Analyses and Case Studies
The AI Act in 2026: What Already Applies, What Was Delayed and What It Means for You
In the summer of 2026 the European Union did something almost nobody expected: it postponed its own artificial intelligence legislation — months before its heaviest part was due to take effect.
The result is confusion. Half the commentary still cites “2 August 2026” as the date for high-risk systems, while the other half announces that the AI Act has been “frozen”. Neither is true. This article sets out what actually applies today, what moved, and what it means for a company that uses or develops artificial intelligence.
Key Takeaways
- The AI Act has not been repealed or frozen. Regulation (EU) 2024/1689 is in force; only the timetable for some obligations changed.
- The change came through Regulation (EU) 2026/1744 — the “Digital Omnibus” on artificial intelligence — adopted on 8 July 2026 and in force since 27 July 2026.
- Obligations for Annex III high-risk systems move to 2 December 2027, and those for Annex I product-embedded systems to 2 August 2028.
- Prohibited practices and the AI literacy requirement have applied since 2 February 2025 and were never postponed — this is the part that can already cost you money.
- Article 50 transparency obligations apply from 2 August 2026. Generative systems already on the market have until 2 December 2026 to bring content marking into line.
- Penalties are unchanged — up to EUR 35 million or 7 % of worldwide turnover for prohibited practices.
- The delay is an opportunity, not an all-clear. Organisations that use the extra time to build an ISO/IEC 42001 management system will meet 2027 with a working mechanism.
What happened in July 2026
Regulation (EU) 2026/1744 amends the AI Act and changes some of its application dates. It was adopted on 8 July 2026 and entered into force on 27 July 2026. The reason for the postponement was practical: the harmonised standards against which manufacturers were to demonstrate conformity were not ready in time, and neither were the supervisory authorities in most Member States.
It matters to understand what did not change. The structure of the Regulation, the risk categories, the definitions and the penalties all remain the same. What was postponed is the date from which certain obligations become enforceable — not the obligations themselves.
Be careful with sources. Analyses written before July 2026 are still circulating; they describe the failed negotiating round in April and conclude that no delay would happen. Other, older texts cite 2 August 2026 as the date for high-risk systems. Both are out of date. Check the publication date before planning against it.
The timetable as it stands today
| Date | What applies | Status |
|---|---|---|
| 2 February 2025 | Prohibited practices (Art. 5) and the AI literacy requirement (Art. 4) | In force |
| 2 August 2025 | Obligations for general-purpose AI models (GPAI) | In force |
| 2 August 2026 | Article 50 transparency for certain systems | In force |
| 2 December 2026 | Deadline for existing generative systems under Art. 50(2); two new Article 5 prohibitions | Upcoming |
| 2 December 2027 | Annex III high-risk systems (stand-alone) | Postponed |
| 2 August 2028 | Annex I high-risk systems (embedded in products) | Postponed |
The part that can already cost you money
The most underestimated fact is that two obligations have applied since February 2025 and have never been postponed.
Prohibited practices
Article 5 bans certain AI applications outright. They include social scoring systems, manipulative techniques exploiting vulnerabilities and — most relevant for employers — emotion recognition in the workplace and in education, outside narrow exceptions for safety and medical reasons.
This is a concrete risk for companies that have deployed employee monitoring with analysis of facial expression, voice or “engagement”. The penalty for a prohibited practice reaches EUR 35 million or 7 % of worldwide annual turnover, whichever is higher.
AI literacy
Article 4 requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among the staff who work with them. There is no prescribed format, number of hours or certificate — the requirement is for genuine competence, proportionate to context and role.
A practical minimum for Article 4: identify which roles use AI tools; run training on the capabilities, limitations and risks of those specific tools; record who was trained, when and on what. This is the same logic as competence under ISO 9001 clause 7.2 — and it is evidenced the same way.
Provider or deployer
| Role | Who it covers | Weight of obligations |
|---|---|---|
| Provider | Develops an AI system and places it on the market or into service under its own name | The full set — risk management, data, documentation, oversight, accuracy, cybersecurity |
| Deployer | Uses an AI system under its own authority in a professional activity | A lighter set — use as intended, human oversight, informing affected persons |
| Deployer becoming provider | Puts its brand on someone else’s system or substantially changes its intended purpose | The full provider set |
The third row is the trap. A company that buys a ready-made AI tool, brands it and offers it to its own customers becomes a provider, with all the obligations that follow — the same logic found in the Cyber Resilience Act and in machinery law.
How to use the extra time
- Inventory your AI systems. Include the tools that arrived sideways — through a SaaS subscription or embedded in software you already use.
- Classify every system. Prohibited, high-risk, subject to transparency, or minimal risk. Everything else follows from this.
- Eliminate prohibited practices immediately. They do not wait for 2027 and carry the highest penalty.
- Meet Article 4 by role. Training and records for the people who actually work with AI tools.
- Determine your role for each system — provider or deployer — and document it, including where you brand someone else’s product.
- Build a management system to ISO/IEC 42001. It provides the structure the Regulation expects without you having to invent it.
- Track the harmonised standards. Once published, they become the shortest route to a presumption of conformity.
Where ISO/IEC 42001 fits
ISO/IEC 42001 is the management system standard for artificial intelligence and is the closest thing to a ready-made framework for implementing the AI Act. It does not confer compliance — the Regulation does not accept certificates as evidence — but it covers much of the required process.
| AI Act requirement | Covered by ISO/IEC 42001? |
|---|---|
| Lifecycle risk management system | Yes, as a process |
| Data governance and quality | Yes, through the data controls |
| Technical documentation and logging | Partly — the Regulation’s format is specific |
| Human oversight and roles | Yes |
| Transparency towards affected persons | Partly |
| Conformity assessment and marking | No — that is a procedure under the Regulation |
More on the standard itself is in our article on ISO 42001. If you already maintain ISO 27001, a significant share of the controls overlap and the two systems are cheaper to build together than separately.
Not sure which category your AI systems fall into?
We inventory and classify systems against the AI Act, remove prohibited practices, deliver the AI literacy requirement and build an ISO/IEC 42001 system — on a timeline matched to the new deadlines.
Conclusion
Postponing the high-risk obligations is good news for companies that were panicking and bad news for those reading the pause as a cancellation. The Regulation remains the most ambitious AI legislation in the world and shows no sign of being abandoned — the delay was about infrastructure readiness, not a change of direction.
The practical advice is short: do the inventory now, while things are calm. Companies hunting for a consultant in December 2027 will be paying for a deadline rather than for quality — exactly what happened during the last ISO 9001 transition.
Frequently Asked Questions
Has the AI Act been repealed?
No. Regulation (EU) 2024/1689 is in force and has not been repealed. Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the deadlines for some obligations, mainly those for high-risk systems. The structure, the risk categories and the penalties remain unchanged.
When do the obligations for high-risk AI systems apply?
After the amendment, obligations for stand-alone high-risk systems under Annex III apply from 2 December 2027, and for product-embedded systems under Annex I from 2 August 2028. The original date was 2 August 2026.
What of the AI Act applies right now?
In force are the prohibited practices under Article 5 and the AI literacy requirement under Article 4 since 2 February 2025, the obligations for general-purpose AI models since 2 August 2025, and the Article 50 transparency requirements since 2 August 2026. By 2 December 2026 existing generative systems must meet the requirements of Article 50(2).
What are the penalties under the AI Act?
For prohibited practices penalties reach EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher. For breaches of other obligations the ceiling is EUR 15 million or 3 percent, and for supplying incorrect or misleading information to the authorities EUR 7.5 million or 1 percent.
Can we use AI to monitor employees?
Emotion recognition in the workplace is a prohibited practice under Article 5, outside narrow exceptions for medical and safety reasons. That prohibition has applied since 2 February 2025 and was never postponed. Other forms of monitoring may fall into the high-risk category and are also subject to data protection law.
What does the AI literacy requirement mean?
Article 4 requires providers and deployers to ensure a sufficient level of AI literacy among staff who work with AI systems, proportionate to context and role. No format or number of hours is prescribed. In practice it is met through training on the capabilities, limitations and risks of the specific tools, plus records of who was trained, when and on what.
Is ISO/IEC 42001 enough for AI Act compliance?
Not on its own — the Regulation does not accept certificates as evidence of conformity. ISO/IEC 42001 does cover much of the required process: lifecycle risk management, data governance, roles and human oversight. Conformity assessment and the specific format of the technical documentation fall outside its scope.