The EU AI Act – when does it become enforceable now?

2026-07-24 · Source: Data Protection Report · Field: Legal & Regulatory — Compliance & Risk Management, Regulatory Affairs & Government Relations · Depth: Intermediate, short

Summary

The EU AI Act's application dates have been updated following the Digital Omnibus on AI publication, clarifying enforcement timelines for various obligations. Prohibitions and AI literacy requirements became applicable on 2 February 2025. Transparency obligations for generative AI providers and deployers, including machine-readable content marking and deep fake disclosure, will apply from 2 August 2026, with a grace period for some provider marking until 2 December 2026. Obligations for general-purpose AI model providers have been applicable since 2 August 2025, with an enforcement grace period until 2 August 2026 for Code of Practice signatories. Crucially, high-risk AI system obligations are pushed back to 2 December 2027 for standalone systems (Annex III) and 2 August 2028 for embedded systems (Annex I), allowing time for standardization. Market surveillance authorities are due by 2 August 2026.

Key takeaway

For Directors of AI/ML or AI Product Managers navigating EU compliance, you must prioritize understanding the staggered AI Act application dates. Ensure your teams implement transparency measures for generative AI by 2 August 2026, including clear AI interaction disclosures and machine-readable content marking. Utilize the extended deadlines for high-risk AI systems (2 December 2027 for standalone, 2 August 2028 for embedded) to proactively develop robust technical documentation and conformity assessment processes, as these are product safety obligations challenging to retrofit.

Key insights

The EU AI Act's enforcement dates are staggered, with high-risk system obligations significantly delayed to allow for standardization.

Principles

• "Applicable" means enforceable by regulator.
• Providers must mark AI-generated content.
• High-risk AI demands product safety compliance.

Method

Providers of high-risk AI systems must prepare detailed technical documentation, assess conformity, and declare compliance throughout the development lifecycle, aligning with new AI standards.

In practice

• Inform individuals when interacting with AI.
• Explore model provider tools for content marking.
• Update supplier onboarding for high-risk AI.

Topics

• EU AI Act
• AI Regulation
• Generative AI
• High-Risk AI Systems
• Transparency Obligations
• Compliance Deadlines

Best for: CTO, VP of Engineering/Data, Executive, Legal Professional, Director of AI/ML, AI Product Manager

Related on AIssential

• Europe Pauses Some Ai Regulations — The EU AI Act amendments balance regulatory burdens with innovation, extending compliance timelines and clarifying scope for businesses.
• What Actually Comes Due on August 2, 2026: EU AI Act Article 50 Transparency and the Digital Omnibus Reset — The EU AI Act's August 2, 2026 deadline for transparency and enforcement is firm, despite high-risk regime deferrals.
• The EU’s AI transparency deadline is weeks away. Is your enterprise ready? — The EU AI Act mandates explicit transparency for AI-generated content and interactions to foster public trust and mitigate manipulation risks.
• EU AI Act Omnibus Agreed: More Time, Limited Substantive Change — The EU AI Act's recent amendments primarily extend compliance deadlines, offering businesses more preparation time without major substantive changes.
• EU AI Act GPAI Enforcement Goes Live August 2, 2026: A Readiness Guide for AI Governance Teams — EU AI Act GPAI enforcement activates August 2, 2026, making existing obligations sanctionable with significant fines.
• Guidelines on transparency obligations for providers and deployers of AI systems — The AI Act's Article 50 guidelines clarify transparency obligations for AI systems posing specific risks, effective August 2, 2026.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Data Protection Report.