The EU AI Act Became Applicable on 2 August 2026: High-Risk Systems Move to December 2027, and What Non-EU Software Companies Should Do

Important: This article is general information and not legal advice. Consult a lawyer on how the EU AI Act applies to your company.

In brief: According to the European Commission's AI regulatory framework page, the EU AI Act became applicable on 2 August 2026. The AI Office and Member State authorities took over implementation, supervision and enforcement; for general-purpose AI (GPAI) models the Office can request technical documentation, evaluate models, require corrective measures and issue fines. The strict obligations for high-risk systems (the Annex III areas such as biometrics, critical infrastructure, education, employment and migration) moved to 2 December 2027, and the rules for high-risk systems embedded in regulated products moved to 2 August 2028. The cause of that shift is the Digital Omnibus (AI Omnibus), which entered into force on 27 July 2026. The first harmonised standard was published in the Official Journal on 19 October 2026. For non-EU companies that put AI-enabled products on the EU market or whose AI output is used in the EU, this timeline means extra time to prepare, but no reason to wait.

Last updated: 23 October 2026

The timeline: what applies when?

Dates from the Commission's page (summary):

What did the Digital Omnibus (AI Omnibus) change?

According to the Commission's page the Omnibus was adopted by the Commission on 19 November 2025, reached political agreement on 7 May 2026 and entered into force on 27 July 2026. In this process the dates for high-risk systems were pushed back. Note: this does not mean the Act was “postponed;” the Act applies, and only the dates of some obligations changed. The other parts of the broader “Digital Omnibus” package, covering GDPR, the Data Act and cookie rules, are on a separate track and, per secondary sources, not yet complete.

How does it concern non-EU companies?

The AI Act is generally designed to cover providers and users who place AI systems on the EU market or whose system output is used in the EU; being established in the EU is not required. The Act can touch you if:

• You offer AI-enabled software (chatbot, recommendation engine, document analysis, image analysis) to EU customers,
• You supply an AI component to an EU company's product (as a subcontractor/supplier),
• You use AI to generate content or decisions on a platform operating in the EU,
• You develop or fine-tune and distribute a GPAI model.

The details of scope and your role (provider, deployer, importer) need a legal assessment.

Fines

The Commission's page says the AI Office can request technical documentation for GPAI models, evaluate models, require corrective measures and issue fines; it does not give fine amounts on that page. Check the penalty framework in the official text and with your legal adviser. A draft implementing regulation also clarifies enforcement rules and, per secondary sources, is open for feedback until 9 November 2026.

What to do today: a 9-point checklist

1. AI inventory: Which AI systems, models and APIs do you use in your company and products?
2. Determine your role: For each system, are you a provider, a deployer or just a user?
3. Market map: Is your output or product used in the EU?
4. Risk class: Does your product's use area fall under Annex III (hiring, education, credit, biometrics, etc.)? If so, build a roadmap for 2 December 2027.
5. Transparency: Do users know they are interacting with AI? Is AI-generated content labelled?
6. AI literacy: Has your team had training on using AI? (Applicable since 2025.)
7. Documentation and records: Are models, data sources, test results and decisions written down?
8. Supplier contracts: Get compliance documents and data processing terms from the model/API providers you use.
9. Privacy compliance: Alongside EU rules, your national data protection obligations (such as KVKK in Türkiye) still apply. See our AI use policy guide.

Plain takeaways for business owners

• You gained time, but the clock is running: The high-risk date moved to 2027, but inventory, risk classification and documentation take a long time.
• Compliance can be a sales advantage: EU enterprise customers will ask suppliers for evidence of compliance.
• Think of AI investments together with cost: See how to calculate ROI on AI investments.
• Enforcement is real: The Office's powers over GPAI models have existed since 2 August 2026.

AI projects with Aktaş Digital

In AI chatbot, document analysis and automation projects we plan the data flow, user disclosure and documentation from the start. If you'd like to discuss the technical architecture and scope for an AI product aimed at the EU market, you can use our quote form. For legal compliance assessment we recommend consulting your own legal adviser. Related services: AI solutions.

Frequently Asked Questions

Is the EU AI Act fully in force today?

The Act has been applicable since 2 August 2026, but obligations are phased in. The strict rules for Annex III high-risk systems start on 2 December 2027 and for products-embedded systems on 2 August 2028.

Does it affect me as a company established outside the EU?

It can, if you offer AI systems to the EU market or your system's output is used in the EU. Assess the scope with a lawyer.

What is a GPAI model?

A general-purpose AI model able to perform a wide range of tasks (such as large language models). Providers of these models have separate obligations and are subject to the AI Office's powers.

What is high-risk AI?

Systems used in sensitive areas listed in Annex III of the Act (biometrics, critical infrastructure, education, employment, migration, etc.). Strict obligations on quality, documentation and human oversight are foreseen for them.

What is the AI literacy obligation?

Under the Act, organisations are expected to ensure that staff who use AI have a sufficient level of knowledge; this has applied since 2 February 2025.

Conclusion

The EU AI Act is now being applied; only the dates for high-risk systems moved to 2027. Use the time for inventory, role determination, documentation and transparency work. The first thing you can do today: write all the AI systems in your products and company, and their link to the EU, into one table.