Annex IV documentation, Article 4 literacy programs, ISO/IEC 42001 alignment, conformity declarations — powered by our own ComplianceLint scanner (Profiling Wizard + Human Gates + AI Observation) so most of the inventory work is automated.
| Date | Status |
|---|---|
| 1 Aug 2024 | Regulation (EU) 2024/1689 entered into force. |
| 2 Feb 2025 | Article 4 AI literacy + Article 5 prohibited practices enforceable. |
| 2 Aug 2025 | General-purpose AI model obligations enforceable. |
| 2 Aug 2026 | High-risk Annex III obligations — legally binding deadline today. A political agreement reached on 7 May 2026 (the EU "Digital Omnibus") will, once formally adopted (expected June–July 2026), defer this to 2 December 2027. Until OJ publication of the amending regulation, the August 2026 deadline remains the law. |
| 2 Aug 2027 | High-risk Annex I embedded systems — same status as above. Digital Omnibus will defer to 2 August 2028 once formally adopted. |
Most teams discover they don’t actually have a clear inventory of the AI systems running inside their company — let alone a defensible risk classification. Here’s the practical sequence we run with clients:
Three fixed-price entry points dedicated to the EU AI Act specifically. For broader AI compliance covering GDPR, NIS2, CRA, ISO 27001, and ePrivacy, see our AI Compliance service and the AI Governance package.
We built ComplianceLint, an EU AI Act scanner that runs locally in your IDE. The Profiling Wizard scopes which obligations apply to your AI system (covering Annex III categories, Art 6(3) derogation, role assignment, Art 2 carve-outs). Human Gates capture judgement-grade attestations. The AI Observation flow surfaces disagreement between AI-derived and human-derived answers. Most inventory and risk-classification work runs automatically — expert time goes to judgement, not data entry.
The same engine adapts to other European regulations — GDPR, NIS2, CRA, ISO 27001, ePrivacy, Whistleblowing — with modules rolling out on demand.
The Digital Omnibus does not change penalty amounts. Fines reach up to:
Yes if you sell, deploy, or distribute AI systems into the EU market — regardless of where your company is registered. The Act applies extraterritorially.
The EU Digital Omnibus is a political agreement reached on 7 May 2026 that proposes deferring high-risk Annex III obligations from 2 August 2026 to 2 December 2027 (and Annex I embedded systems from 2 Aug 2027 to 2 Aug 2028). Formal adoption + OJ publication are expected June–July 2026. Until then, the current law (August 2026) remains in force. Penalty amounts are unchanged.
Single high-risk system: 8–12 weeks with a responsive engineering team. Multiple systems: 10–14 weeks for the bundle — we work in parallel where we can.
You’re likely in the limited-risk or minimal-risk tier with much lighter obligations. Article 50 transparency rules may still apply (chatbots must disclose, deepfakes must be labelled). We confirm classification in the EU AI Act Deep Audit (or the broader AI Readiness Assessment €2,500 package on the /packages/ page).
Yes — in force since 2 February 2025. Every provider and deployer of AI must ensure their staff (and anyone operating AI on their behalf) has a sufficient level of AI literacy. We deliver a 4-tier curriculum with documented assessment.
That’s our broader compliance work — see the AI Compliance service. The ComplianceLint engine adapts to multiple regulations; modules for GDPR, CRA, ePrivacy, NIS2, ISO 27001 and Whistleblowing roll out as priority demand emerges.
We’ll tell you which package fits, or whether you need one. No sales pressure.
Email us →