EU AI Act deadline: 2 August 2026. Seventy-one days.

The high-risk provisions of Regulation (EU) 2024/1689 enter application on 2 August 2026. That date is fixed and there is no transition period for placing high-risk systems on the EU market after it. This page is the deadline in concrete terms: three application dates, who is affected, what the penalty structure looks like, and a ten-week plan for the time still on the clock.

One regulation, three application dates

The AI Act is often discussed as a single 2026 deadline. It is not. Article 113 of the regulation phases obligations across three dates, each binding a different population of providers and deployers. Knowing which date binds you is the first step in deciding what to ship between now and then.

The bulk of enterprise AI sits in the middle row. Credit-scoring models, recruitment screening, exam scoring, biometric identification, critical infrastructure controllers, law-enforcement support tools, migration and asylum systems, justice-administration models — all of these are Annex III. All of them have 71 days as of the date of this article.

Are you affected? A short decision path

The Act binds two populations differently: providers (you place a system on the EU market or put it into service in the EU under your own name or trademark) and deployers (you use a system in a professional context). The obligations are not symmetric. A provider faces conformity assessment, technical documentation, and post-market monitoring. A deployer faces fundamental-rights impact assessments and Article 26 use obligations.

1. Do you place an AI system on the EU market, in any form? If yes, you are a provider for that system. Distributors and importers who modify a system substantially can become providers under Article 25.
2. Is the intended purpose listed in Annex III? Critical infrastructure, education and vocational training, employment and worker management, essential private and public services (including credit scoring), law enforcement, migration and asylum, administration of justice and democratic processes, biometric identification not prohibited under Article 5. If yes and the system is not excluded by Article 6(3), it is high-risk.
3. Is the system a safety component of a product in Annex I? Medical devices, machinery, lifts, toys, in-vitro diagnostics, civil aviation, agricultural and forestry vehicles, marine equipment, railway. If yes, it is high-risk under Article 6(1) and the 2027 deadline applies, but the 2026 deadline still applies to GPAI obligations and to any Annex III intended purposes.
4. Is it general-purpose AI? Trained on broad data, capable of performing a wide range of distinct tasks. Then Chapter V obligations applied on 2 August 2025; you are already inside the regime. If your model has systemic risk under Article 51, additional duties apply.

The honest answer for most enterprise AI vendors selling into Europe is: yes, somewhere in your portfolio there is at least one Annex III system, and the 2026 date binds you.

What the deadline actually triggers

"Enters application" is a Regulation-specific phrase. It means that on 2 August 2026, market surveillance authorities in every Member State can act. From that date:

• A high-risk system may not be placed on the market unless the conformity assessment under Article 43 is complete and the EU declaration of conformity (Article 47) is drawn up.
• The CE marking obligation under Article 48 applies to the AI system or, where embedded, to the host product.
• Registration in the EU database under Article 71 is required before placing on the market.
• Article 72 post-market monitoring obligations begin: providers must establish and document a monitoring system, collect performance data over the lifetime of the system, and feed findings back into the Article 9 risk management process.
• The serious incident reporting obligation under Article 73 binds: providers must report to the national competent authority within fifteen days of becoming aware, or two days for serious and widespread incidents.
• Market surveillance authorities gain the powers of Articles 74 to 79: requests for technical documentation, restriction of free movement, withdrawal or recall, financial penalties.

The compliance posture changes overnight. Before 2 August 2026 the obligations exist on paper. From 2 August 2026 they exist in practice, with state machinery behind them.

Article 99: the penalty structure

Penalties are tiered. The headline number is €35 million or seven percent of global annual turnover, but that maximum applies only to a narrow set of infringements. The full structure:

The €15M / 3% tier is the one most relevant to a provider that intended to comply but did not finish the work. Article 12 logging gaps, Article 17 QMS gaps, Article 43 conformity-assessment irregularities, Article 72 post-market monitoring failures all fall here. SMEs and start-ups receive proportionate reductions under Article 99(6), but the proportionality is calibrated by the supervisory authority, not waived.

A ten-week plan for the seventy-one days you have

The plan below assumes you are a high-risk provider, have already done an initial regulation read, and are now executing rather than scoping. If you have not yet done the read, the readiness assessment is the prior step.

What to do this week, before the ten-week plan starts

1. Read Article 6 and Annex III, carefully. Most disputes about whether the Act binds a particular system resolve on the precise wording of Annex III. Twenty minutes here saves weeks of misaligned work.
2. Identify your competent authority. Member-State designations under Article 70 are public. Knowing who you would report to under Article 73 changes how you write the incident-response runbook.
3. Inventory current evidence. List every accuracy claim, threshold, and test result you have made publicly or to a customer in the past twelve months. Which of those can you reproduce from raw artefacts today? That number is your real baseline.
4. Decide the conformity assessment route per system. Internal control under Annex VI is the default for Annex III. Anything involving biometric identification, the Article 6(2) sub-categories, or third-country notified-body recognition needs that decision now.
5. Block ten weeks on the calendar. The plan above is doable in ten focused weeks. It is not doable in ten weeks done in parallel with three other initiatives.

Where this overlaps with PRML and falsify

PRML is the pre-registered ML manifest specification — an open spec for committing an evaluation claim (metric, comparator, threshold, dataset hash, seed) to a SHA-256 hash before the run. It is not a compliance product. It is a small piece of infrastructure that closes three specific gaps under the 2026 regime:

• Article 12 automated logging. Every evaluation run carries a tamper-evident commitment to the claim it was meant to test. If a threshold is silently changed between v1 and v2 of a system, the hash diverges.
• Article 15 accuracy and robustness claims. The pre-registered manifest is the auditable form of an accuracy claim. Post-hoc rationalisation becomes structurally visible.
• Article 18 retention. Content-addressed manifests make ten-year retention a matter of storing the artefact, not auditing it for tampering.

PRML does not close Article 9, 13, 14, 17, 26, 43, or 72. Those are organisational and procedural. PRML closes one specific kind of evidence problem and stays in its lane.

What to do next

FAQ

Is the 2 August 2026 deadline a hard date or is there a transition period?

It is the application date under Article 113. There is no general transition period for high-risk systems placed on the market after that date. Article 111 contains narrow grandfathering for high-risk systems already on the market before 2 August 2026, but it is conditional and time-limited.

If I am a non-EU provider, does the Act bind me?

Article 2 applies the regulation to providers placing systems on the EU market regardless of establishment. Non-EU providers must designate an authorised representative in the EU under Article 22 before placing a high-risk system on the market.

What counts as "placing on the market"?

Article 3(13) defines it as the first making available of an AI system on the EU market. Putting into service is a parallel concept for systems used in-house. A free or open-source release that is intentionally made available in the EU counts as placing on the market unless one of the Article 2(12) exceptions applies.

How do penalties scale for SMEs and start-ups?

Article 99(6) requires supervisory authorities to take the economic viability of SMEs into account and to consider proportionality. The maximum penalty caps apply, but actual penalties are calibrated. There is no automatic exemption.

Does GPAI compliance under the 2025 deadline cover me for 2026?

No. GPAI model obligations under Chapter V are a separate regime. If your portfolio contains both a GPAI model and an Annex III application, both regimes bind you on their respective dates.