Enforcement began Aug. 2, 2026. Securiti, a Veeam company, gives you one platform to find, classify, and govern every AI system.
30 minutes with a Securiti expert, mapped to your AI systems and your deadlines.
Enforcement Timeline · Updated for Digital Omnibus Amendments, in force July 27, 2026
Feb. 2, 2025
In Force
Prohibited practices banned.
AI literacy duties apply.
Aug. 2, 2025
In Force
GPAI model obligations begin.
Governance bodies operational.
Aug. 2, 2026
Enforceable Now
Article 50 transparency applies.
Commission GPAI enforcement powers active.
Live for 95 days
Dec. 2, 2027
Next Deadline
High-risk AI obligations apply
(standalone Annex III systems).
In 392 days
Aug. 2, 2028
Final Phase
AI embedded in regulated products
(Annex I) comes into scope.
August 2026 Status Check
The Digital Omnibus moved the high-risk deadlines. It didn’t touch what’s already live, and it didn’t soften a single high-risk requirement. Here’s exactly where things stand.
Enforceable since Aug. 2, 2026
Article 50 transparency is live
If customer-facing AI touches the EU, disclosure duties apply today.
Active since Aug. 2, 2025
GPAI enforcement powers are on
Documentation requests won’t wait for your inventory to catch up.
Deferred to Dec. 2, 2027
High-risk moved, unchanged
Risk management, data governance, human oversight, and conformity assessment are all still required.
What’s at stake
€35M or 7%
of global annual turnover, whichever is higher
The penalty ceiling for the most serious violations. Lower tiers still reach €15 million or 3% of turnover.
0 EU offices
needed to fall in scope
The Act reaches providers and deployers anywhere in the world when their AI system’s output is used in the EU.
1 budget cycle
between today and Dec. 2, 2027
That’s one enterprise planning, procurement, and audit cycle to inventory, classify, document, and prove conformity.
Why teams start now
Teams that treat the deferral as a pause will spend 2027 in triage. Teams that use it build once and reuse everywhere.
Evidence takes months, not weeks
Conformity assessments and technical documentation must cover your data pipeline, training sources, and oversight controls, not just the model.
Your AI estate outgrows your inventory
Every new SaaS tool, copilot, and internal project add models you don’t know about. Shadow AI doesn’t wait for a compliance program.
Live duties and future duties share one foundation
The inventory, mapping, and controls you need for Article 50 and GPAI today are the same foundation high-risk compliance sits on in 2027.
How Securiti helps
Securiti’s AI Security & Governance solution, an integration of the DataAI Command Platform, connects your AI systems to the data behind them so compliance evidence generates itself.
Discover and catalog every AI model
Automatically find AI models across public clouds, private clouds, and SaaS apps, including the shadow AI nobody registered.
Classify systems by risk tier
Assess models for toxicity, bias, copyright, and disinformation risks, then classify each system against the Act’s prohibited, high-risk, GPAI, and limited-risk tiers.
Map Data+AI flows end to end
Connect every model to its data sources, vendors, processing activities, and compliance obligations, and monitor the flows continuously.
Enforce Data+AI controls in production
Context-aware LLM firewalls and guardrails mitigate OWASP Top 10 for LLM risks and adversarial machine learning attacks.
Automate assessments and reporting
Pre-built frameworks for the EU AI Act, NIST AI RMF, and 20+ other regulations, with categorization assessments, fundamental rights impact assessments, conformity assessments, and audit-ready reports.
Request a Demo
See your AI inventory, risk tiers, and automated EU AI Act assessments live, on the
platform large global enterprises already rely on.
At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.
Copyright © 2026 Securiti · Sitemap · XML Sitemap
[email protected]
Securiti, LLC.
3155 Olsen Drive
Suite 325
San Jose, CA 95117
Type
