← All insights EU AI Act

What the August 2026 deadline means for in-house teams

If you run legal, compliance or risk for an organisation that builds, buys or deploys AI, one date should already be in your board pack: 2 August 2026. That is when the bulk of the EU AI Act's obligations for high-risk AI systems begin to apply. It is not a soft launch. It is the point at which a regulation that entered into force in August 2024 starts to carry real, enforceable consequences for the way you use AI.

The good news is that the Act phases in, so you are not facing everything at once. The harder truth is that the work needed to comply takes months, not weeks — and most of it is organisational, not legal. Here is what actually lands, and what to do now.

The timeline, briefly

The EU AI Act (Regulation (EU) 2024/1689) applies in stages:

• February 2025 — prohibitions on "unacceptable risk" AI practices, plus AI-literacy obligations, already apply.
• August 2025 — obligations for general-purpose AI (GPAI) models and the governance/penalty architecture began.
• August 2026 — the main body of obligations for high-risk AI systems applies. This is the one most in-house teams need to plan for.
• August 2027 — a later tranche for high-risk AI embedded in products already covered by EU product-safety law.

Step one: you cannot comply with what you cannot see

The single most common gap I see is that organisations do not have an inventory of the AI they actually use. Shadow AI — tools adopted by individual teams, models embedded in vendor products, features switched on by a SaaS provider — means the real footprint is almost always larger than legal assumes.

Before you can classify anything, you need a living register of your AI systems: what they do, who owns them, what data they touch, and whether they were built in-house or bought in. This is unglamorous and it is the foundation of everything that follows.

Step two: classify by risk

The Act is risk-based. Each system falls into one of four buckets: prohibited, high-risk, limited-risk (transparency obligations), or minimal-risk. Most of the compliance burden attaches to high-risk systems — for example AI used in recruitment, credit, essential services, or as a safety component of a regulated product.

The classification question is not "is this AI?" It is "what is this AI deciding, and about whom?"

Getting classification right matters enormously, because it determines whether a system carries a handful of transparency duties or the full high-risk regime: risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity.

Step three: know whether you are a provider or a deployer

Your obligations differ depending on your role. A provider develops an AI system or has it developed and places it on the market under its own name. A deployer uses an AI system in the course of its activities. Many organisations are both, for different systems — and the line can shift if you substantially modify a third-party system or put your own branding on it.

Why starting now is the cheap option

Retrofitting governance onto AI that is already in production is expensive and disruptive. Building the inventory, classification and contractual hooks now — while the August 2026 date is still ahead of you — lets you prioritise, spread the cost, and avoid the scramble that tends to produce poor, defensive decisions. Regulators rarely punish organisations that can show a credible, documented programme of work. They are far less forgiving of those who cannot show they even knew what AI they were running.

This article is provided for general information only. It is not legal advice and does not create a lawyer–client relationship. The EU AI Act is detailed and fact-specific; obtain qualified advice for your circumstances. For the authoritative text, see the Legislation Library.