The AI Act and the TravelTech ecosystem (I): what is in force today and who it applies to

This is the first of three posts on how Regulation (EU) 2024/1689, the Artificial Intelligence Act, affects businesses in the TravelTech ecosystem. Here we explain what is in force as at September 2026, what role each company plays in relation to each system and how risk is classified. The second post looks at eight specific use cases in the sector. The third covers what the AI Act does not regulate but still affects you (GDPR, consumer law and contracts) and sets out a 90-day work plan.

On 7 September we opened the legal block of the TechTur Legal Series, organised by the Tech Tourism Cluster, with a session on the EU AI Act and how it applies to tourism businesses. Codurance handled the technical block. The room was full of product, technology and management people from TravelTech companies, and the question we heard most often at the end was the same one we have been hearing since 2024: “But does this actually apply to us?”

The short answer is yes, almost certainly, though not in the way many fear. What follows is an expanded version of that session, written so that someone at an OTA, a bedbank, a hotel chain, a channel manager or an activities startup knows where they stand.

The essentials in five lines

• The AI Act has been in force since 1 August 2024 and applies in phases. Already enforceable are the prohibited practices, AI literacy, the obligations for general-purpose models, the penalties regime and, since 2 August 2026, the transparency obligations in Article 50.
• Regulation (EU) 2026/1744, the so-called AI “Digital Omnibus”, in force since 27 July 2026, has postponed the high-risk regime to December 2027 (Annex III) and August 2028 (Annex I). It has not changed the transparency obligations: it only gives systems already on the market until 2 December 2026 to mark generated content.
• Your obligations depend on the role you play in relation to each AI system (provider, deployer, importer, distributor), not on your sector or your size.
• The regime depends on the risk of the specific use, not on the fact of using AI. In tourism, most cases fall into transparency risk or minimal risk.
• In Spain the supervisory authority is AESIA, and a Draft Organic Law on the proper use and governance of AI has been going through the Spanish Parliament (Congreso) since June 2026.

Why the AI Act matters to TravelTech even if you don’t sell “AI”

AI is already part of the product of almost every company in the sector, even if you don’t call it that: a customer service chatbot on WhatsApp, a revenue management engine that adjusts rates according to demand, a destination recommender on the home page, automated CV screening, identity verification at online check-in, an internal copilot for operations, a generator of room photos and descriptions, or a tool for analysing and responding to reviews. Many of these uses fall within the scope of the AI Act if they meet the definition of an AI system.

We see three risks that are already on the table:

• Regulatory. Transparency has been enforceable since 2 August 2026 and there is already an authority, AESIA, with power to supervise.
• Reputational. Generated images that do not match the real hotel, or bots that pass themselves off as people to a traveller who thinks they are talking to reception.
• Contractual. This is the one that gets the least attention: the AI provider shifts liability onto you by contract, or simply guarantees you nothing.

The problem with the AI Act in TravelTech is not that the law is harsh. It is that most companies still do not know what role they play in relation to each system or which risk level each use falls into. Without that, you cannot comply, nor can you negotiate sensibly with whoever sells you the technology.

The legal basis you need to have to hand

Regulation (EU) 2024/1689. This is the Artificial Intelligence Regulation, known as the AI Act. In force since 1 August 2024, with staggered application between 2025 and 2028.

Regulation (EU) 2026/1744. This is the AI “Digital Omnibus”, in force since 27 July 2026. It postpones the high-risk regime, adjusts the scope of the AI literacy obligation in Article 4 and adds two prohibitions to Article 5, applicable from 2 December 2026. It keeps the transparency obligations in Article 50; it only changes paragraph 7, on codes of practice, and gives a transitional period for marking in systems already on the market.

Spain. The Spanish Agency for the Supervision of Artificial Intelligence (AESIA) is the supervisory authority. The Draft Organic Law on the proper use and governance of AI has been going through the Spanish Parliament since June 2026, still with no fixed approval date. It is worth tracking, but not worth waiting for.

The AI Act applies because of what you do with the system, not because of your sector or size

This is the idea that is hardest to take on board and the one that changes everything. The AI Act does not regulate “AI companies”: it assigns obligations according to the role you play in relation to each specific AI system. And you can play several roles at once, with different systems.

Provider

The provider is whoever develops an AI system or places it on the market under its own brand. In TravelTech you are a provider if you sell your own AI engine to hotels or agencies. You are also a provider if you integrate a third-party model (an LLM from OpenAI, Anthropic or Google, for example) and market it as a white-label product as if it were your own. This second case is far more common than it seems: a channel manager that offers “our AI assistant” built on someone else’s model is, for the purposes of the AI Act, the provider of that system.

Deployer

The deployer is whoever uses an AI system under its authority in the course of its professional activity. This is the most common role in tourism: the hotel with a chatbot it has contracted, the OTA with a third-party recommender, the agency with a pricing tool supplied by its technology partner or the tour operator using a copilot to draft itineraries. You did not build the system, but you operate it and decide what it is applied to.

Importer and distributor

The importer brings into the EU a system from a provider established outside it. The distributor makes it available on the market without being the provider or the importer. This comes up when you resell AI software from outside the EU to your customers, something that happens in B2B hotel distribution more often than you might think.

Reach beyond the EU

The AI Act also applies to providers and deployers established in a third country where the output of the system is used in the EU (Article 2). A bedbank in Dubai or a pricing engine in the United States serving European hotels is not excluded just because it is outside the EU. And if you are the European customer of that provider, you are the deployer of a system whose provider may not know that the AI Act applies to it. That is where the contractual problem we cover in the third post begins.

AI Act timeline as at September 2026

Following Regulation (EU) 2026/1744, the timeline now stands as follows:

Two points to note. First, postponing the high-risk regime changes the timetable, not the content: risk management, technical documentation, human oversight and conformity assessment remain the same, they simply arrive later. Second, the next relevant milestone for TravelTech is 2 December 2026, when the transitional period for technical marking of synthetic content ends for systems that were already on the market. If your image or text generation tool was up and running before August, you have until December to make marking work without exception.

Risk levels: the regime depends on the use, not on the fact of using AI

The AI Act sets four levels. In tourism, most cases fall into the last two, and that is the best news anyone can give a company in the sector today.

Prohibited

Cannot be used in the EU. This includes subliminal manipulation or the exploitation of vulnerabilities, emotion recognition in the workplace and biometric categorisation to infer ethnic origin or other sensitive categories. In TravelTech it is rare, but not impossible: a “wellbeing analysis” tool for the reception team based on facial expression, or a check-in system that classifies travellers by their features, would fall here. The only possible action is to drop the use.

High risk

This is Annex III, applicable from 2 December 2027. It includes staff selection and assessment, remote biometric identification and creditworthiness assessment if you offer financing to the traveller. It covers HR tools with automated screening, certain biometric verification systems and BNPL or financing flows built into a booking checkout if they include automated scoring. It requires risk management, documentation, human oversight, registration and conformity assessment.

Transparency risk

This is Article 50, applicable since 2 August 2026. It includes chatbots and voicebots, generated images, video and audio, deepfakes and generated text on matters of public interest. This is where most of the sector sits: the booking assistant, the after-sales bot, generated photos for a hotel listing or synthetic promotional videos. The obligation is to inform users that they are interacting with an AI and to mark or label the content.

Minimal risk

No specific obligations under the AI Act. This includes the destination recommender, the ranking of results, demand-based pricing and review analytics. No obligation under the AI Act does not mean no obligations at all: the GDPR, consumer protection law and your contracts still apply and, in many cases, are more demanding than the AI Act itself.

General-purpose AI models (GPAI)

The obligations on general-purpose models (documentation, copyright, marking) fall on whoever develops them. If you build on them, as is usual in TravelTech, you need to read their documentation and terms and classify the system you build on top. The base model has its obligations and your system has its own, and they are not the same.

The real question: what role do we play and which level does each use fall into?

The conversation about AI usually starts in the wrong place: whether the product “has AI” or whether the provider “complies with the AI Act”. And it ends without anyone learning anything useful.

We have seen pricing engines that management regarded as “a business rule” and that were in fact models trained on specific customers’ data. Chatbots deployed in more than twenty markets that worked perfectly from a technical standpoint but gave out cancellation terms nobody had checked against local consumer law. Contracts with AI providers whose only compliance clause was that the customer assumed all liability.

In none of those cases was the law the problem. The problem was that nobody had taken an inventory of which systems existed, what role the company played in relation to each one and which risk level each use fell into. That inventory is, by a wide margin, the most cost-effective thing a TravelTech company can do today in relation to the AI Act.