EU AI Act high-risk deadline: what changed on August 2, 2026

August 2, 2026 came and went last week. If you were bracing for the EU AI Act's high-risk obligations to land that day, you can stop bracing. They didn't. Not yet, anyway.

We wrote about this deadline back in March, when the text of the regulation still said August 2, 2026 was the date high-risk obligations kicked in. That was accurate when we wrote it. Brussels moved the goalposts in the meantime, and moved them close enough to the deadline that a lot of teams are still catching up on what actually happened. Here's the update.

What was supposed to happen on August 2

The EU AI Act (Regulation (EU) 2024/1689) rolled out in stages. Chapters I and II, covering banned practices like social scoring and manipulative AI, applied from February 2, 2025. Chapter V, covering general-purpose AI models, plus the Act's governance structure, applied from August 2, 2025. Both of those dates are already behind us and already enforceable.

August 2, 2026 was billed as the big one: the date the rest of the Act, including the substantive obligations for high-risk AI systems under Article 6 and Annex III, came into force. Conformity assessments, technical documentation, risk management systems, human oversight requirements, mandatory logging, EU database registration. The text of the regulation said so directly in Article 113, and every compliance deadline tracker on the internet had it circled.

What actually happened instead

Six days before that deadline, it stopped being true. On July 24, 2026, the EU published Regulation (EU) 2026/1744, the "Digital Omnibus on AI," in the Official Journal. It entered into force on July 27, 2026, five days ahead of the original deadline, and it rewrote Article 113.

The high-risk obligations tied to Annex III (the standalone use cases: employment, credit scoring, law enforcement, education, migration, essential services) now apply from December 2, 2027, sixteen months later than planned. The obligations for high-risk AI embedded in regulated products under Annex I, things like medical devices and machinery, move from August 2, 2027 to August 2, 2028. Both changes came from the same regulation, and both are now law, not proposal.

The EU's own stated reason isn't "industry asked for a break." The Commission's recitals point to the harmonised technical standards that CEN and CENELEC were supposed to deliver, and to national market surveillance authorities that weren't fully staffed up yet. Regulators would have been enforcing rules against a conformity assessment process nobody could actually complete. That's a real operational problem, not a lobbying win dressed up as one, and it's worth taking at face value.

What's actually live right now

Not nothing. Article 50 wasn't part of the delay, and it applies from August 2, 2026 as originally written. If your product has a chatbot, generates synthetic audio, video, or images, or produces content that could be mistaken for something a human made, you now have a standing obligation to disclose that. This applies well beyond the high-risk tier: a customer support bot with no high-risk features at all still needs to tell the user it's a bot.

The prohibited practices and GPAI obligations that became enforceable in 2025 haven't gone anywhere either, and the institutional machinery behind them, the EU AI Office and national market surveillance authorities, has had a full year to get up and running. If anything, enforcement of what's already in force is more likely now than it was twelve months ago, even though the newest and biggest category of obligations just got pushed out.

Why the classification work still matters

Here's the trap: treating the postponement as permission to stop. Nothing about Article 6 or Annex III changed. The definitions of what counts as high-risk are identical to what they were in March. Only the date by which you have to comply with the resulting obligations moved.

December 2027 sounds distant, but it's roughly sixteen months out, and most engineering orgs plan in quarters, not years. A team that shipped an AI feature this year without ever running it through the Article 6 classification exercise still doesn't know whether it's building toward a hard compliance deadline or not. That uncertainty doesn't improve with time. It compounds, because every new feature built on top of an unclassified one inherits the same unanswered question.

We'd also gently push back on reading this delay as the EU going soft on AI regulation. The obligations themselves weren't watered down. Nothing in Annex III got narrowed. The only thing that changed is the runway, and runway is something teams that classify early get to use productively while teams that wait just get to wait longer before the same work starts.

What to do now, given the extra time

If your team already did the classification work, the sensible move is to keep going, not to stand down. Use the extra sixteen months to build the documentation and traceability infrastructure properly instead of assembling it under deadline pressure. Teams that treat this as a pause usually rediscover, closer to December 2027, that "we have time" quietly became "we ran out of it."

Teams that haven't started should begin with the inventory: list every feature that uses AI or ML in any customer-facing or decision-making capacity, and run each one through the Article 6 test. Don't wait for certainty on borderline cases. Assume high-risk until you've confirmed otherwise, because that assumption is cheap now and expensive later.

Check your Article 50 posture separately from your high-risk posture, because it's the one obligation that's actually enforceable today. Any AI-facing interaction with an end user, chat, generated content, synthetic media, needs a disclosure mechanism now, regardless of where the feature lands on the risk tiers.

And revisit your release plans with December 2027 as a real internal deadline, not a vague future concern. If a high-risk feature is scheduled to ship in 2027, its risk management system, logging, and human oversight mechanisms need to be built alongside the feature, not bolted on the quarter before enforcement starts.

The testing question doesn't wait for the compliance date

One thing the postponement doesn't change: how you actually test AI systems that don't produce the same output twice. That work is good practice with or without a regulatory deadline attached to it. We covered the specific techniques, metamorphic testing, statistical acceptance bands, adversarial robustness, drift monitoring, in our earlier piece on testing non-deterministic AI. None of it depends on which article of the Act happens to apply on a given date.

The same goes for ownership. The Act still sits across engineering, QA, legal, and security, and none of those functions gets to assume someone else has it covered just because the deadline moved. We laid out a workable division of labor in who owns EU AI Act compliance, and that division didn't change on July 27 either.

Whichever deadline ends up mattering for your team, December 2027 or August 2028, the underlying work is the same: know what you're testing, prove that you tested it, and keep a record an auditor could actually follow. qtrl gives you requirements traceability and an immutable audit trail on every plan, so the test evidence you generate today is still usable when the deadline that matters to you finally arrives.

If your AI features still haven't been through a risk classification, or your test records wouldn't survive someone asking "prove it," the extra runway is a good time to fix that before it's urgent again. See how it works.