EU AI Act compliance, the working playbook for August 2026.

Executive summary

The EU AI Act (Regulation 2024/1689) entered into force on 1 August 2024 and establishes horizontal EU rules for specified AI practices and operator roles. Its penalty tiers vary by breach; the €35 million or 7% of global annual turnover maximum applies to prohibited practices.^[1]

The phased calendar: prohibited practices have applied since 2 February 2025 and GPAI model obligations since 2 August 2025. After a provisional agreement in May 2026, the AI Omnibus was adopted as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. Relevant Annex III high-risk obligations apply from 2 December 2027, while relevant Annex I product-embedded obligations apply from 2 August 2028.^[12][13][14] Other AI Act obligations retain their own application dates.

Where we land in August 2026. The GPAI Code of Practice is finalised. Harmonised standards remain an important part of operational compliance, but organizations should classify each system and map the provisions that apply rather than treating either high-risk date as a deadline for the Act as a whole.^[15][16]

What changed by August 2026

What is the EU AI Act?

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world’s first comprehensive legal framework regulating artificial intelligence systems. Adopted by the European Parliament on March 13, 2024, and entering into force August 1, 2024, it establishes harmonized rules for AI development, deployment, and use across all 27 EU member states.^[1]

History and legislative process

The European Commission proposed the AI Act on April 21, 2021, as part of its digital strategy. After three years of trilogue negotiations between the Commission, Parliament, and Council, political agreement was reached December 9, 2023. The final text passed with 523 votes in favor, 46 against, and 49 abstentions.^[4]

The regulation was published in the Official Journal of the European Union (EUR-Lex) on July 12, 2024, as Regulation (EU) 2024/1689, comprising 180 articles and 13 annexes spanning 144 pages.^[1]

Scope and applicability

The AI Act applies to:

• AI system providers placing systems on the EU market or putting them into service, regardless of location
• AI system deployers (users) located in the EU
• Providers and deployers of AI systems located in third countries where the output is used in the EU
• Importers and distributors of AI systems in the EU

The regulation defines an “AI system” per Article 3(1) as “a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.”^[1]

Key objectives

The regulation balances promoting AI innovation with protecting fundamental rights, health, safety, and democratic values. Article 1 establishes objectives including:

• Ensuring AI systems placed on the EU market are safe and respect fundamental rights
• Ensuring legal certainty to facilitate investment and innovation in AI
• Enhancing governance and effective enforcement of existing law on fundamental rights
• Facilitating the development of a single market for lawful, safe, and trustworthy AI systems

Risk categories

The AI Act employs a risk-based approach, classifying AI systems into four tiers with escalating regulatory requirements based on potential harm to health, safety, and fundamental rights.

Timeline and deadlines

The AI Act follows a staggered application calendar. As of 26 August 2026, prohibited-practice, AI-literacy, GPAI-model, and specified transparency provisions are among those already applicable. The AI Omnibus is in force; relevant Annex III high-risk obligations apply from 2 December 2027 and relevant Annex I product-embedded obligations from 2 August 2028.^[12][13]

Requirements by category

Prohibited AI systems (Article 5)

Prohibited practices became illegal February 2, 2025. Organizations must immediately cease any:

• Subliminal manipulation causing harm
• Exploitation of vulnerabilities (age, disability, economic situation)
• Social scoring by public authorities
• Risk assessment based solely on profiling or personality traits
• Facial recognition database creation via untargeted scraping
• Emotion recognition in workplace/education (limited exceptions)

Penalty ceiling: Up to €35 million or 7% of total worldwide annual turnover for specified infringements. For undertakings other than SMEs, the higher applicable ceiling is used; for SMEs, including startups, Article 99 applies the lower applicable fixed or percentage ceiling.^[1]

High-risk AI systems (Articles 8–15)

High-risk AI systems face comprehensive requirements across the entire lifecycle. Providers must implement:

Penalty for high-risk non-compliance: Up to €15 million or 3% of total worldwide annual turnover (Article 99).^[1]

Limited-risk AI systems (Article 50)

Limited-risk systems face only transparency obligations:

• Chatbots: Inform users they are interacting with AI (unless obvious from context)
• Emotion recognition/biometric categorization: Inform natural persons they are being subjected to such systems
• Deep fakes: Disclose that content has been artificially generated or manipulated

Penalty: Up to €7.5 million or 1% of total worldwide annual turnover (Article 99).^[1]

High-risk AI systems in detail

Classification criteria (Article 6)

An AI system is considered high-risk if:

1. The AI system is intended to be used as a safety component of a product covered by EU harmonization legislation (Annex I), OR
2. The AI system itself is a product covered by EU harmonization legislation (Annex I) and requires third-party conformity assessment, OR
3. The AI system falls under one of the eight high-risk use cases listed in Annex III

Annex III high-risk use cases

Conformity assessment procedures (Articles 43–44)

Before placing high-risk AI systems on the market, providers must undergo conformity assessment to demonstrate compliance. Two pathways exist:

Healthcare AI Under the EU AI Act

The EU AI Act doesn’t create one single healthcare deadline. Under the AI Omnibus now in force, relevant Annex III high-risk obligations apply from 2 December 2027, while relevant Annex I product-embedded obligations, including covered MDR/IVDR pathways, apply from 2 August 2028. Healthcare teams still need to classify first and calendar second.

Healthcare deployments often land in high-risk categories because they either:

• Are AI systems or safety components in products regulated under the MDR or IVDR
• Fall within Annex III use cases such as determining access to essential private or public services (including healthcare access, coverage, or prior-authorization workflows)
• Support clinical workflows where a regulated-product pathway or another high-risk classification applies

Not every healthcare feature is automatically high-risk. Ambient documentation, clinical decision support, diagnostics, utilization management, and access workflows can land in different buckets depending on product classification, intended purpose, and how the output is used. For an operational breakdown by clinical-AI type, see our dedicated guides on ambient AI scribe, CDSS high-risk classification, and AI diagnosis high-risk classification.

GPAI obligations and Code of Practice

The AI Act sets specific obligations for providers that place general-purpose AI models on the EU market. Those obligations have applied since 2 August 2025; the Commission’s enforcement powers began applying on 2 August 2026.^[15]

Definition and classification (Article 3)

A general-purpose AI model is defined as an AI model “trained on large amounts of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market.”^[1]

All in-scope GPAI model providers face baseline obligations. Models classified as posing systemic risk face additional duties; Article 51 includes a rebuttable compute-based presumption and also permits Commission designation based on capabilities or impact.

Compliance deadline

GPAI obligations have applied since 2 August 2025. The Commission’s enforcement powers began applying on 2 August 2026; providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply.^[15]

Penalties and enforcement

The AI Act establishes one of the most stringent penalty regimes in technology regulation, mirroring GDPR’s structure with fines tied to global annual turnover.

Penalty tiers (Article 99)

Important: “Global annual turnover” means worldwide revenue for the preceding financial year. For undertakings other than SMEs, Article 99 uses the higher applicable percentage or fixed ceiling. For SMEs, including startups, each fine must not exceed the lower applicable percentage or fixed ceiling. The authority still sets any actual fine under the Act’s criteria and the facts.^[1]

Enforcement structure

The AI Act establishes a multi-layered enforcement architecture:

Market surveillance powers (Article 74)

National authorities have extensive investigatory powers including:

• Requesting access to all documentation and data demonstrating conformity
• Requesting access to training, validation, and testing datasets
• Requesting access to source code and algorithms (protected as confidential)
• Requiring providers to take corrective action or withdraw systems from market

Member-state implementation, reviewed August 2026

The Act applies directly across the 27 member states, but each must designate national competent authorities (Article 70) and a single point of contact. The implementation picture remains uneven; the entries below are dated status summaries, not legal advice, with country deep dives linked.^{[17][18][19][20][21][22]}

Compliance roadmap

Organizations should implement a phased approach aligned with system classification and the provision-specific calendar. Relevant Annex III high-risk duties apply from 2 December 2027 and relevant Annex I product-embedded duties from 2 August 2028.

GLACIS framework

EU AI Act compliance roadmap

1

AI system inventory and risk classification

Catalog all AI systems across the organization. Classify each system using the Act’s categories and applicable Annex I or Annex III pathway. Identify provisions already applicable and systems with 2027 or 2028 high-risk dates. Document intended purpose, deployment context, and affected populations.

2

High-risk system prioritisation

For high-risk systems, assess current state against Articles 9-15 requirements. Identify gaps in risk management, data governance, logging, transparency, human oversight, and cybersecurity. Prioritize systems by business criticality and compliance gap severity. Determine which systems require notified body assessment vs. internal control.

3

Risk management system implementation

Establish continuous risk management per Article 9. Implement processes for identifying foreseeable risks, estimating harm likelihood and severity, evaluating post-market monitoring findings, and adopting mitigation measures. Document risk management activities per Annex IV technical documentation requirements. Integrate with existing ISO 42001 or NIST AI RMF frameworks where implemented.

4

Technical documentation and logging

Prepare the applicable Annex IV technical documentation. Implement automatic logging capabilities appropriate to the intended purpose and the Article 12 events that apply. Set proportionate access, integrity, and retention controls under the relevant rules. Pair logs with testing, routing, coverage, and source evidence; a log does not by itself prove that a control executed or was effective.

5

Quality management system and conformity assessment

Establish the applicable Article 17 quality-management system, covering compliance strategy, design controls, post-market monitoring, and corrective actions. For systems requiring notified-body assessment, begin engagement well before the applicable 2027 or 2028 date. For an internal-control pathway, prepare the required declaration of conformity and CE marking.

6

Post-market monitoring and continuous compliance (ongoing)

Implement the applicable post-market monitoring system, including relevant performance, incident, and feedback signals. Establish Article 73 serious-incident procedures, maintain required documentation, and update it as the system evolves. Conduct periodic reviews that assess ongoing compliance with the applicable Articles 9–15 duties and prepare for competent-authority requests.

Critical insight: Notified-body capacity is finite. Teams that begin classification and evidence work well ahead of the applicable 2027 or 2028 high-risk date reduce assessment bottlenecks, rushed implementations, and avoidable enforcement exposure.

GPAI provider roadmap

Foundation model providers faced the August 2, 2025 deadline. Immediate priorities include:

Frequently asked questions

References