Update (30 October 2026): The AI Omnibus (Regulation (EU) 2026/1744), in force since 27 July 2026, changed the timetable described below — the Annex III high-risk obligations now apply from 2 December 2027, and the Annex I product-embedded high-risk obligations from 2 August 2028. Most Article 50 transparency obligations kept their 2 August 2026 date. See our analysis of the Digital Omnibus. The readiness checklist below stands — with more time to execute it, and no excuse not to.
The AI Act entered into force on 1 August 2024, but its obligations arrive in stages. The prohibitions on unacceptable-risk practices have applied since February 2025, and the obligations for general-purpose AI models since August 2025. When this piece was written, the date that mattered for most companies was 2 August 2026, when the bulk of the regulation — including the high-risk regime of Annex III — was due to apply; the AI Omnibus has since moved the high-risk deadlines, as set out in the update note above.
A short readiness check:
- Inventory. Do you know, in one place, every AI system your company develops, procures or embeds? Most compliance gaps we see start with an incomplete inventory, not a misread article.
- Classification. For each system, determine the risk category — and document the reasoning. "Not high-risk" is a conclusion that needs a written basis, particularly where Annex III use cases (employment, credit, essential services, and others) are nearby.
- Role. The Act's obligations differ sharply between providers, deployers, importers and distributors. Many technology companies are more than one of these at once — for different systems, or even for the same system in different arrangements.
- Contracts. If you procure AI capability from vendors, your compliance depends partly on their conduct. Information obligations, cooperation duties and audit rights belong in the contract — not in a goodwill assumption.
- Governance. Transparency duties, human oversight, logging and post-market monitoring are operational processes, not documents. If they exist only in a policy PDF, they do not exist.
None of this needs to be dramatic. For companies that already run structured GDPR and information-security programmes, the AI Act is an extension of a familiar discipline — the work is in the inventory, the classification and the contracts. If any of those three are open questions for you, we should talk.