EU AI Act: What Changes Now vs What Starts in 2026

Key obligations are already active, including bans on certain “unacceptable-risk” AI practices and initial requirements that apply to general-purpose AI (GPAI) providers (and organizations embedding GPAI). This means teams should already be auditing prohibited use cases and preparing documentation, transparency, and reporting pathways.

2 August 2026 is the general application date when most remaining obligations come into effect especially for high-risk AI systems (risk management, data governance, technical documentation, human oversight, robustness/cybersecurity, CE-marking where required, EU database registration, and post-market monitoring). Transparency duties for “limited-risk” AI (e.g., deepfake labeling and AI-interaction disclosures) also align with this deadline.

Start building an evidence engine: a central AI register, model cards, evaluations, release notes, decision logs, and incident reporting playbooks. In parallel, implement transparency and content integrity controls (e.g., labeling/watermarking and AI-interaction disclosures) so they’re production-ready before the 2026 cutover.