top of page

The EU AI Act Compliance Deadline Is August 2 — What It Actually Means

S. West
Jul 8
10 min read

Updated: 4 days ago

Correction, 3 October 2026. When this post went up in May, it said the August 2 deadline would not be delayed further. It was. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. It moves the stand-alone Annex III high-risk obligations to 2 December 2027 and high-risk AI inside regulated products (Annex I) to 2 August 2028. The original also said pre-existing high-risk systems get no grandfathering, which was wrong even before the Omnibus. The sections below are corrected. We've kept the original title so existing links still work.

The EU AI Act entered force in August 2024. Plenty of the organisations it affects spent the following two years waiting for it to be softened, or assuming their vendors would handle it. In July 2026, the waiting half paid off: the EU deferred the biggest block of obligations by sixteen months.


Only half. The general application date, 2 August 2026, did not move. The transparency duties in Article 50 applied on schedule, and so did the Commission's power to fine general-purpose AI providers. What moved was the high-risk regime, and it moved because the harmonised standards and national authorities weren't ready, not because the requirements were abandoned.


This post is the plain-English version of what applies now, what moved, and what to do with the extra time.


What Applied on 2 August 2026, and What Moved


The Act rolls out in stages. The unacceptable-risk bans (social scoring, manipulative AI targeting vulnerable groups, most real-time remote biometric identification in public spaces) and the AI literacy duty applied from February 2025. General-purpose AI (GPAI) obligations applied from August 2025.


What applied on 2 August 2026, as scheduled:


  • Article 50 transparency. Providers must design AI systems that talk to people so the person knows they're dealing with AI, unless that's obvious. Providers of generative systems must mark synthetic audio, image, video and text in a machine-readable way. Deployers must disclose deepfakes and emotion-recognition use, and must label AI-generated text published on matters of public interest unless it went through human editorial review. There is one grace period: generative systems already on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking duty.

  • The Act's general date of application. The Omnibus did not change it, except for provisions it gave their own dates.

  • Commission enforcement against GPAI providers, including fines of up to €15 million or 3% of worldwide turnover.


What moved:


Obligation

Original date

After Regulation (EU) 2026/1744

Annex III high-risk (employment, credit, education, essential services, etc.)

2 Aug 2026

2 Dec 2027

Annex I high-risk (AI in medical devices, machinery, toys and other regulated products)

2 Aug 2027

2 Aug 2028

Art. 50(2) marking, for generative systems already on the market

2 Aug 2026

2 Dec 2026

New prohibition: AI generating child sexual abuse material or non-consensual intimate imagery

—

2 Dec 2026 (new)


Grandfathering. The original version of this post got this wrong. Under Article 111(2), a high-risk system placed on the market before the high-risk rules apply comes into scope only if its design changes significantly after that date. The exception is systems intended for use by public authorities, which must comply by 2 August 2030. "We launched it before the deadline" is a strong position for a frozen system. It's a weak one for a system you keep retraining and redeploying. Whether a given change counts as "significant" is a legal call to make per system, and you want it made before a regulator asks.


Who Actually Falls Under This


The Act has three primary audiences: providers (who build or place AI systems on the market), deployers (who use those systems professionally), and GPAI providers (the labs behind foundation models). The obligations differ.


If you build an AI system, you're a provider. If you fine-tune or substantially modify someone else's system, you may be reclassified as a provider of that modified system. If you use an AI system in your work — even if you didn't build it — you're a deployer, and you have your own (lighter) obligations.


The extraterritoriality is the part most US companies underestimate. The Act applies to:


  • Providers placing AI systems on the EU market, regardless of where the provider is based

  • Deployers in the EU

  • Providers and deployers outside the EU where the output is used in the EU


That last clause is broad. If a French company uses your US-built AI tool to screen candidates, you're a provider for purposes of that deployment. If a Spanish bank uses your US-built credit-scoring API, same thing. The factual test is where the output lands, not where the model runs.


High-Risk Classification


Most of the obligations attach to high-risk systems. The classification is what matters operationally — most companies either definitely have a high-risk system or definitely don't, but a sizable middle ground requires careful analysis.


A system is high-risk if it falls under either:


  1. Annex I: AI as a safety component of a regulated product (medical devices, toys, machinery, aviation, automotive). If your AI is inside a product that already needs CE marking under EU product safety law, the AI Act stacks on top.

  2. Annex III: AI used in one of eight specific domains:

    • Biometric identification and categorization

    • Management of critical infrastructure (water, gas, electricity, transport, digital)

    • Education and vocational training (admissions, evaluation, monitoring)

    • Employment and worker management (recruitment, performance evaluation, task allocation)

    • Access to essential private and public services (credit scoring, insurance pricing, eligibility for benefits)

    • Law enforcement (risk assessment, polygraphs, evidence evaluation)

    • Migration, asylum, and border control

    • Administration of justice and democratic processes


There's an escape valve: a system in an Annex III category is not high-risk if it performs a narrow procedural task, improves the result of a previously completed human activity, doesn't substantially influence the decision, or is preparatory only. This is meant to exclude AI that proofreads cover letters from the recruitment classification. It's narrow. Most production AI in these domains qualifies as high-risk.


If you're high-risk, the obligations are extensive: risk management system, data governance, technical documentation, transparency to deployers, human oversight, accuracy and robustness, cybersecurity, post-market monitoring, conformity assessment, registration in an EU database, CE marking. None of these are trivial. Most are multi-month projects if you haven't started.


GPAI: The Quiet Heavy Lift


The GPAI obligations — on the labs and companies that build general-purpose foundation models — activated in August 2025 and are now in force. They're easy to forget about because they apply to a small number of companies, but the downstream consequences for everyone integrating those models are significant.


GPAI providers must produce technical documentation, share information with downstream providers, comply with EU copyright law in their training (including a published summary of training data), and implement a policy to respect text and data mining opt-outs. Models classified as having systemic risk (large compute thresholds — currently 10^25 FLOPs and above) have additional obligations: model evaluation, systemic risk assessment, incident reporting, and cybersecurity protection.


If you're integrating a frontier model into your product, your vendor's GPAI compliance affects you. The technical documentation they're required to maintain is what you use to justify your own high-risk compliance downstream. If your vendor's documentation is thin, your conformity assessment will be thin, and your regulatory exposure increases.


This is why "we use OpenAI/Anthropic/Google" is not a compliance posture. It's a starting point. You still have your own obligations as the provider or deployer of the integrated system.


The State Law Layer


The EU has one comprehensive law. The US has a patchwork of state laws, and in 2026 it moved as much as Brussels did. (Corrected 3 October 2026. The original dates and scopes below were out of date.)


California's AI Transparency Act (SB 942) requires large generative AI providers to offer a free AI-detection tool and to embed latent provenance disclosures in generated content, with an option for visible disclosures. AB 853 moved its operative date from 1 January 2026 to 2 August 2026, the same day as the EU's Article 50, and widened its reach to large online platforms and some device makers.


Colorado's AI Act (SB 24-205) never took effect in its original form. On 14 May 2026, Colorado enacted SB 26-189, which repeals it and replaces it with a narrower law on automated decision-making technology (ADMT) that materially influences consequential decisions. It takes effect 1 January 2027. The duty of care, the mandatory impact assessments and the risk-management-program requirement are gone. What remains is notice, adverse-decision explanations, data correction, human review where commercially reasonable, and record keeping. The Attorney General enforces it, with a 60-day cure period.


Texas's Responsible AI Governance Act (HB 149), in effect since 1 January 2026, is narrower than its early drafts. It mostly prohibits specific practices, such as intentional unlawful discrimination and manipulation toward self-harm or violence. Its disclosure duties fall on government agencies and healthcare providers. The Attorney General has exclusive enforcement, also with a 60-day cure period.


These laws still don't align on definitions, scope or obligations, but the trend changed direction in 2026: away from EU-style risk management and toward notice and transparency. "AI compliance" is still a matrix. It's just a different matrix from the one we described in May.


What Regulators Will Actually Do


Compliance frameworks live or die by enforcement, and the enforcement playbook for the AI Act is becoming clearer.


The European AI Office and national authorities have been hiring throughout 2025 and into 2026. They have direct authority to request technical documentation, audit conformity assessments, and demand corrective measures. The complaint-driven model — used heavily under GDPR — applies here too: individuals and civil society organizations can submit complaints that trigger investigations.


Early enforcement is likely to concentrate where violations are easiest to see. Prohibited systems (the unacceptable-risk bans) are the easiest cases — fines up to 7% of global turnover, clear definitions, public-facing systems. Expect enforcement on real-time biometric identification, social scoring, and emotion recognition in workplaces and schools.


GPAI non-compliance will follow. The Commission has already opened technical dialogues with major model providers. Public documentation is a low-friction check for regulators — either it exists and meets requirements or it doesn't.


Article 50 transparency is now the most testable obligation: a regulator or a complainant can check in minutes whether a chatbot discloses that it's AI, or whether synthetic media carries a marker.


High-risk system non-compliance is the largest enforcement category, and after the Omnibus the slowest. Annex III duties don't apply until 2 December 2027, so high-risk enforcement belongs to 2028, not 2026. (Corrected 3 October 2026. The original predicted high-risk fines in late 2026.)


What to Do With the Extra Sixteen Months


(Rewritten 3 October 2026.) The order of operations hasn't changed. What changed is how much time you have to do it properly, and a deferral is exactly when compliance programmes lose their budget. Do the Article 50 work now, because it's already in force. Then use the high-risk runway for the steps that take longest.


Article 50 first, this quarter. Find every AI system that talks to customers or the public: chat, voice, email agents. Confirm each one discloses that it's AI at the start of the interaction. If you ship generative output, confirm it carries a machine-readable marker, or that you'll have one by 2 December 2026 for systems launched before August. A team can do this in a week, and it's the obligation a regulator can check in minutes.


Inventory. List every AI system your organization builds, deploys, or substantially modifies. For each, document who built it, what it does, where the output is used, and what data flows in and out. This is the foundational document everything else rests on.


Classify. For each system, determine: prohibited / high-risk / limited risk / minimal risk. For high-risk candidates, document the analysis. Get legal review on edge cases. The "this is a narrow procedural task" escape valve will get tested by regulators.


Gap-assess high-risk systems. Compare current state against the high-risk requirements: documentation, risk management, data governance, human oversight, transparency. Identify the largest gaps.


Plan to the new date, with slack. Conformity work depends on harmonised standards and Commission guidance that are still arriving; the Commission's high-risk classification guidelines and post-market-monitoring guidance are scheduled through 2027. Plan to be assessment-ready by mid-2027, not December. Flag the systems you keep retraining or re-scoping, and get legal's view on whether those changes are "significant" under Article 111(2).


Vendor pressure. Get GPAI compliance documentation from every foundation model vendor you depend on. If they can't produce it, that's a procurement risk you need to surface to your legal team.


The organisations that will be fine in December 2027 are the ones treating the deferral as runway, not reprieve. A sixteen-month delay on a multi-quarter programme is a reason to do the inventory and classification properly. It isn't a reason to stop.


To check whether your own pipeline would produce the evidence this asks for, the AI Governance in the Pipeline checklist walks through model documentation, evaluation gates and production monitoring, with who owns each.


The Honest Takeaway


(Corrected 3 October 2026.) In May we wrote that the Act would not be delayed further. We were wrong. The high-risk timeline moved, and the reason it moved matters: the EU wasn't ready to enforce, not unwilling. The requirements are the same. Article 50 and GPAI enforcement are live today, and the high-risk regime is now a dated, known obligation with fewer excuses attached.


For most organizations, the right framing is not "how do we comply?" It is "which of our AI systems do we keep operating in the EU, and which do we either rebuild for compliance or pull out of the market?" That is a strategic question, not a legal one. It needs to be answered with full visibility into the cost of compliance for each system versus the value the system delivers in EU jurisdictions.


The vendors selling you compliance-in-a-box are largely selling templates and a process. The hard work — classification, documentation, conformity assessment, post-market monitoring — is yours to do or pay someone to do specifically for your systems.


Don't wait for a regulator to call. They will.


Sources




Related reading


bottom of page