The AI Act for Law Firms, No-Nonsense: What it Requires from August 2026 and What it Doesn't

As of August 2, 2026, a law firm is generally subject to the transparency obligations of the AI Act (Article 50) and the AI literacy duty (Article 4, already applicable — and with new wording from July 27, 2026: support promotion, not guarantee a level); the 'high-risk' obligations of Annex III —including the administration of justice— were postponed until December 2, 2027, with the Omnibus package —Reglamento (UE) 2026/1744—, and an internal copilot of a private firm is not automatically a high-risk system. In this article: the complete, date-by-date verified timeline, the legal criterion that debunks panic selling, and the three duties a small law firm can indeed comply with this very week.

'The AI Act comes into force in August and we'll all be fined.' This phrase circulates in law firms, consultancies, and commercial presentations. Let's contrast it with the text of the regulation — with dates and sources, not opinions.

The real dates (after the Omnibus)

First, some context: in June, the European Union finalized the so-called Omnibus package, which re-schedules parts of the AI Regulation (Regulation (EU) 2024/1689). The Parliament backed it on June 16, and the Council gave its final approval on the 29th. With that, the timeline that matters to a firm is as follows:

— What DOES apply on August 2, 2026: transparency obligations (Article 50) and the bulk of the Regulation. In short: if you use AI externally with third parties—a chatbot that handles queries, generated content you publish—you must disclose it. No more, no less.

— What was ALREADY applicable: AI literacy (Article 4) — and take note, because it changed. As of July 27, 2026, the Omnibus replaced its wording: it now mandates adopting measures to support the promotion of literacy for those who use AI on your behalf, and explicitly states that it does not require guaranteeing a specific level for any particular person. It remains applicable, and continues to be the most cost-effective aspect of the entire regulation; what is no longer valid is that it obliges you to certify anyone's proficiency level.

— What was deferred to December 2027: the "high-risk" obligations from Annex III — the list that includes, among other areas, the administration of justice. This is where you'll find the certifications, audits, and risk management systems that some are already trying to charge you for 'before August'.

— And a fact almost no one mentions: the Spanish supervisory agency (AESIA) is already operational, and the sanctioning caps of the European Regulation itself are applicable from August 2025 — even though the Spanish law that defines these sanctions is still undergoing parliamentary processing. Supervision is not future; it is present. Another reason to do things right — and another reason not to be sold on panic, because panic and diligence are entirely different.

Is your AI copilot a high-risk system?

Read what Annex III says about justice: it covers AI systems used by a judicial authority or on its behalf. A private law firm that uses an internal assistant to prepare its pleadings is not a judicial authority nor acts on its behalf. It is not automatically high risk. Period.

So when someone tells you 'you need to get certified before August or you'll be fined,' ask them two questions: what article? what date? If the argument survives those two questions, listen to it. It almost never survives.

So, what should you do? (the honest list)

Three things. None require an expensive consultant, and all three can be done in July:

1 · Literacy (already applicable, in its new wording). An internal session: what tools we use, what they can do, where they fall short, what they never grasp. If there are two of you in the office, it's a long discussion over coffee. Document it with a date.

2 · Transparency (effective August 2). An inventory of where your firm uses AI externally. If there is a chatbot on the website or generated content you publish, it must be declared. If none of that applies — which is common for a small firm — this obligation, today, hardly applies to you.

3 · Documented Diligence (no fixed deadline). Verify every citation against the official source and ensure it is documented that you did so. This doesn't come from the AI Act: it comes from your professional ethics, from the circular that the legal profession approved this year on the use of AI — and from what a Spanish court already demanded in writing.

The irony we shouldn't lose sight of

The real risk for a small firm in 2026 is not a European fine that arrives in 2027. It's a Spanish penalty that is already happening: the fine for the fabricated appointment, the referral to the Bar Association, the ridicule in WhatsApp groups. That doesn't depend on Brussels or any future date. It depends on how you work this week.

And a note in favor of early action, without fear: serious compliance programs take between 12 and 18 months. Whoever establishes their governance today—written policy, verification, registration—will reach December 2027 strolling, while others run. Advantage, not panic. That's the entire difference between preparing proactively and being forced to buy a last-minute solution.

What I'm Building (And Why I'm Telling You Here)

I'm still working with a select group of legal and accounting firms on an AI-driven workflow system where every statement is anchored to its official source and diligence is fully auditable—precisely the third duty on the list, built into the architecture. It's not finished; I'm building it, and this newsletter openly documents the process.

Frequently Asked Questions

What AI Act obligations apply to a law firm by August 2, 2026?

Generally speaking, the transparency obligations of Article 50 require informing when AI is used for external parties (e.g., a customer service chatbot, published generated content). The literacy duty of Article 4 was already applicable before — with the wording given to it by the Omnibus on July 27, 2026: to support promotion, without requiring a specific level from anyone. High-risk obligations do not come into effect on that date.

Is an AI copilot in a private office 'high risk'?

Not automatically. Annex III covers, in the field of justice, systems used by a judicial authority or on its behalf. A private law firm using an internal assistant to prepare its pleadings is neither a judicial authority nor acts on its behalf. Any commercial argument that presumes the contrary must answer two questions: which article? which date?

What exactly was postponed to December 2027?

Annex III high-risk system obligations (certifications, risk management, audits), following the Omnibus package—Regulation (EU) 2026/1744—approved by the Parliament (June 16) and the Council (June 29, 2026). Annex I (AI embedded in regulated products) has been postponed to August 2028.

What is AI literacy of Article 4?

As of July 27, 2026, Article 4 obliges providers and deployers to «take measures to support the promotion of AI literacy» among their staff and those operating systems on their behalf, taking into account their knowledge, training, and the context of use — and adds that «this obligation does not require them to… guarantee a specific level of literacy… for any particular person». The previous wording, which did refer to guaranteeing a sufficient level, was replaced by Regulation (EU) 2026/1744. In a small office, this is fulfilled through a documented internal session covering: which tools are used, their limitations, and what responsibilities users should never be entrusted with.

Can someone in Spain already sanction me for using AI?

Yes, but not as you might think: the Spanish law that defines the AI Act's sanctions is still undergoing parliamentary processing (the European maximums are applicable from August 2025), and meanwhile, Spanish courts have already penalized in 2026 for lack of diligence — fabricated, unverified citations — with a fine and referral to the Bar Association. The current risk is diligence, not Brussels.

Sources for this article

• Regulation (EU) 2024/1689 (EUR-Lex)
• Regulation (EU) 2026/1744 ('Omnibus'): replaces Article 4 and reschedules Article 113 of Regulation (EU) 2024/1689. The text of Article 4 cited herein has been collated character by character against the version published in the OJEU.
• Official note from the Judicial Branch regarding the order of the High Court of Justice of the Canary Islands.
• Circular 3/2026 of the General Council of the Spanish Bar.

Sources verified on Jul-6-2026. This blog doesn't ask for faith: it links to the source.

Updated on August 25, 2026. This article was originally published stating that Article 4 required to "guarantee" a sufficient level of AI literacy. That wording was replaced on July 27, 2026 by Regulation (EU) 2026/1744: the duty still exists, but now consists of supporting the promotion of literacy, and the article itself clarifies that it does not require guaranteeing a specific level for any individual. Corrected in the text. The implementation schedule we published remains unchanged.

Every two weeks I publish an analysis like this in the PYME Digital PRO newsletter: digitalization for law firms, consultancies, and professional SMEs, without the hype. Subscribe on LinkedIn.