What changed on 2 August 2026
The Commission reports general application and enforcement of the AI Act from 2 August 2026, including relevant transparency obligations. Earlier prohibitions, AI literacy and GPAI obligations remain part of the timeline. Later high-risk application dates do not mean every obligation is deferred.
Review the role, intended purpose and specific provision before assigning a deadline. The official sources below are the starting point; legal counsel should confirm the effect of amendments, exceptions and transitional arrangements on your system.
The amended application timeline
Dates checked against the European Commission’s current AI Act overview on 9 September 2026. The Commission links the AI Omnibus amendment and reports its entry into force on 27 July 2026.
1 August 2024
The AI Act entered into force.
2 February 2025
Initial prohibited practices and AI literacy obligations began applying.
2 August 2025
GPAI governance rules and obligations began applying.
2 August 2026
General application and enforcement began, including relevant transparency rules.
2 December 2027
Certain Annex III high-risk system rules apply under the amended timeline.
2 August 2028
Certain Annex I product-related high-risk system rules apply under the amended timeline.
Who may be a provider or deployer?
Do not infer a legal role from a vendor label or assume that using an external model removes organizational responsibilities.
| Role question | Why it matters | What to document |
|---|---|---|
| Who develops or places the system under their name? | Provider responsibilities can differ from those of a user organization. | System ownership, branding, supply relationships and intended purpose. |
| Who uses the system under their authority? | A deployer has responsibilities associated with the way the system is used. | Operating procedures, users, oversight and context. |
| Has the system or its purpose changed? | A modification or changed use may affect role and classification analysis. | Change records and a qualified review of the consequences. |
Why role and risk classification matter
The relevant legal analysis concerns the system and its intended use, not the word “agent.” Record whether the system is within scope, which role the organization occupies, and whether prohibited, transparency or high-risk provisions are relevant.
An enterprise may occupy different roles for different systems. A shared inventory should therefore keep system-specific decisions and their rationale, rather than assign one classification to every AI project.
Prohibited practices and AI literacy
The Commission reports that the 2026 amendment simplifies the earlier company AI-literacy requirement and strengthens the promotional role of the Commission and Member States. Review the amended provision before assigning a legal duty. The practices below are operational preparation, not a claim that the original duty is unchanged.
Review permitted uses before testing
Escalate potentially prohibited uses to qualified legal review. Passing an evaluation cannot authorize a prohibited practice.
Make literacy relevant to actual work
Identify who develops, operates or oversees the system and what they need to understand about its capabilities, limitations and risks.
Retain the operating decisions
Keep training, guidance and scope records appropriate to the organization. A generic completion badge is not the whole operating process.
The Commission identifies 2 December 2026 as the application date for the new prohibitions concerning non-consensual intimate material and child sexual abuse material. Distinguish those additions from the initial prohibitions in the timeline.
Translate transparency duties into observable behaviour
Article 50 addresses transparency for certain AI systems, including interaction with people and generated or manipulated content. The Commission’s guidance explains provider and deployer duties and relevant exceptions.
For readiness work, identify where notices or disclosures should appear, who owns them and how they behave across actual channels. Test an ordinary user journey as well as error and handoff states. Do not treat a statement in a policy document as evidence that users receive the required information.
Prepare high-risk system readiness deliberately
These are readiness work areas, not a complete legal checklist or a claim of conformity with every high-risk requirement.
Risk management and testing
Document foreseeable risks, selected controls and evaluation criteria relevant to the intended purpose. Keep findings and unresolved risks visible.
Technical documentation
Connect the system description, development context, limitations and evaluation basis to the version under review.
Record keeping
Identify relevant logs, access responsibilities and evidence needed to explain operation. Retention decisions require legal and operational review.
Human oversight
Define who can interpret, challenge, intervene or stop the system. Test escalation and oversight arrangements rather than only their existence on paper.
Accuracy, robustness and cybersecurity
Use criteria appropriate to the task, foreseeable conditions and consequences. Do not infer system assurance from one model benchmark.
Post-market monitoring and incident readiness
Define observation channels, escalation ownership and procedures for investigating material events. Applicable reporting duties and timelines require legal confirmation.
How AI Agent Certify supports the operating process
This describes launch scope. Supported mappings, integrations and coverage must be confirmed for the engagement.
Scope the agent and requirement
Register the version and selected obligations after applicability review.
Map controls to evaluations
Create criteria that produce observations useful to a reviewer.
Collect and review evidence
Connect cases, findings, limitations and human decisions.
Prepare bounded artifacts
Produce a Scorecard and, where eligible, an Agent Passport with an approved sharing boundary.
Monitor and reassess
Investigate material change and preserve relationships between old and new assessments.
What the platform does not determine
The platform does not establish your legal role, make the final risk classification, perform an automatic notified body assessment or guarantee compliance. It does not turn an Agent Passport into a statutory certificate.
Qualified people must determine applicability, legal interpretation, conformity procedures and incident reporting duties. Use the platform to organize readiness evidence and operating decisions, not to substitute a software outcome for legal authority.
Questions about eu ai act readiness
Are all AI agents high-risk systems?
No. The legal analysis depends on intended purpose, role and applicable provisions. Calling a system an agent does not settle its classification.
Do later high-risk dates defer every AI Act obligation?
No. General application, relevant transparency rules and earlier obligations must be considered separately from the amended high-risk dates.
Does the platform make our enterprise compliant?
No. It supports readiness, evaluation and evidence management. Legal interpretation and compliance determinations require the appropriate qualified review.
Sources and further reading
- European Commission: AI Act overview and application timeline
- European Commission: enforcement and transparency from 2 August 2026
- European Commission: transparency guidelines
- EUR-Lex: Regulation (EU) 2024/1689
- EUR-Lex: AI Omnibus amendment linked by the Commission
- European Commission: AI Omnibus enters into force
- European Commission: enforcement framework and phased application