An engraved drafting compass inscribing an arc crossed by a single vertical timeline rule.

The EU AI Act Goes Live in August. Here's the Part That Reaches You.

June 29, 2026

Executive Summary

EU AI Act compliance does not arrive in one big bang on August 2, 2026. The Digital Omnibus deal pushed the heavy high-risk obligations to December 2027, so the August date is narrower than the headlines suggest.
What still lands on schedule: transparency labeling for chatbots and AI-generated content, live enforcement power over general-purpose AI models, and the full penalty machinery behind it.
The reach is extraterritorial. If your AI output is used in the EU, you are in scope even with no EU office, staff, or servers.
Most US firms will feel this through their European customers first, as AI Act clauses show up in RFPs, security reviews, and contracts.
The documentation you build to answer August's transparency rules is the same documentation December 2027 will demand, so there is no reason to wait.

I have watched a lot of regulation get announced as a cliff and arrive as a speed bump. The EU AI Act has been the opposite kind of confusing: a real cliff that keeps getting its edges sanded down, quietly, while the press keeps the old date in the headline. So let me give you the version with both feet on the ground. EU AI Act compliance is genuinely here for some things on August 2, 2026, and genuinely a year and a half away for others. Knowing which is which is the whole game.

An engraved clock fused with a gear and a pointer crossing a threshold.

What August 2 Actually Triggers

On August 2, 2026, three things switch on: transparency obligations, enforcement authority over general-purpose AI, and the penalty system that gives both teeth. The original plan was bigger. The Act entered into force on August 1, 2024 and was written to become fully applicable exactly two years later, according to the EU Artificial Intelligence Act implementation timeline. Then reality, and a lot of industry lobbying, intervened.

On May 7, 2026, the Council and Parliament reached provisional agreement on the Digital Omnibus, a simplification package that defers the high-risk rules. Per the Council of the EU, standalone high-risk systems now apply December 2, 2027, and high-risk systems embedded in regulated products move to August 2, 2028.

One honest caveat, because I am not going to pretend the ink is dry. The deferral is a political agreement, not yet published law. As Covington's privacy team notes, the changes only take legal effect on formal adoption and publication in the Official Journal, expected before August 2. Plan for the deferral, but keep the receipts in case the date moves again.

Four nested engraved triangles graduated by weight, showing the AI risk tiers.

The Risk Tiers in Plain Language

The Act sorts AI into four buckets by how much harm it can do, and your obligations follow the bucket. This is the part people skip, and it is the part that tells you whether August matters to you at all.

Prohibited systems come first. Social scoring, untargeted scraping of facial images, emotion recognition in workplaces and schools, and a handful of manipulative uses are simply banned, and have been since February 2025. The Omnibus added a fresh prohibition on AI that generates non-consensual intimate imagery. If you are doing any of these, stop reading and call a lawyer.

High-risk systems are the famous tier: AI used in hiring, credit decisions, education, and critical infrastructure (Annex III), plus safety components of regulated products (Annex I). This is the bucket with the long obligation list, and this is the bucket that just moved to late 2027.

Then there is the limited-risk transparency tier, which covers chatbots and synthetic media. That one lands in August. Everything else is minimal risk with no new duties. If your AI writes marketing copy or sorts your inbox, you are almost certainly here. This tiering is the same logic we walked through in writing an AI governance policy people will actually follow: match the control to the actual risk, not to the noise.

Two engraved landmass arcs joined by a compass span, showing transatlantic reach.

Which Obligations Reach US Firms

If your AI system touches the EU market or its output is used in the EU, the Act reaches you, full stop. The design mirrors GDPR's extraterritorial scope on purpose. As compliance analysts have put it, a US company with no EU entity, no EU staff, and no EU servers is still in scope if its AI output is used inside the EU.

Two obligations are live for in-scope US companies in August. First, transparency under Article 50: you must tell people when they are talking to an AI, and you must mark AI-generated or manipulated content, including deepfakes, as artificial. The Commission published its Code of Practice on transparency on June 10, 2026, with a July 22 window to sign and earn a presumption of conformity. Second, if you provide a general-purpose AI model, the AI Office gains direct enforcement authority over you on the same day.

Here is the part regulators do not even have to lift a finger for. Your European customers will move first. They are already adding AI Act language to RFPs, security questionnaires, and master service agreements, pushing the obligations down the supply chain through contracts and indemnities. I have seen this movie with GDPR. The regulator is slow. Your biggest customer's procurement team is not. This is exactly why we keep arguing that responsible AI is not a compliance tax, it is how you keep the deal.

Stacked engraved ledger plates bound by a gold rule.

Documentation You'll Need Either Way

The documentation August asks for and the documentation December 2027 will demand overlap so much that splitting them is a false economy. Both rest on one foundation: knowing what AI you actually run.

That foundation is exactly what most organizations are missing. A March 2026 Cloud Security Alliance research note found more than half of organizations still lacked a basic inventory of the AI systems they operate. You cannot classify risk, label outputs, or fill out a customer's security questionnaire if you cannot list your systems. The readiness gap is not new either: a Deloitte Legal study of 500 decision-makers found just 26.2% of firms had actively started AI Act preparation as of late 2024, per reporting on the survey.

Build four things now and you cover August and most of 2027 at once: an AI system inventory with a risk tier per system, a transparency mechanism that discloses AI interaction and labels generated content, technical documentation describing what each model does and on what data, and a record of human oversight for anything consequential. None of that is wasted. It is the same evidence trail we describe in treating privacy as infrastructure rather than a bolt-on.

An engraved vertical sequence of checkpoints with a balance scale at the base.

A Readiness Checklist

Start with scope, then transparency, then documentation, in that order. The sequence matters because most teams burn weeks on controls for systems that turn out to be minimal risk.

First, inventory every AI system and the data it touches, then assign each a tier. Second, for anything customer-facing or content-generating, add the August transparency disclosures and labeling. Third, if you ship a general-purpose model, treat the AI Office as a live regulator starting in August. Fourth, ask your EU customers for their AI Act expectations now, because their contracts will outrun the statute. Fifth, name an EU authorized representative if you are a non-EU provider of a high-risk system, since that requirement survives the deferral. Penalties make the prioritization easy: transparency and high-risk breaches run up to 15 million euros or 3% of global turnover, and prohibited-practice violations reach 35 million euros or 7%, per Article 99 of the Act.

This is also a sovereignty question as much as a compliance one, the same theme we traced when digital sovereignty stopped being a policy debate and became an infrastructure bill. Where your AI runs, and who can see its data, is now a line item.

A wide engraved frieze of compass and orbit motifs.

Frequently Asked Questions

When Does the EU AI Act Take Effect?

It entered into force on August 1, 2024, and phases in over several years. Prohibited practices applied in February 2025 and GPAI model rules in August 2025. Transparency obligations and GPAI enforcement land August 2, 2026, while high-risk obligations are being deferred to December 2027 under the Digital Omnibus.

Who Does the EU AI Act Apply To?

It applies to providers and deployers of AI systems connected to the EU market. That includes companies based outside the EU when their AI system is placed on the EU market or its output is used inside the EU.

Does the EU AI Act Apply to US Companies?

Yes, if you place an AI system on the EU market or its output is used in the EU. The scope is deliberately extraterritorial, and US providers of high-risk systems must also designate an EU authorized representative.

What Is a High-Risk AI System?

It is AI used in sensitive contexts such as hiring, credit, education, or critical infrastructure (Annex III), or AI that acts as a safety component of a regulated product (Annex I). These systems carry the heaviest obligation list, now due in December 2027.

What Are High-Risk AI Obligations Under the EU AI Act?

Risk management, data governance, technical documentation, human oversight, record-keeping, transparency, and cybersecurity, capped by a conformity assessment and CE marking. The Digital Omnibus moved the deadline for these to December 2, 2027.

References

Back to Blog