EU AI Act Compliance: Duties and Deadlines After the 2026 Changes

EU AI Act compliance depends on what an AI system does, your organisation’s role and the provisions that apply to that use. 2 August 2026 is no longer the general deadline for Annex III high-risk requirements. Following the July 2026 amendment, Chapter III, Sections 1–3 apply from 2 December 2027 for Annex III systems and 2 August 2028 for systems classified under Article 6(1) and Annex I, with Article 6(5) excepted. Other obligations, including much of the transparency regime, already apply. AI Act, Article 113

This guide reflects the legal text checked on 14 September 2026. It covers enterprise AI systems; general-purpose AI model providers also need a separate review of Chapter V. The amendment is enacted legislation, effective from 27 July 2026. Regulation (EU) 2026/1744, Article 4

Which EU AI Act deadlines apply now?

The table summarises Articles 111 and 113 of the current AI Act. A postponement for particular Chapter III provisions does not postpone GDPR, product law or every AI Act obligation.

Existing systems need a separate transition analysis. Article 111(2) generally applies the Regulation to operators of high-risk systems placed on the market or put into service before the relevant Chapter III application date only where their designs undergo significant changes from that date. It preserves Article 5 and sets a 2 August 2030 compliance date for providers and deployers of high-risk systems intended for public authorities. Article 111(1) has separate rules for specified large-scale IT systems. Record the relevant date, version and subsequent design changes before relying on a transition. AI Act, Article 111

How to classify an AI system

Start with its intended purpose, actual workflow and affected people. A vendor’s label, the department buying the tool or the presence of a human reviewer does not by itself settle classification. The Act defines intended purpose by reference to the provider’s instructions, documentation and other supplied information. AI Act, Article 3(12)

Check prohibited practices first

Article 5 prohibits defined practices subject to their stated conditions and exceptions. These include certain harmful manipulation and exploitation of vulnerability, social scoring, untargeted scraping to build facial-recognition databases, and specified uses of biometrics. The social-scoring prohibition is not limited to public authorities. Workplace and education emotion recognition has an exception for medical or safety reasons; real-time remote biometric identification for law enforcement has its own narrow conditions. AI Act, Article 5

Use the full provision for a suspected match. A short category label cannot establish whether an exception applies. The new content-related prohibitions added in 2026 have the separate application date shown above.

Apply both high-risk classification routes

AI Act, Article 6 and Annexes I and III

Annex I is the product-legislation list. Annex II lists criminal offences. Within Annex I, Section B products have a restricted, sectoral regime under Article 2(2); the full general high-risk checklist should not be applied to them without checking that provision. Section A includes medical devices and in vitro diagnostic devices. Article 2(13) also provides for specified limits on overlapping requirements through delegated acts, whose actual scope must be checked. AI Act, Article 2(2), Article 2(13) and Annex I

Some common Annex III boundaries are easy to miss:

AI Act, Annex III

Document any Article 6(3) exception

For an Annex III system, Article 6(3) addresses systems that do not pose a significant risk to health, safety or fundamental rights, including by not materially influencing a decision’s outcome. It identifies four conditions: a narrow procedural task; improvement of a completed human activity; detection of decision patterns subject to the specified human-review safeguard; or a preparatory task for a relevant assessment. A preparatory task can support the exception. An Annex III system that profiles natural persons remains high risk. AI Act, Article 6(3)

The provider must document its assessment before placing the system on the market or putting it into service, and Article 49(2) provides for registration. Calling a tool “administrative” or “human assisted” is not that assessment. AI Act, Articles 6(4) and 49(2)

Provider and deployer duties

A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses a system under its authority in a professional context. The same organisation can have different roles for different systems. AI Act, Article 3(3)–(4)

For high-risk systems within the relevant scope and application date:

AI Act, Articles 9–20, 26 and 72. Input-data duties under Article 26(4) apply to the extent the deployer controls that data. Registration and impact-assessment duties have their own scope tests.

Changes to a purchased system can alter your role. Article 25 covers specified rebranding, substantial modification and changes of intended purpose that make a system high risk. Routine configuration or fine-tuning is not automatically a substantial modification; assess it against the definitions and the original intended purpose and conformity assessment. AI Act, Articles 3(23), 25 and 43(4)

Transparency and AI literacy

Article 50 distinguishes providers’ design obligations from deployers’ disclosure obligations:

• Providers of systems intended to interact directly with people must enable disclosure that the interaction is with AI, unless this is obvious under the statutory test.
• Providers of systems generating synthetic content must provide machine-readable marking and detectability, subject to technical conditions and specified exceptions, including standard editing assistance.
• Deployers must disclose deepfake content and specified AI-generated public-interest text. Public-interest text has an exception where human review or editorial control occurs and a person or entity holds editorial responsibility.
• Deployers of emotion-recognition or biometric-categorisation systems must provide the relevant information, where such use is permitted.

The full provision contains additional exceptions and requires clear, distinguishable information by the first interaction or exposure. For systems placed on the market before 2 August 2026, Article 111(4) gives certain providers until 2 December 2026 to meet Article 50(2). It does not defer all disclosure duties for older systems. AI Act, Articles 50 and 111(4)

The amended Article 4 requires providers and deployers to take measures supporting the development of AI literacy among relevant staff and others acting on their behalf. It expressly does not require a guarantee of any individual’s literacy level. Practical measures can address the tools people use, their limitations and the routes for reporting problems; keep a record of the measures chosen and the context they address. AI Act, Article 4

GDPR, DPIAs and fundamental-rights assessments

GDPR continues to apply to personal-data processing. Its Article 22 concerns decisions based solely on automated processing with legal or similarly significant effects, subject to exceptions and safeguards. It is not a general opt-out from any use of AI. AI Act human-oversight controls do not replace the separate GDPR analysis. AI Act, Article 2(7); GDPR, Article 22

A GDPR data protection impact assessment (DPIA) is required when the processing is likely to create high risk to people’s rights and freedoms, with specific examples in Article 35. The AI Act fundamental rights impact assessment (FRIA) has a different scope: Article 27 covers specified Annex III deployers, including public-law bodies, private providers of public services, and deployers of the listed creditworthiness and life/health-insurance systems. It excludes Annex III point 2 infrastructure systems from that duty. GDPR, Article 35; AI Act, Article 27(1)

Where both apply, Article 27(4) allows the FRIA to cross-reference or include relevant DPIA material. Check both assessments’ requirements and fill any gaps. The provision does not impose a universal sequence of two separate projects. AI Act, Article 27(4)

Conformity assessment and evidence

Article 43 sets different assessment routes. Annex III points 2–8 use internal control under Annex VI. Point 1 biometric systems may require a notified body depending on the standards or common specifications applied. Section A product systems follow the relevant product assessment procedure with the applicable AI requirements included; Article 43(3) also addresses systems covered by both routes. AI Act, Article 43

Article 49 EU-database registration concerns specified Annex III systems and actors, with exceptions and national registration for point 2 infrastructure systems. It is not a universal register for every medical product or every workplace AI tool. Harmonised standards whose references are published in the Official Journal can support a presumption of conformity only for the requirements they cover. AI Act, Articles 40 and 49

A practical starting checklist

The following records can organise a compliance review. They are operational recommendations, not a prescribed company methodology or a promise of legal compliance.

1. Inventory the uses. Record the system, version, owner, vendor, intended purpose, deployment date, affected people and data used.
2. Write the classification decision. Identify the relevant provision, your role, any exception or transition and the evidence supporting it.
3. Address duties already applicable. Review prohibited uses, transparency, literacy measures and existing data-protection or product obligations.
4. Assign the remaining work. Link each applicable requirement to an owner, evidence location, gap and decision date. Agree with suppliers what evidence and update notices they will provide.
5. Review changes before release. Revisit the assessment when the purpose, model, input data, affected population or human oversight changes.

Estimate effort from those gaps and the actual assessment route. The Act does not supply a universal compliance budget or fixed implementation duration.

What penalties can apply?

For SMEs, including start-ups, Article 99(6) uses the lower of the relevant amount or percentage. For small mid-cap enterprises, Article 99(6a) applies that lower-of rule to paragraphs 4 and 5. The amount imposed depends on the circumstances; public bodies and general-purpose model providers have additional specific provisions. The €35 million/7% tier is not the general penalty for every high-risk-system breach. AI Act, Articles 99–101

Frequently Asked Questions

What is the current EU AI Act deadline for high-risk systems?

Article 113 sets 2 December 2027 for Chapter III, Sections 1–3 concerning Annex III systems, and 2 August 2028 for those sections concerning Article 6(1)/Annex I systems, with Article 6(5) excepted. Check sectoral scope and existing-system transitions separately. Other AI Act duties can already apply. AI Act, Articles 2, 111 and 113

Does buying a compliant AI tool satisfy our obligations?

Supplier evidence helps establish the provider’s position. A deployer of a high-risk system has its own applicable duties, including use according to instructions, human oversight, monitoring and controlled-log retention. These depend on the relevant scope, dates and transition rules. AI Act, Article 26

Does a human reviewer make an AI system low risk?

Human review alone does not establish an exception. Article 6(3) requires the relevant Annex III assessment and conditions; systems performing profiling of natural persons remain high risk under that provision. AI Act, Article 6(3)–(4)

Must every AI-assisted document carry an AI label?

Article 50 contains distinct rules for provider marking, deepfakes and text published to inform the public on matters of public interest. It includes editing and editorial-control exceptions. Assess the content, use and actor before selecting the disclosure. AI Act, Article 50

Is a FRIA required for every high-risk AI deployment?

No. Article 27 applies to specified deployers of Article 6(2)/Annex III systems and excludes the point 2 infrastructure category. A system classified only through the regulated-product route does not trigger this FRIA duty by that classification alone. GDPR may separately require a DPIA. AI Act, Article 27; GDPR, Article 35

Does the EU AI Act reach companies outside the EU?

It can. Article 2 covers, among other cases, providers placing systems or general-purpose models on the EU market and non-EU providers or deployers where system output is used in the EU. Its scope also contains exclusions, which need to be checked for the actual activity. AI Act, Article 2

Can existing systems rely on a transition period?

Possibly. Article 111 has different rules for older high-risk systems, certain large-scale IT systems, older general-purpose models and certain synthetic-content systems. Eligibility depends on the dates, actor, provision and changes involved. Document those facts before relying on an exception. AI Act, Article 111

Contact The Thinking Company.