What actually applies on August 2, 2026

The correction most sources have not made

This matters because a large amount of published guidance, including several widely-cited reference sites, still describes August 2, 2026 as the date the high-risk regime lands. If you are planning against that, you are planning against a timeline that no longer exists — in one direction on conformity assessment, and in the other on transparency, which is genuinely nine days away at the time of writing.

The timeline as it now stands

• August 1, 2024 — the Regulation entered into force. No obligations applied yet.
• February 2, 2025 — the Article 5 prohibited practices and the Article 4 AI literacy duty started to apply. Both are already in force.
• August 2, 2025 — general-purpose AI model obligations, the EU governance structure, national competent authorities, and the penalty framework.
• August 2, 2026 — Article 50 transparency obligations and the measures supporting innovation. Enforcement begins for general-purpose AI, the prohibitions, transparency, and AI literacy.
• December 2, 2026 — the Article 50(2) grace period ends for systems already on the market, and new Article 5 prohibitions on AI generating child sexual abuse material and non-consensual intimate imagery start to apply.
• August 2, 2027 — Member States must have at least one AI regulatory sandbox operational.
• December 2, 2027 — the Annex III high-risk regime: Articles 9–15, deployer obligations under Article 26, fundamental rights impact assessments under Article 27, conformity assessment, registration, post-market monitoring, and serious-incident reporting.
• August 2, 2028 — high-risk AI that is a safety component of a product regulated under Annex I sectoral law.

What Article 50 actually requires

Article 50 splits by role, and the split is the part teams most often get wrong. Two paragraphs bind providers and two bind deployers, and a company can be both for different systems.

• Article 50(1) — providers. A system that interacts directly with people must be designed so those people are informed they are dealing with an AI system, unless that is obvious to a reasonably well-informed and observant person. The Commission's guidelines read that exception restrictively, because relying on it removes the disclosure entirely.
• Article 50(2) — providers. Systems generating synthetic audio, image, video, or text must mark outputs in a machine-readable format detectable as artificially generated or manipulated. Narrow carve-outs exist for assistive editing functions, short sequences, source code, and machine-to-machine output not exposed to a person.
• Article 50(3) — deployers. People exposed to an emotion recognition or biometric categorisation system must be informed of its operation. The obligation is to disclose that it operates, not to explain its purpose.
• Article 50(4) — deployers. Deepfakes must be disclosed on first exposure, in a clear and distinguishable way that does not require technical tools to notice. Published AI-generated text on matters of public interest must also be disclosed — unless it went through genuine human review or editorial control, which spell-checking does not satisfy.

Breach of Article 50 carries administrative fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher, with proportionality considered for SMEs. Enforcement sits with national market surveillance authorities.

What the deferral does and does not buy you

Sixteen extra months on Annex III is real relief, and it is worth being honest about that rather than manufacturing urgency. But three things do not move.

• The prohibitions have applied since February 2025. If a system performs an Article 5 practice, the deferral is irrelevant — it should not be on the EU market now.
• The Article 4 literacy duty has applied since February 2025 and covers providers and deployers alike.
• Article 50 applies on August 2, 2026. For most product teams shipping customer-facing AI — assistants, support copilots, generated content — this is the obligation that actually attaches, and it is the nearest one.

The deferral also does not change what a buyer asks for. Enterprise procurement and security reviews already ask how AI systems are inventoried, classified, and overseen, and those questions do not wait for an application date. A December 2027 obligation with no record built against it is the same problem in eighteen months that it is today, minus the runway.

What a defensible record looks like now

The work that pays off under either timeline is the same, because every downstream obligation depends on it:

• An AI system register: every system in scope, its intended purpose, its role — provider or deployer — and its risk classification with the Article 6 and Annex III reasoning written down.
• An Article 50 determination per system: which limb applies, who bears it, and what the disclosure actually says. This is the one with a date in nine days.
• An obligation map that distinguishes what applies now from what applies in December 2027, so nobody mistakes deferred for absent.
• Named owners per control, with human-oversight assignments identifying a person with competence and authority rather than a mailbox.
• Evidence with review dates, and a review rhythm that keeps the record honest as systems, vendors, and uses change.

Frequently asked questions

Keep reading

• Article 50 transparency: chatbots, deepfakes, and synthetic content
• Article 26 deployer obligations, operationally
• Annex III high-risk categories, with real product examples
• Provider or deployer? Getting your AI Act role right