On August 2, 2026, the EU AI Act's most consequential obligations take effect: Annex III high-risk AI system requirements, Article 50 transparency obligations, conformity assessments, CE marking, and AI Office enforcement powers. As of April 2026, 78% of organizations have not taken meaningful steps toward compliance.
Key Takeaways
>
- The August 2, 2026, deadline is 120 days away. It covers high-risk AI systems (Articles 9--15), Article 50 transparency, conformity assessments, and CE marking.
- The Digital Omnibus may delay the Annex III deadline to December 2027, but trilogue negotiations are still pending and the original deadline remains legally binding.
- Maximum fines reach 7% of global annual turnover (EUR 35M) -- exceeding GDPR's 4% maximum.
- 78% of organizations have not taken meaningful compliance steps. Over 50% lack a basic AI inventory.
- 12 member states missed the competent authority appointment deadline. National implementation is fragmented.
- Compliance costs for large enterprises range from $8--15 million. Third-party certification costs $50,000+ per AI system.
Implementation timeline
The EU AI Act entered into force on August 1, 2024. Key milestones already passed:
What takes effect August 2, 2026:
The August 2, 2027, deadline covers Annex I product-embedded high-risk AI, public authority deployers, and GPAI models placed on market before August 2025.
The Digital Omnibus: potential delay, but don't count on it
The European Commission proposed the Digital Omnibus (COM(2025) 836) on November 19, 2025, aiming to reduce compliance burden by 25% overall and 35% for SMEs by 2029. The proposal would:
Legislative progress: the Council adopted its negotiating position on March 13, 2026. The European Parliament's IMCO/LIBE committees adopted their joint report on March 18, 2026. Both co-legislators rejected several Commission simplification proposals and introduced a new ban on AI systems generating non-consensual sexual content. Trilogue negotiations are targeted for April or early May 2026.
The critical caveat: until the Omnibus is formally enacted, the original August 2, 2026, deadline remains legally binding. Organizations that pause compliance work based on an anticipated delay are taking a significant legal risk.
High-risk AI system requirements (Articles 9--15)
Eight Annex III categories
High-risk classification applies to AI systems in:
AI systems performing profiling are always classified as high-risk with no exemptions.
Core requirements
| Article | Requirement | Summary |
|---|---|---|
| Art. 9 | Risk Management System | Continuous, iterative risk identification and mitigation throughout the AI system lifecycle |
| Art. 10 | Data Governance | Quality criteria for training, validation, and testing datasets |
| Art. 11 | Technical Documentation | Detailed system documentation prior to market placement |
| Art. 12 | Record-Keeping | Automatic logging capabilities for traceability |
| Art. 13 | Transparency to Deployers | Clear instructions for use, capabilities, and limitations |
| Art. 14 | Human Oversight | Measures enabling human oversight during operation |
| Art. 15 | Accuracy, Robustness, Cybersecurity | Appropriate levels of performance and resilience |
Additional obligations include Quality Management Systems (Art. 17), conformity assessment, CE marking, EU database registration, post-market monitoring, serious incident reporting, and fundamental rights impact assessments for deployers.
Harmonised standards -- delayed
CEN/CENELEC harmonised standards are being developed by over 1,000 European experts across 5 working groups. These standards are significantly delayed -- the original April 2025 deadline was pushed to August 2025, and first standards may not reach publication until Q4 2026. The Digital Omnibus explicitly links high-risk obligations to standard availability.
Penalty structure
| Tier | Violation | Maximum Fine | Revenue % |
|---|---|---|---|
| Tier 1 (highest) | Prohibited AI practices | EUR 35M | 7% of global annual turnover |
| Tier 2 | Other obligations | EUR 15M | 3% of global annual turnover |
| Tier 3 | Misleading information | EUR 7.5M | 1% of global annual turnover |
| GPAI-specific | Chapter V violations | EUR 15M | 3% of global annual turnover |
The AI Act's top tier of 7% of global turnover exceeds GDPR's 4% maximum -- a deliberate signal from the EU. Article 99(8) prevents double penalties for the same factual violation under both the AI Act and GDPR. SME protections apply the lower of the percentage or fixed amount.
GPAI Code of Practice and Article 50
The GPAI Code of Practice was published July 10, 2025, and endorsed by the Commission in August 2025. It provides a "presumption of conformity" for signatories. 26 organizations signed, including Amazon, Anthropic, Google, IBM, Microsoft, OpenAI, Mistral AI, Cohere, and Aleph Alpha. xAI signed safety/security sections only. Meta publicly declined to sign.
The systemic risk threshold is greater than or equal to 10^25 FLOPs -- only 5--15 companies worldwide currently qualify.
The separate Transparency Code of Practice for AI-Generated Content (Article 50) has its second draft published March 3, 2026, with the final version expected June 2026. Article 50 obligations -- chatbot disclosure, AI content marking, deepfake labeling -- apply from August 2, 2026.
National implementation: fragmented progress
At least 12 member states missed the August 2, 2025, deadline for competent authority appointments. 19 member states had not appointed single points of contact as of November 2025. France, Germany, and Ireland had not enacted national legislation by November 2025.
Notable progress by individual states:
Company readiness: alarming gaps
The compliance readiness data paints a concerning picture:
What to do in the next 120 days
For organizations that have not yet started compliance work, the following steps are prioritized by impact and urgency:
Immediate (weeks 1--4)
Short-term (weeks 4--8)
Medium-term (weeks 8--16)
Regardless of timeline
Conclusion
The EU AI Act's August 2026 deadline represents the most significant regulatory event in AI governance to date. With 78% of organizations unprepared, maximum fines exceeding GDPR levels, and harmonised standards still delayed, the compliance challenge is substantial. The Digital Omnibus may provide relief, but betting on an unenacted legislative proposal is a risk no organization should take. The time to act is now.