Most EU AI Act coverage falls into two camps: panic about obligations that do not apply to you, or reassurance that everything was delayed. Both are wrong, and the accurate picture is more manageable than either.
A note first: this is a summary for orientation, not legal advice. Your regulator and your counsel are the authorities here.
What Actually Happened With the Dates
The Act crossed its general application date on 2 August 2026, and transparency obligations under Article 50 along with general-purpose AI enforcement took effect from that point.
Separately, an omnibus agreement pushed the high-risk deadlines back. Obligations for standalone high-risk systems listed in Annex III moved to 2 December 2027, originally 2 August 2026. High-risk AI embedded in regulated products under Annex I moved to 2 August 2028.
So the headline is not that everything was delayed. Transparency and general-purpose AI obligations are live now. The heavy high-risk conformity work bought roughly sixteen extra months.
The Question to Answer First
Almost everyone starts at the wrong end, reading about conformity assessments before establishing whether they apply.
Work out your role instead. Are you a provider, meaning you develop or place a system on the market under your own name? Or a deployer, meaning you use somebody else system in your own operations?
Most companies are deployers, and deployer obligations are substantially lighter. Establishing that clearly is the cheapest hour of compliance work available.
What Most Organisations Need To Do Now
- Inventory your AI systems. Including features embedded in software you already bought. This is the single most common gap.
- Classify by risk. Prohibited, high-risk, limited-risk with transparency duties, or minimal. Most business tooling lands in the last two.
- Meet the transparency duties. Article 50 obligations are enforceable now. Where people interact with an AI system, they generally need to know.
- Label synthetic content. Transparency around AI-generated material is part of the same package.
- Handle AI literacy. Staff working with these systems need appropriate understanding. Modest, documented training satisfies far more than most people assume.
- Check what your vendors provide. Deployer obligations often depend on documentation the provider must supply. Ask now, at renewal.
If You Might Be High-Risk
| If your system… | Then |
|---|---|
| Screens job applicants | Likely Annex III high-risk |
| Assesses creditworthiness | Likely high-risk |
| Is used in education assessment | Likely high-risk |
| Is embedded in a regulated product | Annex I, later deadline |
| Drafts marketing copy | Almost certainly minimal risk |
If any row above sounds like you, use the extra time deliberately. Risk management systems, data governance and technical documentation are genuine build work, and December 2027 arrives faster from a standing start than anyone expects.
The Practical Advice
Do the inventory and the classification this quarter even if nothing you run is high-risk. That document is what your enterprise customers will ask for in procurement, and increasingly they ask before regulators do.
Compliance work has a habit of becoming a sales asset. Being able to hand over a clear AI inventory shortens deals.
Conclusion
Establish whether you are a provider or a deployer, inventory every AI system including embedded features, and classify by risk. Meet the transparency and AI literacy duties that are enforceable now, and use the deferred high-risk deadlines of December 2027 and August 2028 as planning time rather than a reprieve. Then keep the documentation current, because it will be requested in a procurement process long before an inspection.
Frequently Asked Questions
Does this apply to companies outside the EU?
It can, where output is used in the EU or systems are placed on the EU market. Geography of incorporation is not the deciding factor, which surprises many teams.
What if we only use AI features inside tools we bought?
You are likely a deployer with lighter obligations, though you still need the inventory and the transparency duties. Ask your vendors what documentation they provide.
Are the deadlines likely to move again?
They have moved once already, so treat any date as a planning assumption rather than a certainty, and track it through official sources rather than vendor summaries.