Editor's note — September 12, 2026: Corrected the blanket high-risk deadline and removed an unidentified U.S. order reference. The original publication date and URL are retained.
The take
AI governance requires ownership and evidence, but a single countdown does not describe the EU AI Act.
The European Commission's timetable, reviewed September 12, 2026, lists December 2, 2027 for specified Annex III high-risk uses and August 2, 2028 for high-risk AI embedded in regulated products. Other provisions have separate application dates. This does not mean that all obligations were postponed.
Questions for management
- Which systems, legal entities and uses fall within scope?
- What category and application date has counsel identified for each?
- Who owns the controls, evidence and remediation decisions?
- How will material changes trigger a new assessment?
My recommendation is to connect the legal applicability assessment with the actual inventory and operating controls. A policy and a deadline calendar alone cannot demonstrate readiness.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.
Reviewed October 20, 2026: There is no single EU AI Act deadline for every system. Under the amended timetable, specified Annex III high-risk requirements apply from December 2, 2027, and Annex I product-related high-risk requirements from August 2, 2028, subject to relevant exceptions and transitional provisions. Other obligations already apply: the original prohibited practices and AI literacy from February 2, 2025; governance and GPAI-model obligations from August 2, 2025; and general application, including relevant transparency obligations, from August 2, 2026. The later high-risk dates reflect enacted amendments, not merely a pending proposal. Providers and deployers have different responsibilities. Boards should ask management for a system-by-system applicability assessment, named control owners and evidence of readiness. A self-assessment is not legal advice or proof of compliance. Obtain qualified advice for the specific system, use and organizational role. Sources: European Commission overview and Regulation (EU) 2026/1744.