The EU AI Act Compliance Countdown: What Every Enterprise Must Do Before August 2, 2026

Regulation Enters Into Force

Published in EU Official Journal (OJ L 2024/1689, July 12, 2024). The 20-day entry clock began.

Prohibited AI Practices Banned

Social scoring, cognitive manipulation, real-time remote biometric ID in public spaces (with narrow exceptions) are now prohibited across all EU-connected markets.

GPAI Model Providers Must Comply

General-purpose AI model providers (OpenAI, Google, Anthropic, Mistral, etc.) must maintain technical documentation, comply with copyright rules, and publish summaries of training data.

HIGH-RISK AI (ANNEX III) - THE BIG DEADLINE

All enterprises deploying high-risk AI must have: conformity assessments completed, technical documentation filed, EU database registration active, human oversight mechanisms in place, and incident reporting systems live.

High-Risk AI (Annex I) - Regulated Products

AI embedded in regulated product categories (medical devices, machinery, vehicles, toys) under the existing harmonized legislation framework.

Biometric Identification

Real-time and post-event biometric systems

Critical Infrastructure

AI in water, gas, electricity, transport networks

Education and Vocational Training

AI for student assessment, admissions, proctoring

Employment and HR

AI used in hiring, promotion, task assignment, monitoring

Essential Private and Public Services

Credit scoring, insurance, benefits eligibility AI systems

Law Enforcement

AI systems supporting police investigations and risk assessment

Migration and Border Control

AI for visa assessment, asylum processing, risk profiling

Administration of Justice

AI supporting judicial decisions and dispute resolution

Risk Management System (Article 9)

Continuous process identifying and mitigating risks to health, safety, and fundamental rights throughout the AI lifecycle. Not a one-time assessment.

Data Governance (Article 10)

Training, validation, and testing data must meet quality criteria. Bias must be examined and mitigated. Data governance policies must cover provenance and collection conditions.

Technical Documentation (Article 11)

Comprehensive documentation must be prepared before the system is placed on the market - including general description, design specifications, development methodology, and monitoring procedures.

Automatic Event Logging (Article 12)

High-risk AI systems must log events automatically to enable post-market monitoring and post-incident investigation. Logs must be kept for minimum periods defined by the regulation.

Transparency and Instructions (Article 13)

Systems must be transparent enough for deployers to understand capabilities and limitations. Instructions for use must be provided in a format appropriate for the deployer's role.

Human Oversight (Article 14)

High-risk AI systems must be designed so that humans can effectively oversee outputs - including the ability to override, interrupt, and disregard system outputs. "Human in the loop" is not enough; humans must understand what they are overseeing.

EU Database Registration (Article 49 + Annex VIII)

Before deployment, high-risk AI systems must be registered in the EU-wide database maintained by the European AI Office. Registration is public and searchable by supervisory authorities.