EU AI ACT · 8 MIN READ

EU AI Act: What Organisations Need to Prepare for Next.

The EU AI Act is moving through its phased implementation timetable. Organisations need to understand which requirements apply, when obligations take effect and where preparation should begin.

INTAI Research · Published 21 July 2026

Read the Update

A Phased Law, Not a Single Deadline

The EU AI Act does not arrive all at once, and treating it as a single compliance deadline is one of the more common misreadings organisations make about it. It entered into force on 1 August 2024 and takes effect in a series of staged obligations spread across several years, each applying to a different category of AI system or provider.

The first substantive deadline has already passed: from 2 February 2025, prohibited AI practices, systems the Act bans outright, such as certain forms of social scoring and manipulative AI, ceased to be permitted, alongside new AI literacy obligations for organisations deploying AI. From 2 August 2025, the Act’s governance provisions and the obligations for general-purpose AI model providers came into force, with the European AI Office publishing the final Code of Practice for general-purpose AI providers on 10 July 2025 to help those providers demonstrate compliance.

The High-Risk Timeline Has Just Moved

This is the detail most worth getting right, because it has changed recently and a great deal of existing commentary has not caught up. Under the original text, obligations for high-risk AI systems were due to apply from 2 August 2026. In May 2026, the EU reached a Digital Omnibus agreement that revised this timetable materially.

Under the revised schedule, obligations for Annex III high-risk systems, the use-based category covering areas such as employment, credit scoring and law enforcement, are now postponed from 2 August 2026 to 2 December 2027, a deferral of sixteen months. Obligations for Annex I high-risk systems, product-integrated AI embedded in regulated products such as medical devices, lifts and radio equipment, are postponed from 2 August 2027 to 2 August 2028. The stated reason is the practical difficulty of operationalising testing, documentation and third-party conformity assessment requirements on the original timetable. What has not moved is the general-purpose AI track: the Commission’s full enforcement powers over GPAI providers, including requests for information, model access and recall powers, still activate on 2 August 2026, backed by penalties of up to €35 million or 7% of global annual turnover.

Central Insight

The practical effect of the May 2026 deferral is not that high-risk AI governance can wait. It is that the deadline pressure has shifted: general-purpose AI provider obligations remain on the original, unmoved 2 August 2026 enforcement date, while high-risk system obligations now have a longer runway. Organisations that read the deferral as blanket breathing room, rather than a change specific to Annex III and Annex I systems, risk misallocating the very preparation time the extension was meant to provide.

Where Preparation Should Begin Now

Regardless of the exact date any specific obligation takes effect, the practical starting point is the same: knowing which AI systems the organisation develops, deploys or procures actually fall into a regulated category under the Act, and under which annex.

That means building or updating an AI system inventory that tags each system against the Act’s risk categories, confirming which role the organisation holds for each system, provider, deployer, importer or distributor, since obligations differ meaningfully by role, and using the extended Annex III timeline productively rather than as a reason to deprioritise the work. A sixteen-month deferral is a genuinely useful amount of time to build documentation, risk management processes and human oversight arrangements properly. It is considerably less useful if the organisation spends the first twelve months of it not preparing at all.