The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in staggered phases through 2027 and beyond. It is risk-based: the obligations scale with the potential for harm, not with the sophistication of the technology. A simple recommendation engine and a frontier model can both fall almost entirely outside the heavy provisions, while a comparatively modest system used to screen job applicants can sit squarely inside them.
Two structural features matter before anything else. First, the Act is extraterritorial: much like the GDPR, it applies where an AI system's output is used in the EU, regardless of where the provider or deployer is headquartered. Second, your obligations depend on your role - a "provider" who develops and places a system on the market carries far heavier duties than a "deployer" who merely uses one. Most companies building on top of a third-party foundation model are deployers, but substantial fine-tuning or rebranding can quietly reclassify them as providers.
Every system you build, buy, or deploy falls into one of four tiers. Classifying your inventory against this pyramid is the single most valuable compliance activity, because it tells you which rules apply and, just as often, which do not.
Unacceptable risk systems are prohibited: social scoring, manipulative or deceptive systems, untargeted scraping of facial images, and emotion recognition in the workplace or educational settings, among others. High-risk systems - the heart of the Act - include AI used in hiring and employment, credit scoring, biometric identification, critical infrastructure, education, essential public and private services, and law enforcement, plus AI acting as a safety component of regulated products. Limited-risk systems carry transparency duties only: tell people they are interacting with AI, and label synthetic media. The vast majority of business software lands in the minimal-risk tier, which attracts no new obligations under the Act.
For most of 2025, organizations planned around a single dreaded date: 2 August 2026, when obligations for high-risk systems were due to apply. By late 2025 it was clear that implementation was off track - harmonized standards, the classification guidelines, and national authority designations were all behind schedule. In response, the European Commission tabled the Digital Omnibus on AI on 19 November 2025, and on 7 May 2026 the Council and Parliament reached a provisional political agreement to amend the Act [1].
The most consequential change is a staggered deferral of the high-risk obligations [2]:
The agreement also adds a new prohibition targeting AI-generated non-consensual intimate imagery and child sexual abuse material, and it softens the AI-literacy duty from an obligation to "ensure" literacy to one to "take measures to support" it [3].
The pragmatic posture is therefore to treat the extra time as runway to do the work properly - not as a reason to stand down.
Several obligations are already live and carry no remaining grace period. These should be in place now, regardless of the Omnibus.
Because almost every AI product is built on a general-purpose model, the obligations on model providers cascade down to those who deploy them. The Commission's AI Office published the final General-Purpose AI Code of Practice in July 2025, covering transparency, copyright, and - for models with systemic risk - safety and security [6]. Signing the Code is voluntary, but it confers a presumption of conformity and a lighter-touch, collaborative relationship with the AI Office; non-signatories must demonstrate compliance by other adequate means and can expect closer scrutiny [7]. When selecting model vendors, signatory status is a useful proxy for lower integration risk.
These duties are engineering-light but must be designed into a product rather than bolted on at launch. Teams shipping chatbots or generative features should treat December 2026 as the date to plan against.
The deferral gives in-scope organizations roughly sixteen extra months on high-risk obligations. The trap is relief followed by amnesia. Two moves convert the runway into an advantage:
Providers of high-risk systems must demonstrate conformity before placing a system on the market. There are two broad routes, and knowing which applies prevents both under- and over-investment.
In both cases the provider must establish a risk-management system, ensure data governance and appropriate technical documentation, enable logging and record-keeping, provide for human oversight, and meet accuracy, robustness, and cybersecurity requirements. The system is then CE-marked and registered in the EU database for high-risk systems before going to market, with post-market monitoring afterward. Deployers carry their own duties: operating the system within its intended purpose, ensuring human oversight, retaining logs, and - for public bodies and certain others - completing a fundamental-rights impact assessment.
The practical challenge is meeting these obligations across a large portfolio without a compliance function that throttles every release. The organizations doing this well treat governance as reusable infrastructure rather than a per-project tax.
The Act's penalties are tiered and, for the most serious breaches, exceed the GDPR's. Prohibited practices can draw fines of up to €35 million or 7% of global annual turnover; breaches of high-risk and GPAI obligations up to €15 million or 3%; and supplying incorrect information to authorities up to €7.5 million or 1% [8]. For SMEs and startups, the penalty is the lower of the fixed amount or the percentage. Enforcement of GPAI obligations by the AI Office begins in August 2026, transforming the soft-touch monitoring of the past year into the power to compel documentation, restrict market access, and impose fines.
The EU AI Act in 2026 is best understood not as a single cliff-edge but as a sequence of obligations arriving at different times - some already live, one biting soon, and the largest set now pushed into late 2027. The Digital Omnibus has bought in-scope organizations valuable time, but it has not removed the work, and until it is published the original timeline technically still stands.
The organizations that will fare best are those that classify their systems first, keep their compliance programs running through the delay, and build governance as durable, reusable infrastructure. Done that way, the Act becomes less a brake on innovation and more a shared baseline that protects users while letting teams move quickly and sell with confidence across the European market.