The Clock Is Ticking: August 2, 2026
On August 2, 2026, the EU AI Act’s most significant compliance milestone takes effect. High-risk AI system obligations under Annex III become enforceable — meaning every company that develops, deploys, or imports AI systems operating in high-risk categories within the EU must demonstrate full regulatory compliance.
Penalties for non-compliance reach up to EUR 15 million or 3% of global annual turnover. For prohibited practice violations, the ceiling rises to EUR 35 million or 7%.
The Full EU AI Act Timeline
Already Enforceable
- February 2, 2025: Prohibited AI practices (Article 5) — social scoring, manipulative AI, untargeted facial recognition, emotion recognition in workplaces/schools.
Coming August 2, 2025
- National AI supervisory authorities must be designated
- General-Purpose AI (GPAI) obligations take effect
- Transparency obligations for limited-risk systems (chatbots, deepfakes)
The August 2, 2026 Milestone
- All high-risk AI system obligations under Annex III become enforceable.
- Providers and deployers must have complete compliance infrastructure: risk management, documentation, human oversight, quality management, and post-market monitoring.
August 2, 2027
- High-risk obligations for AI in regulated products (Annex I — medical devices, machinery, etc.)
The Digital Omnibus Caveat
The European Commission’s Digital Omnibus proposal has discussed potentially extending the Annex III deadline to December 2027. However, this is not yet adopted and should not be relied upon. Target August 2, 2026.
What Must Be in Place by August 2, 2026
1. AI System Inventory
A complete registry of all AI systems with classification documentation and rationale.
2. Risk Classification Records
Documented evidence of how each system was classified, including Annex III category mapping and any Article 6(3) exemption analysis.
3. Technical Documentation (Annex IV)
System description, design specifications, data governance practices, training data descriptions, performance metrics, and cybersecurity measures.
4. Risk Management System (Article 9)
Systematic approach to identifying, analyzing, and mitigating risks throughout the AI system lifecycle.
5. Conformity Assessment
Self-assessment or third-party assessment with EU Declaration of Conformity and CE marking.
6. Human Oversight Protocols (Article 14)
Documented procedures ensuring effective human oversight including override and intervention capabilities.
7. Post-Market Monitoring Plan (Article 72)
Active monitoring of AI performance including data collection, performance tracking, and incident reporting.
8. Quality Management System (Article 17)
Organizational framework for ongoing compliance covering procedures, testing, corrective actions, and communication with authorities.
Month-by-Month Preparation Plan
March 2026: Inventory and Assessment
- Complete AI system inventory across all departments
- Identify shadow AI usage
- Begin risk tier classification
- Assign compliance ownership per system
April 2026: Classification and Gap Analysis
- Finalize risk classifications with documented rationale
- Conduct compliance gap analysis
- Prioritize high-risk systems
- Begin technical documentation collection
May 2026: Documentation Sprint
- Complete technical documentation for priority systems
- Draft risk management documentation
- Establish human oversight protocols
- Begin conformity assessment
June 2026: Conformity and Quality
- Complete conformity assessments
- Establish quality management system
- Set up post-market monitoring
- Internal review of all documentation
July 2026: Testing and Validation
- Test all compliance processes end-to-end
- Validate audit trail completeness
- Conduct mock regulatory inspection
- Address identified gaps
August 2026: Operational Readiness
- Final review and sign-off
- Confirm monitoring is active
- Test incident reporting procedures
- Brief leadership on compliance status
Why Starting Now Is the Minimum Lead Time
- AI system inventory: 2–4 weeks for companies with 5+ systems
- Technical documentation: 4–8 weeks per high-risk system
- Conformity assessment: 2–6 weeks additional
- Quality management setup: Requires process design, training, and validation
Starting in March 2026 gives you minimum viable timeline. Starting later means cutting corners.
Take the First Step Today
Do not wait for the Digital Omnibus. Inventory your AI systems and begin classification. Everything else flows from that foundation.
Start your compliance interview with AI Comply Help — classify your AI systems and generate compliance documents in a single conversation.
AI Comply Help supports compliance operations and is not a substitute for legal advice.
Related Reading
- EU AI Act Compliance for SMEs
- How to Classify Your AI System
- Why Compliance Is Not a One-Time Project