The obligationfollows the role,not thetechnology.
- In force
- 1 August 2024
- Amended
- 27 July 2026
- High-risk duties
- 2 December 2027
- Fines up to
- 7% of worldwide turnover
The high-risk deadline is no longer August 2026. Most of what is written about this Act still says it is.
What applies, and when
Some uses are simply closed
The prohibited practices have been in force since February 2025, and the July 2026 amendment added to them. This is the only tier where the ceiling is 35 million euro or 7% of worldwide annual turnover, under Article 99(3).
General-purpose models carry their own duties
Obligations for providers of general-purpose AI models, and the governance structure that supervises them, have applied since August 2025. The July 2026 amendment widened the AI Office's enforcement role.
People must be told they are dealing with a machine
A system that interacts directly with a person has to say that it is a system, and synthetic image, audio or video has to be disclosed as artificially generated. This duty was not part of the deferral and is live now.
The high-risk regime, sixteen months later than first written
Systems in the Annex III use cases — employment, education, credit, essential services, law enforcement, and others — take the full high-risk regime from 2 December 2027. Where the AI sits inside a product already regulated under Annex I, 2 August 2028.
Provider and deployer are different jobs with different exposure
The provider carries the quality management system, the documentation, the logs and the conformity of the system itself. The deployer has a narrower set: use it as instructed, keep human oversight real, and tell a person when a high-risk system is deciding about them. The line between the two is where a business is most likely to be wrong about which one it is.
Three ceilings, and most exposure sits in the middle one
Prohibited practices reach 35 million euro or 7% of worldwide annual turnover. Breaching the provider duties in Article 16, the deployer duties in Article 26 or the transparency duties in Article 50 reaches 15 million or 3%. Giving a notified body or an authority incorrect, incomplete or misleading information reaches 7.5 million or 1%.