The AI Act After 2 August 2026

“From 2 August 2026, do we have to meet every AI Act requirement?” Not all of them. For more than two years 2 August 2026 was treated as the date of full application of the EU’s artificial intelligence regulation, but on 27 July 2026 Regulation (EU) 2026/1744 entered into force, published in the Official Journal on 24 July, and moved the heaviest part of the obligations back by more than a year.¹ The date did not disappear. It simply means something different today than most compliance plans written in 2025 assumed.

Classifying a specific system calls for support from a lawyer.

The timeline after the amendment

Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in stages under Article 113:

The amendment added two intermediate dates. From 2 December 2026 new Article 5 prohibitions apply, covering the generation of intimate material without the person’s consent and of child sexual abuse material. The same day ends the transition period for machine-readable content marking for systems placed on the market before 2 August 2026.

What began to apply on 2 August

The Article 50 transparency obligations are now operational. On 20 July 2026 the European Commission adopted final guidelines on the article that set out the situations below with examples.²

This affects many companies that do not consider themselves technology organizations: a chatbot on the website, an assistant in the customer service channel, an image or recording generated for a marketing campaign.

Penalties and smaller firms

Article 99 sets three tiers of sanctions: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most other infringements and up to EUR 7.5 million or 1% for supplying incorrect or misleading information.³ For undertakings the higher of the two values applies.

Paragraph 6 of the same article reverses the rule for SMEs, including startups: for them the lower of the two values applies. The July amendment added an equivalent mechanism for small mid-caps. For a company with turnover in the tens of millions, the difference between the two methods can be the difference between a painful fine and one that ends the business. This detail is the one most often missed in board-level conversations about the AI Act.

HR as a high-risk area

Point 4 of Annex III covers employment and workforce management. Point (a) lists systems used for recruitment and selection, in particular for placing targeted job ads, analyzing and filtering applications and evaluating candidates. Point (b) covers systems supporting decisions on terms of employment, promotion and termination, allocating tasks based on behavior or personal traits, and monitoring and evaluating performance and behavior.

A CV-ranking tool, a candidate-scoring model, analysis of recorded interviews or a system allocating tasks based on an employee profile may fall under this point. Qualification is decided by analysis of the specific use, including the Article 6(3) exceptions for systems that do not materially influence the outcome of a decision. The full requirements apply from 2 December 2027, so HR departments gained about sixteen extra months.

The work takes longer than it looks at the start. The order for HR:

1. Tool inventory. Every tool that touches candidates and employees, including AI features switched on in the recruitment system without a separate purchasing decision.
2. Vendor contract review. For the documentation the vendor will have to provide.
3. Human oversight design. Naming the person with the competence and mandate to reject the system’s recommendation.
4. Notices and logs. Rules for informing candidates and employees, and retention of event logs.

Deployer obligations beyond HR

Article 26 places obligations on the organization using a high-risk system, independently of the provider’s obligations. They cannot be transferred to anyone else by contract, which often comes as a surprise after buying a ready-made tool from a known vendor. The core of these obligations is the same in every industry:

• using the system in line with the provider’s instructions,
• assigning oversight to people with the right competence and support,
• monitoring operation and, if a risk to health, safety or fundamental rights is suspected, suspending use and informing the provider and the supervisory authority,
• keeping automatically generated logs for the period set in the rules,
• ensuring input data is relevant to the extent the organization controls it.

Some deployers, including public bodies and providers of certain services, also carry out the fundamental rights impact assessment under Article 27.

The Polish supervisory authority

Poland’s Act of 3 July 2026 on artificial intelligence systems was signed by the President on 24 July and published in the Journal of Laws on 27 July 2026 (item 1003), with most of its provisions entering into force on 11 August 2026.⁴ It establishes the Commission for the Development and Security of Artificial Intelligence (KRiBSI) as the national market surveillance authority and contact point for EU institutions. The Act allows two months from entry into force to appoint the chair, that is until October 2026. The full Commission is to begin operating in November.

What to do with the extra time

The moved deadlines are good news for schedules and risky news for discipline. Projects deferred without a named owner usually come back a quarter before the deadline, when the room for negotiating with vendors has already closed.

This order costs little and removes most of the risk that usually surfaces at the last moment. We prepare the inventory, classification and compliance schedule as part of the AI Strategy package.

Frequently asked questions