The EU AI Act Is Now Enforceable — But the High-Risk Deadlines Have Moved

The EU AI Act Is Now Enforceable — But the High-Risk Deadlines Have Moved

On 2 August 2026, the EU AI Act entered a decisive new phase. The European Commission's AI Office and national competent authorities can now enforce the provisions of the Regulation that have become applicable.

However, this date is frequently misunderstood. It does not mean that every obligation concerning high-risk AI systems now applies. The recently adopted AI Omnibus extended the implementation timetable for important parts of the high-risk regime.

What Applies Now?

Several important requirements are already applicable and enforceable.

Prohibited AI practices have applied since February 2025, while obligations concerning providers of general-purpose AI models have applied since August 2025. From 2 August 2026, the transparency obligations under Article 50 also apply.

These obligations include informing people when they are interacting directly with an AI system, unless this is already obvious; visibly labelling deepfakes and certain AI-generated public-interest content; and enabling the detection of AI-generated or manipulated content through machine-readable marking, subject to the conditions and exceptions of the Regulation.

For organisations using chatbots, virtual assistants, synthetic media, generative AI or automated citizen- and customer-facing services, these are operational requirements — not future policy objectives.

What Has Been Postponed?

The AI Omnibus moved the application of the requirements for high-risk AI systems listed in Annex III to 2 December 2027.

These include certain AI systems used in employment, education, access to essential services, critical infrastructure, law enforcement, migration and the administration of justice.

High-risk AI systems embedded in regulated products covered by Annex I, such as certain medical devices, machinery, lifts and other safety-regulated products, will become subject to the relevant AI Act requirements from 2 August 2028.

The extension reflects, among other factors, the continuing development of harmonised European standards that will support conformity assessment and provide a presumption of conformity. It should not, however, be interpreted as a reason for organisations to postpone AI governance.

The Additional Time Should Be Used Strategically

The most demanding element of AI Act compliance is not the production of a final legal document. It is the establishment of an operating model capable of identifying, classifying, controlling and monitoring AI systems throughout their lifecycle.

Organisations should use the extended period to create a complete AI system inventory, including internally developed systems, externally procured solutions, embedded AI functionality and employee use of general-purpose AI tools.

Each material AI system should have:

• —a defined business purpose and accountable owner
• —a documented provider, deployer, importer or distributor role
• —an initial risk and applicability classification
• —identified data, model and supplier dependencies
• —appropriate human-oversight and escalation arrangements
• —evidence of cybersecurity, testing and change management
• —documented transparency and user-information controls

Particular attention should be given to procurement. Contracting for an "AI-enabled" service without obtaining sufficient documentation on the model, intended purpose, training or input data, known limitations, security controls and regulatory responsibilities can create a compliance gap that the purchasing organisation cannot resolve on its own.

From Legal Interpretation to Operational Governance

AI Act readiness should not be managed as an isolated legal exercise. It must be integrated with data protection, cybersecurity, enterprise risk management, procurement, internal audit and sector-specific regulatory obligations.

At Tools of Tech, we approach AI Act compliance as both a regulatory and technical governance challenge. Our advisory work combines AI system inventories, risk classification, governance architecture, policy development, supplier assessment, cybersecurity review and conformity-assessment preparation.

The objective is not to produce another static compliance checklist. It is to establish a defensible AI governance model that enables an organisation to demonstrate what AI it uses, why it uses it, who is accountable for it and how its risks are controlled.

The central question for boards and senior management is now straightforward: can the organisation identify every material AI system, explain its regulatory status and produce evidence that it is being governed responsibly?

Where the answer is uncertain, AI Act readiness has not yet been achieved.