EU AI Act 2026: What It Means for Businesses Using Odoo in Hungary (and What It Doesn't)

If you've been reading the panic headlines, you might think the EU AI Act brings billion-forint fines down on every company. The reality is different. The Odoo and AI features a typical business operating in Hungary actually uses, automated invoice reading, demand forecasting, natural-language queries, fall into the lightest category, “minimal risk”, where the regulation sets no special obligations. Two things genuinely matter right now: if you let AI talk to your customers, you need to disclose it, and you need to make sure the colleagues using AI understand what they're doing. The strict rules apply to high-risk uses, and most of those have been pushed back to 2027. The European Parliament and the Council both approved the relevant EU package in June 2026, and it becomes law once published in the EU Official Journal. The HUF 13 billion figure is the ceiling for prohibited practices, not the risk facing a small business running a chatbot.

A note: this isn't legal advice, it's business and technical guidance for owners. If you're operating in a border area, HR, credit scoring, biometrics, healthcare, it's worth getting a separate legal opinion too. Updated 24 September 2026: the dates below have been checked against the primary EU legal source, EUR-Lex.

Panic versus reality

The AI Act is the world's first comprehensive AI regulation, and along with it came the usual wave of scare stories: fines, paperwork, a compliance nightmare. As a business owner, it's understandable to be cautious. But that isn't how the regulation actually works: its logic isn't to bury every use of AI in red tape.

The AI Act doesn't penalise you for using AI. It penalises you for what you use it for. The greater the harm an AI system could cause in someone's life, in a job interview, a credit decision, a medical decision, the stricter the rule gets. Where the stakes are low, the obligations are minimal too. And most small businesses aren't using AI to decide people's fates: they're using it to speed up their own operations, reading invoices, finding data, building forecasts.

The four categories, in plain terms

The regulation sorts every use into four tiers:

• Prohibited. A handful of practices simply aren't allowed: social scoring, for instance, or manipulative systems that can harm people. An ordinary business never comes near these.
• High risk. This is where the strict rules apply: systems that decide people's fates. CV-screening AI, credit scoring, certain biometric tools. Full documentation, human oversight, and logging all come with it.
• Limited risk. Chatbots and AI-generated content sit here. There's one main rule: be transparent. People need to know they're talking to a machine, or that an image or a piece of text was made by AI.
• Minimal risk. Everything else. The regulation sets no special obligation here. Most internal, operations-support AI features can fall into this tier, as long as they don't decide on someone's rights, access, or opportunities.

Where do your Odoo AI features actually fall?

In day-to-day operations, this mostly comes down to the cases below. The AI features typically used inside Odoo at a business operating in Hungary generally sit in the minimal-risk category:

• reading incoming supplier invoices automatically and turning them into accounting entries,
• demand or stock forecasting,
• asking a plain-language question about your own data (“show me the overdue invoices”),
• automation you trigger with a written instruction.

In typical cases, none of this carries a separate AI Act paperwork burden, though data protection and internal controls still apply as always. There's exactly one spot where you need to pay attention: if you run a chatbot that customers can see, that's limited risk, and you need to disclose that the visitor is talking to a machine. The same rule applies to publicly published AI-generated content.

You're in high-risk territory when AI makes an important decision about a person in your place: screening or ranking CVs, or assessing someone's creditworthiness. If you're planning something like that, the task gets more serious, but you have time for that too, more on that in a moment.

Here's an example from practice. A twenty-person trading company reviews what it's actually running. AI reads its incoming invoices: minimal risk. A chatbot answers questions on its webshop: limited risk, so it needs to disclose that visitors are talking to a machine. It doesn't screen CVs with AI during recruitment, so it stays clear of the high-risk part. Five minutes, and the picture is clear: the only real task is labelling the chatbot.

The two things you genuinely need to do now

Here's the good news: if you're using minimal-risk AI, your to-do list is short.

1. Build AI literacy. This is the one obligation that's applied to every organisation using or deploying AI since February 2025. It isn't a form, and it isn't an audit. It simply means the colleagues who use AI understand what the tool can and can't do, and when they need a human to check its work. For most companies, a short, plain-language internal briefing is enough to start: what the tool is good for, what it isn't, and when someone needs to verify it.

2. Label your chatbot. If AI chat answers questions on your website or in customer service, make it clear the visitor is talking to a machine. Since 2 August 2026, Article 50(1) of the AI Act has required providers to make sure people know when they're interacting with AI, unless that's already obvious from the context. If you run a chatbot, check whether yours already makes that clear. Often a clearly visible line at the top of the chat window is all it takes.

That's roughly it for the first round. Everything else mainly matters to businesses considering riskier uses of AI.

What takes effect, and when?

To make the timeline clearer:

• 2 February 2025: prohibited practices and the AI literacy obligation start applying.
• 2 August 2025: the rules for general-purpose AI models kick in.
• 2 August 2026: this is the general date of application for the regulation, and from here the transparency rule for chatbots and generated content applies. Providers of AI systems that generate synthetic content and were already on the market before 2 August 2026 have until 2 December 2026 to meet the labelling requirements in Article 50(2).
• 2 December 2027: the main obligations kick in for high-risk systems classified under Article 6(2) and Annex III.
  2 August 2028: the main obligations kick in for high-risk systems classified under Article 6(1) and Annex I.

Precision matters here. A political agreement on postponing the application of the high-risk rules was reached in spring 2026. The European Parliament approved it on 16 June 2026, and the Council adopted it on 29 June 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. That postponement applies to Chapter III, Sections 1 through 3. These dates don't cover every obligation in the AI Act, and Article 6(5) is excluded from the postponement too. The core point still holds, though: most of the strict obligations don't apply to typical internal Odoo automation, and several elements still leave you time to prepare.

The fines, realistically

The HUF 13 billion figure genuinely exists in Hungarian law, but it helps to know exactly what it covers. It's the ceiling for prohibited AI practices: the cap reserved for the most severe cases, not the risk facing an average company. Breaching high-risk obligations falls into a lower band, and giving false information to the authority falls lower still.

And there are two things that specifically protect smaller companies. The regulation requires fines to be proportionate: an SME can't be hit with the same penalty as a large corporation. On top of that, every EU member state has to provide a free regulatory testing environment where you can safely try out an AI solution, with SMEs given priority. In Hungary, this framework was set up by Act LXXV of 2025, and oversight sits with the NMHH and the new AI Market Surveillance Authority.

For a typical business operating in Hungary that uses minimal-risk Odoo and AI features, and takes care of AI literacy and chatbot labelling, the billion-forint fine bracket isn't, in practice, where you sit.

One question every company runs into: where does the data actually go?

The AI Act is about risk, but alongside compliance there's a related question on a lot of owners' minds: if you use AI, where does your company data end up? On top of that, the AI Act doesn't replace GDPR. The two apply side by side, and personal data is still governed by GDPR.

Where the model runs matters a great deal here. If you upload your documents to an external cloud provider, you have less visibility into what happens to them next. If the AI instead runs in your own environment, or a controlled EU one, it's far easier to keep track of where your documents go and what the provider is allowed to use them for.

That's why I favour solutions where AI works around Odoo and your company's own knowledge base, inside a controlled environment. I build private AI assistants for exactly this reason: the system works from your own data, shows its sources, and you don't have to upload every document to an uncontrolled outside tool. If data control matters to you too, I've written more about this on a separate page.

FAQ

Can I really be fined HUF 13 billion?
The HUF 13 billion figure is the ceiling for prohibited AI practices, not the risk facing an average company. If you use minimal-risk features and take care of AI literacy and chatbot labelling, in practice that fine isn't something you need to worry about.

What does AI literacy actually mean?
It means the colleagues using AI understand what the tool can and can't do, and when they need a human to check its work. A short internal briefing is enough to start; there's no official form for it.

Can an AI feature used in Odoo be classed as high-risk?
Generally not, for typical Odoo use. The usual invoice reading, stock forecasting, and internal queries are typically minimal risk, as long as they don't decide on someone's rights or opportunities. You move into high-risk territory when AI decides a person's fate, in CV screening or credit assessment, for example.

What do I need to do if we use a chatbot?
Disclose that the visitor is talking to AI. This has applied since 2 August 2026, so if you haven't put it in place yet, do it now. In many cases a clearly visible sentence is enough, but the exact wording and placement should be adapted to your actual interface.

Does the AI Act replace GDPR?
No. The two apply side by side; personal data is still governed by GDPR. With AI features, you need to keep an eye on both.

Do I need to act right now?
If you're using minimal-risk AI, the only urgent items are AI literacy and, for a chatbot, labelling. Everything else can wait until you're considering a riskier use.

What's worth doing now

The AI Act isn't a reason to panic, but it's a good excuse to think through where and how you actually use AI. The first step isn't a big legal project. It's a simple AI inventory: where does your company use AI, what data does it touch, is it customer-facing, and does it decide anything about a person? Odoo is a good foundation for this, because you're not guessing from scattered spreadsheets: you see the processes, the data, and every AI touchpoint in one system.

That's why I put together my AI Act checklist for SMEs: go through it, and you'll see what AI features you have, which risk category each one falls into, where there's real work to do, and where it's just unnecessary panic.

Book a free consultation with me at Glazer-Innovation Kft. In one conversation, I'll go through:
1. AI inventory, where are AI features running in your Odoo and on your website?
2. Risk classification, which feature falls into which AI Act category?
3. Actual to-dos, where's the real work (labelling, AI literacy), and where's it just unnecessary panic?
4. Data control, where does your company data end up, and how do you keep it under control?

➜ Request a quote

The consultation is free and no obligation. I don't provide legal opinions, but I can help you see more clearly what's worth checking with a lawyer too.

Glazer-Innovation Kft. is an official Odoo Learning Partner and an accredited supplier. I build AI Act awareness into your Odoo and AI setup from the start, rather than bolting it on afterward.

This article is for information only and doesn't count as legal advice; the exact classification is a matter of interpretation, so get a professional opinion if you're in doubt.