Article 50 has applied since 2 August 2026, and Article 4 since 2 February 2025. Chapter IX market surveillance applied from 2 August 2026. Two obligations are live while everyone talks about the ones that are not.
Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved standalone Annex III high-risk systems to 2 December 2027 and high-risk AI embedded in Annex I products to 2 August 2028. It did not move Article 5, Article 4, Article 50 or Chapter IX. Article 50 has applied since 2 August 2026 and Article 4 since 2 February 2025. Boards that read the deferral as a general reprieve are planning around obligations that are already live.
There is no “we are working on it” defence. This is enforceable market access law, and the exposure sits at board level.
GDPR regulated data handling. The EU AI Act regulates whether your AI systems can legally exist in the EU market. That is a categorically different risk profile.
Each penalty tier is applied independently, and penalties are calculated on global turnover, not EU revenue. But financial penalties are only part of the risk. If AI is embedded in core product lines, suspension is operational paralysis.
€35M
or 7% of global annual turnover
Prohibited AI practices under Article 5 only
€15M
or 3% of global annual turnover
Most operator obligations under Article 99(4), including the high-risk duties, Article 50 and deployers' Article 26 duties
€7.5M
or 1% of global annual turnover
Incorrect or misleading information to authorities under Article 99(5)
High-risk classification is triggered by intended purpose, not marketing language. Misclassification is a governance failure.
The EU AI Act applies where
A company established outside the EU is in scope where the output its system produces is used in the Union. This is not a domestic EU issue.
The EU AI Act carries global compliance obligations, with direct market access consequences wherever the output an AI system produces is used in the Union.
If classified as high-risk, compliance requires structural implementation across ten mandatory domains.
A documented, lifecycle-based framework for identifying, evaluating and mitigating AI risk must be operational before market placement. Without it, there is no evidentiary foundation for any other compliance claim.
Training, validation and testing datasets must meet documented quality criteria. Bias must be identified and mitigated. Regulators and enterprise clients will ask for this evidence. Absence constitutes a structural governance failure.
A complete technical record of system design, architecture, training methodology and performance must be maintained and available to competent authorities on request. Incomplete documentation is grounds for market withdrawal.
Automatic logging of system operation must be maintained to enable post-hoc reconstruction of AI decisions. In an enforcement investigation, the inability to reconstruct a decision is itself evidence of non-compliance.
Deployers must receive sufficient information to understand system capability, limitations and appropriate use. Transparency failures under Article 99(4) carry penalties of up to €15 million or 3% of global annual turnover.
Operational mechanisms enabling human intervention, override and monitoring must be designed into the system. Boards cannot delegate this obligation to engineering alone. It requires governance-level accountability.
Measurable performance thresholds, resilience testing results and cybersecurity safeguards must be documented and validated. Performance assertions without evidential backing are legally undefendable under regulatory inspection.
A structured quality management framework covering all compliance obligations must be implemented and maintained. This is the operational envelope within which all other requirements function.
Before market placement, the system must complete either internal self-assessment (Annex VI) or third-party assessment by an accredited notified body (Annex VII). No conformity assessment. No CE marking. No lawful EU market access.
High-risk AI systems listed in Annex III must be registered in the EU database before market placement (Article 49(1)), and so must an Annex III system its provider has concluded is not high-risk under Article 6(3) (Article 49(2)). Annex III point 2 critical-infrastructure systems register at national level instead. Most registrations are publicly visible; law-enforcement, migration, asylum and border-control entries sit in a restricted non-public section under Article 49(4). Non-registration is an independent enforcement trigger.
This is not policy drafting. It is governance infrastructure.
See the full EU AI Act conformity assessment execution frameworkBefore market placement, high-risk systems must undergo conformity assessment.
Provider self-verification, but with full liability retained. May require 3 to 6 months.
Mandatory in specific cases, involving accredited notified bodies. May extend toward 9 to 10 months due to notified body scheduling constraints.
Compliance will move from legal consideration to competitive filter. Non-compliant vendors will quietly lose contracts before they face fines.
We go through what you run, which duties reach it, and what is outstanding. No obligation, and you keep the findings either way.
Book assessment