The EU AI Act is already in force. It is not waiting for 2027 to start binding your company. What changed in 2026 is the shape of the calendar: the Digital Omnibus postponed most high-risk system duties, while leaving prohibitions, general-purpose model rules, governance, penalties, and transparency already live.
If your board still has a slide that says “high-risk obligations begin 2 August 2026,” that slide is wrong. Regulation (EU) 2026/1744 amended Article 113. High-risk duties for Annex III systems now apply from 2 December 2027. High-risk duties for Annex I product-safety systems apply from 2 August 2028. The rest of the Act, unless a later date is named, has applied since 2 August 2026.
This briefing is for operators, not lobbyists. It tells each seat what is already owed, what was postponed, and what you should have in writing before the next board cycle.
What is already binding in late 2026?
Regulation (EU) 2024/1689 entered into force on 1 August 2024. Article 113 then staged application. After the July 2026 amendment, the live pieces as of late October 2026 are these.
Chapters I and II have applied since 2 February 2025. That is the definitions, the territorial scope, AI literacy (Article 4), and the prohibited practices in Article 5 — social scoring, untargeted scraping of facial images to build or expand recognition databases, real-time remote biometric identification in public spaces except for listed law-enforcement cases, and the other listed bans. Two later bans — systems that generate non-consensual intimate imagery, and systems that generate child sexual abuse material — apply from 2 December 2026 (Article 113(a) as amended).
General-purpose AI (Chapter V), notified bodies, Union governance, confidentiality, and the penalty articles have applied since 2 August 2025 (Article 113(b)). Providers of GPAI models placed on the market before that date have until 2 August 2027 to come into compliance (Article 111(3)).
Everything else, unless carved out, has applied since 2 August 2026. That includes Article 50 transparency: people must be told when they are interacting with an AI system, unless it is obvious to a reasonably well-informed, observant and circumspect person; synthetic audio, image, video or text must be marked in a machine-readable format and detectable as artificially generated or manipulated (providers’ technical solutions must be effective, interoperable, robust and reliable as far as that is technically feasible); emotion-recognition and biometric-categorisation systems must disclose that they are operating, with the criminal-law exceptions written in the article.
Articles 102 to 110, which amend other Union acts, have applied since 27 July 2026 (Article 113(d)).
What has not applied yet is the heart of Chapter III Sections 1–3 for high-risk systems: classification under Article 6, the provider duties in Articles 8–15 and 16, deployer duties in Article 26, and the fundamental-rights impact assessment in Article 27. Those apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (Article 113(c) as amended).
Penalties are already live. Article 99 sets administrative fines of up to EUR 35 million or 7% of worldwide annual turnover for prohibited-practice breaches, and up to EUR 15 million or 3% for most other operator breaches, whichever is higher. Those ceilings applied from 2 August 2025. They are not waiting for high-risk classification.
Who counts as a provider, and who is only a deployer?
Article 3(3) defines a provider as the person who develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under their own name or trademark. Article 3(4) defines a deployer as the person using an AI system under their authority, other than in a purely personal, non-professional activity.
Most enterprises are deployers of vendor systems and providers of anything they put their name on. Article 25 turns a deployer into a provider of a high-risk system if they put their name or trademark on it, make a substantial modification, or change its intended purpose. Fine-tuning a workplace model, wrapping it in your brand, and selling or operating it internally under your mark is how companies accidentally become providers.
If you only consume a closed API and do not put your mark on the system, you are usually a deployer. You still have duties — literacy now, transparency now, and Article 26 later for high-risk use. You do not escape the Act by “just using Microsoft / Google / a startup.”
The Act applies to providers placing systems on the Union market and to deployers established or located in the Union, and to providers and deployers in third countries where the output is used in the Union (Article 2). A US or Indian group with EU staff, EU customers, or EU-facing output is in scope.
What does this mean for the CEO?
You own two decisions the law will not make for you.
First: inventory. You cannot classify what you have not listed. The list is not “our AI strategy.” It is every system that meets Article 3(1) — a machine-based system that infers how to generate outputs that can influence an environment, with some autonomy. That includes copilots, agents that call tools, scoring models in HR and credit, and chatbots that talk to customers. Shadow tools count. If a team is using them under your authority, you are the deployer.
Second: role. For each system, decide whether you are provider, deployer, or both. The answer changes capital, insurance, and who signs the technical file. Article 25 is the trap. If the company is going to brand, fine-tune, or substantially modify a high-risk system, budget for provider duties — even though those duties are not yet applicable for most high-risk systems. Building the file takes longer than the remaining calendar.
Do not tell the board “we are fine until 2027.” You are already bound on bans, literacy, GPAI (if you provide a model), transparency, and fines. High-risk product duties were postponed. Prohibited practices were not.
What does this mean for the CTO?
You own classification and evidence.
Article 6 is the classification engine. Annex III lists the high-risk use cases most enterprises actually run: biometrics, critical infrastructure, education, employment and worker management, access to essential services, law enforcement, migration, and administration of justice. Annex I is the product-safety route — AI that is a safety component of a product already covered by listed Union harmonisation law.
The Digital Omnibus did not delete Article 6. It moved when Sections 1–3 of Chapter III apply. You should still classify now. A system that will be high-risk in December 2027 needs a risk-management system, data-governance records, technical documentation, logging, instructions for use, and human-oversight design (Articles 9–14) before that date, not after.
If you provide a general-purpose model, Chapter V already applies. The GPAI Code of Practice is a route to demonstrating compliance; it is not a waiver. Models on the market before 2 August 2025 have until 2 August 2027.
Article 50 is an engineering ticket, not a comms ticket. Interaction disclosure, machine-readable marking of synthetic output, and the emotion-recognition / biometric-categorisation notices have applied since 2 August 2026. Existing synthetic-content systems placed on the market before that date have until 2 December 2026 to meet Article 50(2) (Article 111(4)).
What does this mean for the CISO?
You own two live risks and one deferred control set.
Live: prohibited practices. If a vendor or an internal team is building a facial-recognition database from untargeted scraping, or running real-time remote biometric identification in a publicly accessible space outside the listed exceptions, that is not a “use-case review.” It is an Article 5 problem and an Article 99(3) fine.
Live: transparency and logging hygiene. Article 50 is in force. Agent systems that talk to staff or customers without a clear AI disclosure are already offside unless the interaction is obvious. Synthetic media without machine-readable marking is an Article 50(2) defect.
Deferred but not optional: Article 26 deployer controls for high-risk systems. When they apply, deployers must use the system as instructed, assign human oversight to people with competence and authority, and monitor. Design those controls now. Retrofitting oversight onto an agent that already writes to production systems is how incidents happen.
The CISA/NCSC secure-development guidelines and the later joint deployment guidance are not EU law. They are the technical baseline examiners and insurers already cite when they ask how you secure the model, the weights, and the runtime. Treat them as the how; treat the Act as the who and when.
What does this mean for General Counsel?
You own the record and the role analysis.
Write down, for each material system: provider or deployer; intended purpose (Article 3(12)); whether Article 25 could flip the role; the Annex III or Annex I hook if any; the Article 50 duties already live; and the date on which Chapter III Sections 1–3 will apply to that system. That memo is the difference between a planned programme and a dawn-raid scramble.
Article 27 fundamental-rights impact assessments apply later, and only to listed deployers — public bodies, private entities providing public services, and certain Annex III points on credit and insurance. Do not invent a company-wide “FRIA” and call it compliance. Do the assessment where the article requires it, and a narrower impact note everywhere else.
Territorial scope is Article 2, not your org chart. Output used in the Union is enough.
The Product Liability Directive (EU) 2024/2853 is a separate statute. It treats software as a product and applies to products placed on the market or put into service after 8 December 2026 (Article 2(1) as corrected by the 7 May 2026 corrigendum). An agent that injures a natural person can be a defective-product problem as well as an AI Act problem. Keep the two files distinct.
What does this mean for the board?
Ask for one page with four columns: system, role (provider / deployer), live duties today, next statutory date. Refuse a narrative that collapses those columns into “we have an AI policy.”
Ask whether any current use is an Article 5 prohibition. That is a now question.
Ask whether Article 50 is implemented in production, not in a design doc.
Ask whether the high-risk postponement is being used as time to build the file, or as an excuse to wait. The postponement is real. Waiting is a choice.
What to do next
- Commission a written inventory of every AI system used under the company’s authority, including shadow tools. Name the deployer. Name the provider.
- Classify each system against Article 5 (ban), Article 50 (transparency now), Chapter V (GPAI, if you provide a model), and Article 6 / Annex III or I (high-risk later).
- Flag every case where branding, fine-tuning, or a purpose change could trigger Article 25.
- Put Article 50 controls in production before you debate high-risk documentation.
- If the estate is sprawling or the role analysis is contested, book an Architecture Review — a working session that maps the current AI estate and what a sovereign stack would replace. That session is for the map, not for a certificate.
The Act is a calendar and a role table. Fill both. Then the 2027 and 2028 dates are a build plan, not a surprise.