A Date That Has Already Moved Once
Compliance vendors say EU AI Act high-risk rules went live on 2 August. The Commission's own timeline says December 2027. Both camps are making the same mistake about what kind of date that is.
Compliance vendors say EU AI Act high-risk rules went live on 2 August. The Commission's own timeline says December 2027. Both camps are making the same mistake about what kind of date that is. The correction, first A claim is circulating through compliance-vendor and consultancy content: that the full set of EU AI Act high-risk mandates became enforceable on 2 August 2026 — risk management, data governance, logging, transparency, human oversight, cybersecurity resilience, post-market monitoring. The European Commission's own implementation timeline says: "Rules for high-risk AI systems in Annex III apply" — 2 December 2027 That is a gap of roughly sixteen months , and it is the difference between a conformity programme you need this year and one you do not. The actual timeline, verbatim from the Commission Every row below is quoted directly from the Commission's implementation timeline — free, public, and ninety seconds to read. Date What applies --- --- 1 Aug 2024 "Entry into force" 2 Feb 2025 "General provisions (definitions & AI literacy) and prohibitions apply" 2 Aug 2025 "Rules for general-purpose AI apply and governance must be in place" 2 Aug 2026 "The majority of rules… come into force and enforcement starts" · Article 50 transparency starts to apply 2 Dec 2026 "New prohibitions + Article 50(2) transition apply" — deepfakes, child abuse material 2 Aug 2027 "Member States should have at least one AI regulatory sandbox per country operational" 2 Dec 2027 ✅ "Rules for high-risk AI systems in Annex III apply" 2 Aug 2028 "Rules for high-risk AI embedded in regulated products covered by Annex I apply" Bookmark the Commission's page. It is free, public, and takes ninety seconds to read. Do not over-correct Something real did happen on 2 August 2026, and saying otherwise would be its own error. The Commission's own phrasing is expansive: "the majority of rules of the AI Act come into force and enforcement starts for applicable rules." If you ship generative output in the EU, Article 50 transparency obligations apply to you today. Cooley reaches the same reading independently. The error being circulated is specific : it concerns Annex III high-risk obligations. And frankly, a compressed summary could produce that error honestly — "the majority of rules" is broad phrasing, and someone reading quickly could reasonably assume high-risk requirements were inside it. They are not. But our correction should be as precise as the mistake. The date nobody is discussing 2 December 2026. Ninety-seven days from now. New prohibitions covering deepfakes and child-abuse material, plus the Article 50(2) transition compliance deadline . This is a real, never-deferred, first-time deadline that arrives in three months — and it is receiving a fraction of the attention devoted to an imaginary one fifteen months out. (Full disclosure: this date was not in our own earlier coverage either. It should have been.) Why the wrong date spreads Not dishonesty. Structure. Compli