AI regulation in 2026: what do we need to prepare? Start with 6 steps

For most Taiwan businesses, two things matter right now. If your AI chatbot answers European customers, tell them they're talking to AI. Whether or not you have EU customers, Taiwan's Personal Data Protection Act already applies. If you use AI to screen résumés or assess credit, there's more to prepare.

In 2026, the rules around AI are taking shape: the EU AI Act's transparency duties started to apply on August 2, and Taiwan's AI Basic Act took effect in January. Sometimes the question comes from a customer, like a German customer's supplier questionnaire asking, "Do the AI systems your company uses comply with the EU AI Act?"

Below are two prompts for an AI assistant and six things you can do now, followed by the timeline and the rules. (This article reflects the situation as of September 2026. It's general information, not legal advice; talk to a lawyer about your specific situation.)

Ask AI first

Give an AI assistant such as ChatGPT, Claude or Gemini a list of where you use AI, or one workflow, and it can draft an inventory and flag the steps that touch personal data. Copy these and swap in your own details (the ones below are examples).

Draft an AI inventory

Here's where our company uses AI: a chatbot on our website (it answers inquiries in English), marketing making product images with AI, and HR trying out AI to screen résumés. Turn this into an AI inventory with these columns: use, tool or vendor, data it handles (including personal data), who it serves (including anyone in the EU), owner (leave blank), and the likely risk level under the EU AI Act (prohibited, high-risk, transparency, minimal). Mark anything you're unsure of as "to confirm" and say why. Give me a table I can paste into a spreadsheet.

Find the steps that touch personal data

Attached is our workflow from inquiry to delivery: inquiry, quote, order, payment, shipping, after-sales. For each step, list the personal data it uses, whether it goes into an outside AI service, and whether the step really needs it. Finish with a table: step, personal-data fields, sent to AI (yes/no), recommendation (keep, delete, or replace with a code).

The result isn't legal advice, and the AI may not know the latest dates, such as the delays that took effect in July 2026. Have the person responsible check the risk levels and duties against the official sources linked below, and bring in a lawyer for anything EU-related or high-risk. If your list or workflow includes real customer names or phone numbers, replace them with codes first, or use your company's enterprise plan.

6 things you can do now

1. Build an AI inventory in a spreadsheet, with a risk level for each use

Paste the table from the first prompt into a spreadsheet and fill in the owners, including AI tools employees signed up for on their own. Then confirm each risk level against the EU's four levels and the Taiwan framework below, so you know what's high-risk and what carries transparency duties.

2. Have your chatbot say up front that it's AI

Add a line to your AI chatbot's first message, e.g. "I'm an AI assistant; I'll hand complex questions to a person." The Commission's draft guidelines say a line buried in the terms of use, or vaguely calling it an "assistant," isn't enough: the disclosure has to appear in the conversation itself. If your AI chatbot runs on a LINE Official Account (LINE is the messaging app most Taiwanese customers use), you can put the same line in the welcome message new friends receive.

3. Keep the markers your tools add, and treat marketing assets case by case

Generative AI tools usually embed watermarks or metadata in their output; keep them through editing. An ordinary product lifestyle image isn't necessarily a deepfake. Making a real person "say" something they never said, or synthesizing footage that looks like a real event, needs a clear label. Write both rules into your content workflow.

4. Ask your vendors four questions

• Is our input used for training? Where is it stored, and for how long?
• Is generated content marked in a machine-readable way?
• Will you notify us before model changes?
• If the product is used in the EU, can you provide the documentation and instructions for use the law requires?

5. Give AI only the personal data it needs

Before pasting customer data into an outside AI service or training a model on customer conversations, ask: "Is this within the purpose we told people about?" Start with the fields the second prompt marked "delete" or "replace with a code," de-identify where you can, and update your privacy notice.

6. Keep a person reviewing consequential decisions, and keep records

For hiring, lending and dismissals, AI recommends and a person decides, and the reviewer must understand the reasoning and have the authority to override it. If you process EU residents' personal data, the GDPR already restricts fully automated decisions with significant effects. Also record which model version was used, inputs and outputs, and who approved what. Deployers of high-risk systems in the EU must keep logs for at least six months (Article 26, applying from December 2027).

The timeline: what's in force and what's been delayed

The official schedule is on the European Commission's AI Act Service Desk timeline.

The EU AI Act: when it applies to a Taiwan company

The EU AI Act (Regulation (EU) 2024/1689) doesn't depend on where your company is based. Under Article 2, it can apply if:

• you sell an AI system or a product with AI in it on the EU market;
• you have a presence in the EU and use AI in your business; or
• your company is outside the EU but the output of your AI system is used in the EU, for example an AI chatbot on your English-language website answering European customers.

The law also distinguishes two roles: the provider (who develops an AI system and offers it under their own name) and the deployer (who uses an AI system in their business). If you build a chatbot on a large-model API and put it on your website, you may be both. If you use an off-the-shelf SaaS tool, you're most likely a deployer.

Four risk levels

• Prohibited: for example social scoring, manipulating people by exploiting their vulnerabilities, and emotion recognition at work or in schools.
• High-risk: the uses listed in Annex III, including recruitment and HR (screening résumés, evaluating employee performance), creditworthiness assessment of individuals, education and more, plus AI safety components in products covered by EU product-safety laws.
• Transparency: chatbots that talk to people, AI that generates content, and deepfakes.
• Minimal risk: inventory forecasting, spam filters, internal document summaries and the like. No extra duties, though data protection and other laws still apply.

Maximum fines depend on the tier: up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for breaching high-risk or transparency duties. For small and medium-sized businesses, whichever amount is lower applies.

What was delayed, and what wasn't

In November 2025 the Commission proposed the "Digital Omnibus." Its AI part was adopted as Regulation (EU) 2026/1744 and took effect on July 27, 2026 (Commission announcement):

• Delayed: Annex III high-risk duties move to December 2, 2027; high-risk AI in products moves to August 2, 2028.
• Eased: the AI literacy duty changes from "ensure staff have sufficient AI literacy" to "take measures to support it," and simplifications for small businesses now extend to "small mid-caps."
• Not delayed: Article 50 transparency duties still applied from August 2, 2026. The only relief is for machine-readable marking of AI output: systems already on the market before August 2 have until December 2.
• Added: a ban on using AI to generate non-consensual intimate images and child sexual abuse material, applying from December 2, 2026.

Delayed doesn't mean cancelled. If you use AI for hiring or credit decisions, use the extra time to get your documentation, review process and records in order.

From August 2: what the transparency duties cover

Article 50 is the provision that touches the most companies. In July the Commission published guidelines on the transparency obligations, and in June a voluntary Code of Practice on marking and labeling AI-generated content.

Steps 2 and 3 above cover the day-to-day side. A chatbot that answers only from your own content and hands off to a person when it can't find an answer (see AI customer service that answers from your own content) reduces risk more than adding labels after the fact.

Taiwan: the AI Basic Act is in force, the details are still coming

Taiwan's AI Basic Act passed the Legislative Yuan, Taiwan's parliament, on December 23, 2025 and was promulgated and took effect on January 14, 2026. It has 20 articles, and the lead authority is the National Science and Technology Council (NSTC). As a "basic act," it mainly sets out what government must do:

• Government AI policy must follow seven principles: sustainability and well-being, human autonomy, privacy and data governance, cybersecurity and safety, transparency and explainability, fairness and non-discrimination, and accountability.
• The Ministry of Digital Affairs (MODA) is responsible for a risk classification framework aligned with international standards. Version 1.0 was published in July 2026. It sorts AI risks into 3 categories and 20 subcategories and recommends four steps: inventory, identify, assess, respond.
• Sector regulators are to write risk-based rules using that framework, and government must finish adapting its laws within two years of the Act taking effect. For uses designated high-risk, the Act calls for warnings or cautionary labels, clear allocation of liability, and remedy, compensation or insurance mechanisms.

In other words, the Basic Act itself doesn't fine companies, but the direction is clear, and sector-specific rules will arrive over the next two years.

Laws that already apply

• Personal Data Protection Act (PDPA): tell people why you collect their data, use it only within that stated purpose, and keep it secure. The PDPA was amended in November 2025, adding rules such as breach notification; the Executive Yuan (Taiwan's cabinet) will set the effective date, so keep an eye on it.
• Sector rules: for example, the Financial Supervisory Commission's AI guidelines for the financial industry set expectations on fairness, explainability and governance.
• Your existing responsibilities stay the same when AI is involved: Taiwan's Employment Service Act prohibits hiring discrimination, so if an AI résumé screener systematically filters out candidates by age or gender, the company is still responsible.

When to consider the next step

All of the above can start with an AI assistant, a spreadsheet and the tools you already have. It's worth building it into your systems when:

• Customers' supplier questionnaires start asking how you use AI, or want to see records.
• AI shows up in more places, and you keep redoing the inventory and pasting it into an AI to check.
• You plan to have AI help with consequential decisions like hiring or lending.
• AI is already connected to your back office and changes data or sends email.

The next step: build review and records into the systems you have

You don't need to replace your current systems. Add three things to your existing workflows, one workflow at a time:

1. One place for the inventory: the owner, risk level and vendor for each AI use live together, and the owner is notified when something changes.
2. Review built into the workflow: AI recommends with its reasoning, and nothing takes effect until a person confirms or overrides it. For example, Jev, StudioX's decision model, outputs a decision plus a confidence value, and anything below the threshold goes to a person.
3. Records kept automatically: the model version, inputs and outputs, and who approved what are logged by the system.

Our AI assistant, Xena AI, follows the same principle: it always asks a person before changing data, logs every step and can be set to read-only. Early on, the new way can run alongside the old one. For which actions need a person, see how to set up human confirmation.

The rules will keep changing, but an inventory, risk classification, labels, human review and records will be useful however they end up. To see where to start, try a free AI Health Check, or take a look at our AI adoption services and custom business systems. You're also welcome to get in touch.