AI, Data & Technology

EU AI Act 2026: Deadlines, Obligations, and Outstanding Issues

Sebastian Addicks

October 14, 2026

EU AI Act 2026: Deadlines, obligations, and outstanding issues

The first proposal for regulating artificial intelligence in the EU was published on April 21, 2021. Voices were quickly raised, labeling the planned obligations as a brake on innovation and an economic burden. Proponents argue in favor of protecting fundamental rights (e.g., the ban on social scoring) and a potential strategic advantage that promises sustainability. This discrepancy was evident at relevant tech conferences. The tech-bro AI startup panel would reinforce each other's belief that the EU was only putting obstacles in their way, while right next door, discussions were taking place about potential consequences, discrimination, data protection, and ethics.

One thing is clear: legally capturing developments in the AI sector is a mammoth project. While progress reached one milestone after another, the responsible bodies in the EU first had to clarify what they were actually trying to regulate. As the world's first comprehensive AI law, the EU AI Act plays a central role in the future development and implementation of AI, not just in Europe, but globally.

This article provides an overview of the current situation. What needs to be considered when using AI in companies today? How should I structure my solutions as a company to already cover future planned implementations of the law? What opportunities are there?

Overall, it should be noted that the content of this article may quickly become outdated. Especially regarding the specific details of the EU AI Act, it is worth following current developments directly in the relevant primary sources.

EU AI Act

Current status

The EU AI Act officially entered into force on August 1, 2024. However, the legal implementation of the individual requirements is being staggered over time. Leading up to its entry into force, there were more than three years of proposals, discussions, disputes, and last-minute renegotiations. The Future of Life Institute has documented the key milestones prior to 2024 in a historical timeline. It also offers an overview of application deadlines, which includes events beyond just the key dates. However, they are unfortunately lagging behind here, as the current edit date shows a status as of August 1, 2024. The timeline therefore contains the original staggering and not the now significantly adjusted one. The binding current status and future deadlines can be found in the European Commission's "Implementation Timeline."

On August 2, 2026, the EU AI Act became largely applicable. Just 6 days earlier, on July 27, 2026, the AI Omnibus (an omnibus amendment act related to AI) and thus the first substantial change to the regulations entered into force. This urgent measure was necessary before the August deadline, as otherwise high-risk obligations would have applied even though the necessary harmonized standards (technical specifications) were not yet available. Therefore, the obligations for high-risk AI systems were postponed to December 2027. A distinction is still made here between standalone systems and systems embedded in regulated products. The obligations for the latter will not take effect until August 2028. Additionally, a new ban was added for AI systems that generate non-consensual sexualized imagery or child sexual abuse material. Newly drafted and moved to Article 4ais the permission to process sensitive data categories for the detection and correction of bias. The scope of addressees was expanded, while the threshold of strict necessity remained.

Overall, the adjustment aims to simplify the AI regulatory framework while maintaining guarantees for safety and fundamental rights. Consequently, deadlines are being extended, testing and experimentation opportunities are to be expanded, and companies developing and deploying AI in Europe are expected to benefit from greater legal clarity.

Deadlines at a glance

February 2, 2025

Check use cases against the prohibited list (e.g., emotion recognition in the workplace or social scoring)
Employees in dealing with AI qualify. A specific level of competence does not need to be guaranteed since the AI Omnibus Amendment (July 2026). However, the measures taken should be documented.

August 2, 2025

Anyone offering their own general-purpose models (GPAI):

Create and maintain model documentation
Disclosure of a detailed summary of training data
Strategy for handling copyrights (e.g., protection of training material)
Contact and model information must be public
Possible implementation: check documented data for accuracy, archive it in an immutable format, retain it for 10 years, and respond to requests from downstream providers within 14 days

Downstream providers:

Provide access to current model documentation
Demand clear contact and deadline arrangements from the provider
Quality and integrity guarantee for information provided by the direct supplier

August 2, 2026

Chatbots and AI content must be labeled (transparency obligations)
Member states must have implemented sanction rules. From this point on, authorities can conduct inspections and impose fines.
Requirements that were not postponed by the AI Omnibus remain in effect.

December 2, 2026

Prohibitions apply to AI systems that generate non-consensual sexualized deepfakes or depictions of child sexual abuse.
End of the transition period for machine-readable labeling. Providers of generative AI systems placed on the market before August 2, 2026, must now comply. For systems released after August 2, 2026, this obligation has been in effect since August 2026.

August 2, 2027

End of the grandfathering period for GPAI models
Providers of models placed on the market before August 2, 2025, must comply with GPAI obligations from this date. For models placed on the market later, these have already been in effect since August 2025.

December 2, 2027

Requirements apply to High-risk AI systems under Annex III:

e.g., in the areas of employment and human resources management, education, and biometrics
Excluded are AI systems that fall into an Annex III category but do not pose a significant risk to the health, safety, or fundamental rights of natural persons. However, profiling of natural persons is always considered high-risk.
Requirements in detail

August 2, 2028

Requirements apply to High-risk AI systems under Annex I:

AI systems that are themselves a regulated product or act as a safety component within one. However, this only applies if the product is already subject to third-party assessment, not self-assessment.
Twenty product laws are affected, e.g., those concerning machinery, medical devices, toys, and radio equipment.
For machinery, the separate AI conformity assessment is no longer required. The requirements are integrated into the Machinery Regulation and are assessed by the relevant authority (Art. 1 No. 41 Regulation (EU) 2026/1744). This simplifies the process by eliminating double assessments, while ensuring the content remains equivalent.
Requirements in detail

Source: Own representation based on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, as well as the implementation schedule and classification by the Federal Network Agency. Status: August 2026.

So, what do you need to keep in mind?

Classifying your own AI offering or AI usage in relation to the EU AI Act can quickly become confusing and overwhelming. Which risk category does my AI application fall into? Which specific deadlines must be met? What obligations must I fulfill as a provider or operator? Many companies are currently asking themselves these types of questions.

Since July 2026, the Federal Network Agency has taken on the role of market surveillance authority for the AI Regulation in Germany. At the same time, it serves as the central point of contact for questions and complaints. Oversight of GPAI models, however, lies with the European Commission's AI Office, which provides a practical guide, guidelines and a template for documenting the data basis .

For an initial assessment of your own use case, resources provided directly by the Federal Network Agency are a good place to start. A good starting point is the specially established AI Service DeskAmong other things, you will find the AI Compliance Compass, which allows for a non-binding assessment based on a few simple questions. The European Commission offers a similar tool in the form of the EU AI Act Compliance Checker . At this time, the tool is in its beta phase and is an ongoing project.

As a central body in the implementation of the AI Act, the Federal Network Agency also provides detailed information on specific areas of the AI Act, their implications, and the associated obligations. The topics covered can also be found on the AI Service Desk and have already been partially referenced in this article.

For those who wish to read the legal text itself beyond the initial classification, there are two prepared versions that are well-suited for searching content. The European Commission provides an AI Act Explorer on its platform, which allows you to search through chapters, articles, annexes, and recitals.

In my view, however, the Future of Life Institute's AI Act Exploreris more practical. It has a wider range of features and is more intuitive to use. For example, changes are immediately visible and can be compared with older versions at a glance (which is particularly useful for adjustments made by the AI Omnibus). In addition, the tool offers paragraph-specific permalinks and a language comparison across all 24 official languages.

It should be noted that the Future of Life Institute is not an official EU body, but an NGO registered in the EU Transparency Register that has accompanied the legislative process with its own positions. For binding citations, the consolidated version on EUR-Lex remains the authoritative source.

To get started with classifying your own use case, I recommend using one of the aforementioned assessment tools and independently categorizing the AI systems in question into the four risk levels defined by the regulation:

Unacceptable – prohibited, e.g., social scoring or real-time surveillance
High – Conformity assessment required
Limited – Transparency obligations
Minimal – No specific obligations

In the high-risk category, a distinction is made between two types of systems:

Systems in regulated products subject to third-party assessment
Systems in sensitive areas of application

It is important to note that these levels are not mutually exclusive. Transparency obligations still apply to systems that fall under the high-risk category. Furthermore, separate rules apply to GPAI models, regardless of the system classification.

Once the classification is determined, the list of obligations follows. Your specific role as a provider or deployer will determine which parts of these apply to you. If your assessment places you in the high-risk category, you should not base your preparation timeline on the deadlines of December 2027 and August 2028. There are three reasons for this.

First, the aforementioned harmonized standards, which specify the technical meaning of requirements such as "appropriate accuracy," are still missing. CEN and CENELEC (European standardization organizations), which have been tasked with drafting these, are currently aiming for publication by the end of 2026. If a company's product meets the published standards, it is considered compliant (presumption of conformity). Without corresponding standards, a company has no choice but to justify its own interpretation. However, this is significantly more complex and the outcome is uncertain, as both the testing body and the authorities must agree with your interpretation.

Second, the testing market is still in its infancy. Conformity assessments for high-risk systems may only be carried out by notified bodies. The regulations for this have been in effect since August 2, 2025. A check of the NANDO databaseof the Commission (queried on September 2, 2026), which lists all designated notified bodies, revealed that no such bodies exist yet under the established legal framework of the AI Act. Therefore, anyone who requires third-party testing in the high-risk sector currently cannot find an auditor. This is not a reason to wait, but rather a reason to start preparing now. The technical documentation, risk management, and quality management system must be in place before a testing body can even begin its work.

Third, some of the requirements cannot be met retroactively. Article 10 – Data and data governancerequires information on data collection, origin, and processing steps such as annotation and cleaning, as well as an investigation into potential biases. Anyone who does not take care of this documentation from the very beginning will find it nearly impossible to reconstruct later.

The same applies to logging under Article 12 – Record-keeping. It requires that the AI system be technically capable of logging events. The necessary architectural decisions should be made early on to avoid costly retrofitting. Linked to this is the retention obligation under Article 19 – Automatically generated logs. Logs that were never written do not exist.

In summary, it is worth tackling everything that can be implemented now, or at least planning for it, rather than waiting for the standards. Risk management, quality management systems, documentation of data provenance, and logging capabilities can be established independently of the pending standards and, in some cases, can only be fulfilled during the development phase.

The sources and tools mentioned already provide a good foundation for a company's AI strategy. Nevertheless, I recommend having your own assessment reviewed from a legal perspective.

What are the benefits of the EU AI Act?

Anyone who has read the previous part of this article might be surprised by this section. Standards that have not yet been developed, postponed deadlines, and no designated testing bodies yet. These open issues are certainly open to criticism. Nevertheless, the regulation offers opportunities. Some are already taking effect, while others will only do so once implementation is complete.

A regulation for all of Europe

Small and medium-sized enterprises in particular would struggle to launch a product across Europe if it meant having to check and comply with the national legal situation in every member state. As a regulation, the EU AI Act applies to all member states and, in essence, offers no room for national variation, at least regarding the substantive requirements. The structure of authorities and procedures remain national, as described previously. For the substantive requirements, this means: legal certainty, lower costs, and no market fragmentation.

Ethics cast in law

AI models learn from historical data and reproduce the structures contained within that data. If training data contains discriminatory patterns, the model recognizes these as rules and replicates them. A model that evaluates job applications based on past hiring decisions, for example, can systematically rate women more poorly.

For those who would like to delve deeper into data bias, I recommend the book Data Feminism by Catherine D'Ignazio and Lauren F. Klein. It is not a legal text, but an explanation of a problem to which the EU AI Act is attempting to find answers.

The ambition to use AI without discrimination has long been stated by many companies. However, it was impossible to verify. The EU AI Act turns this into verifiable obligations. Article 10(2) requires an investigation into potential biases that could negatively impact fundamental rights or lead to discrimination prohibited under Union law, along with appropriate measures for their detection, prevention, and mitigation.

For companies that take ethical standards seriously, this is a relief. Without rules, moral diligence is a cost disadvantage. The obligation makes morality a prerequisite. You no longer have to justify why you are putting in effort that competitors are skipping. The regulation sets a baseline for everyone.

A head start in trust

When purchasing an AI solution, origin and traceability play a role that should not be underestimated. According to a 2025 Bitkom survey of 604 German companies, the country of origin of the AI provider is important to 88 percent. 93 percent would prefer a provider from Germany, followed at a significant distance by the USA with 51 percent and EU countries other than Germany and France with 40 percent. However, a European origin advantage can only be derived from this to a limited extent: Japan ranks ahead of other EU countries at 43 percent, with France behind at 38 percent. Among the general public, 62 percent cite trust in the provider as the decisive criterion, even ahead of the quality of the results.

The obligations that a provider must fulfill under the EU AI Act anyway result in a level of trustworthiness from which customers directly benefit. If you use an AI system in your company, you are responsible for providing proof yourself. Evidence already held by the provider can be reused directly.

In addition, the location has a two-fold effect:

Systems operated in the EU are subject to European law and thus not only to the EU AI Act but also to data protection law. This simplifies supplier audits.
And it answers the question that users ask themselves: Where do my inputs end up and who has access to them?

Trust carries more weight than performance.

Establishment of AI regulatory sandboxes

The EU AI Act stipulates that the competent authorities of the member states must establish at least one AI regulatory sandbox. These can also be created as a joint effort by several authorities from different member states. The goal of these labs is, among other things, to create a legally secure, innovation-friendly framework that allows AI providers to develop, train, test, and validate their AI systems in a controlled environment before they reach the market. Furthermore, tests under real-world conditions are planned.

Special attention is paid to supporting start-ups and smaller providers, who are to be given priority access. A slight setback is the deadline for member states to establish or participate in a national AI sandbox, which has been postponed by the AI Omnibus. Originally scheduled for August 2, 2026, it has now been pushed back by one year to August 2, 2027.

Two things make this offer interesting. On one hand, collaboration protects against potential fines. If you follow the plan agreed upon with the authority in good faith, you will not be penalized for violations of the regulation (though you remain liable for damages to third parties).

On the other hand, you don't leave the sandbox phase empty-handed. Upon request, the authority will certify what went successfully, and this evidence must be viewed positively in the subsequent conformity assessment. This can significantly accelerate the process of bringing a product to market.

For Germany, the Federal Network Agency (Bundesnetzagentur) is a good place to find information on the current status of AI labs. Together with the Hessian Ministry for Digitalization and Innovation, a pilot project to simulate an AI regulatory sandbox was already conducted and concluded on March 17, 2026.

Documentation you can request

Anyone purchasing AI models or systems to use within their company, whether internally or as part of a product, is required to provide proof. To provide complete documentation, you are dependent on the provider's records. Before the EU AI Act, obtaining these documents could be tedious and a matter of negotiation between the two parties.

Now, Article 53 mandates what providers of general-purpose models must provide: technical documentation, information for downstream providers, a copyright strategy, and a summary of the training content.

The provider is therefore already obligated to maintain these documents and must make parts of them available to the purchaser upon request. The specific documents are listed in Annex XII of the regulation.

It is important to note, however, that anyone who significantly further trains a third-party model becomes a provider themselves and must, in turn, maintain the aforementioned documentation. The Commission draws the line at one-third of the original training compute. The obligations are then limited to the modifications made, not the entire model.

Potential role model

It is often expected that other legal jurisdictions will follow the European model, thereby giving European providers a head start. This so-called Brussels Effect, named after legal scholar Anu Bradford, largely occurred with the GDPR: by 2024, 172 countries had their own data protection laws, most of which were clearly influenced by it.

With the EU AI Act, this effect is currently weakly supported. According to an analysis by the Center for European Policy Analysis (CEPA), only Canada and Brazil are working on similar frameworks. Brazil's project is stalled, while Canada's Artificial Intelligence and Data Act (AIDA) has failed.

The UK, Switzerland, Singapore, Japan, and others are taking a less restrictive path, and South Korea has only adopted transparency and risk management requirements.

For European providers, this means: the home-field advantage must be earned; it does not necessarily arise from the law itself.

Conclusion

The EU AI Act is a signpost toward a legally secure, transparent, and responsible AI future. It is still on shaky ground, but the plans for the foundation are already in place. Standards are still missing, testing bodies need to be implemented, and deadlines have been postponed more than once. However, the direction is already clear. There is no need to wait for the final coat of paint.

The first steps required now:

Take stock. Which AI is running in the company, where does it come from, who is using it? Create clarity and document it.
Classify. Prohibited, high-risk, subject to transparency requirements, or non-critical? The AI Compliance Compass from the Federal Network Agency helps you get started. The rest follows from the classification.
Clarify your role. Provider or operator? Both roles must fulfill different obligations. Anyone who significantly further trains a third-party model becomes a provider themselves.
Start with what is due anyway. Document training, track data provenance, implement logging, and request documentation from suppliers. None of this requires standards, and some of it will be difficult to catch up on later.

And stay on top of it: The Commission's timeline and the Federal Network Agency's AI Service Desk are the two resources you should keep an eye on. For anything involving money or liability, it is worth seeking legal advice to ensure you are on the safe side.

As complicated and opaque as the regulation may seem, from my perspective, it is an important milestone in creating a secure, ethical, and competitive foundation upon which the future of AI in business and society can be built.

Sources

‍

Sebastian Addicks

Senior Software Engineer

EU AI Act 2026: Deadlines, Obligations, and Outstanding Issues

EU AI Act 2026: Deadlines, obligations, and outstanding issues