis, this is an issue that should not be put off.

What exactly will change in 2026?

In the summer of 2026, a package of amendments to the AI Act - known as the “Digital Omnibus” - was passed, postponing some deadlines for implementing the regulations. However, this does not mean a general postponement of the obligations - that is a misinterpretation that should be clarified right away.

The amendment primarily postpones:

• the obligations for standalone high-risk AI systems - to December 2027,

• the obligations for high-risk systems integrated into other products -to August 2028,

• the deadline for establishing national regulatory sandboxes - to August 2027.

The transparency obligations, however, have not been postponed, and these affect the largest group of companies, as they take effect on August 2, 2026, and do not require the use of advanced technologies or complicated procedures. Who is subject to the transparency requirements?

This is one of the most frequently overlooked aspects of the AI Act - it is sufficient for a company to use a chatbot on its website, a marketing content generator, or a tool for automatically translating documents to be subject to these regulations.

In practice, this means the following measures are required:

• informing users that they are interacting with an AI system (e.g., in customer service chatbots),

• labeling content that has been generated or substantially modified by AI,

• and maintaining basic documentation regarding the AI tools used.

For companies that work with confidential documents - whether in the context of transactional, legal, or financial processes - another aspect is of particular importance: the obligation to ensure an appropriate level of AI literacy among employees who use such tools. This requirement takes effect as early as February 2025.

AI and Personal Data in Documents - Let's Not Forget the GDPR

The AI Act does not apply in isolation from other regulations. If an AI tool processes documents that contain personal data - which, in practice, applies to the vast majority of business records - the GDPR also applies. According to the data protection authority, conducting a data protection impact assessment (DPIA) is almost always required when implementing AI, particularly when processing data on a large scale or when engaging in automated decision-making.

It is worthwhile to conduct such an assessment before the tool is put into daily use, rather than after the fact. This significantly facilitates discussions with customers and business partners, who are increasingly asking service providers directly about the GDPR compliance of the AI tools being used.

What does this mean in practice for companies that work with documents?

For organizations that use AI tools on a daily basis to analyze, categorize, or translate documents - for example, as part of due diligence reviews, audits, or transactions - the following is already of critical importance:

• creating an overview of the AI tools in use - which processes and documents are affected,

• reviewing the providers - whether the AI tools used by the company (whether in-house or provided by partners) meet transparency and data security requirements,

• updating contracts with providers - to include provisions on information obligations, data security, and traceability, as well as training the team - in accordance with the existing requirement for AI competence.

For a medium - sized company, the audit and the preparation of the corresponding documentation typically take anywhere from a few to several weeks; therefore, July and August 2026 are the latest dates to address these matters without time pressure.

Data Security as the Common Denominator

Regardless of the stage a company is at in implementing the AI Act, one thing remains the same: documents processed by AI tools - especially confidential documents, transaction data, or those containing personal data - should remain in a secure, controlled environment. Using solutions that process documents locally within a secure system, rather than transferring them to external, unverified tools, significantly facilitates compliance with both the AI Act and the GDPR.

Summary

The AI Act is not a one-time implementation project, but rather a shift in the way companies use AI tools in their day-to-day operations. The extension of deadlines for high-risk systems should not lead to complacency - the transparency requirements take effect as early as August 2026 and apply to virtually every company that uses AI, even in its day-to-day work with documents.

About Us

DealDone is a specialized company that offers high-quality products in the field of information and data security. We provide digitization services and software based on modern technologies for handling confidential information, classified information, and sensitive data, as well as for the digitization, backup, encryption, and delivery of data and documents both within and outside organizations.

For nearly 15 years, DealDone has specialized in providing solutions for the digitization, archiving, and distribution of documents in the form of a Document Management System (DMS) or a Virtual Data Room (VDR).

DealDone independently developed and launched the SECUDO VDR system. SECUDO is a platform for the secure digitization, archiving, exchange, and processing of corporate documents and data, offered as a cloud solution in a Software-as-a-Service model for business customers.

DealDone also owns the portals www.platformainwestora.pl and www.sprzedamfirme.com, through which the company supports transaction processes related to the sale of companies, fundraising, and the search for investors for projects.

In 2025, DealDone joined the international platform Dealsuite (www.dealsuite.com), which supports professionals in the field of mergers and acquisitions (M&A). Thanks to this collaboration, we can respond even more effectively to market needs and offer our clients VDR SECUDO—a secure and intuitive solution for document management in transaction processes.