If you look up when the AI Act's high-risk obligations take effect, you'll find one date repeated with a lot of confidence: 2 August 2026. It appears in law-firm articles, in consultancy guides and in compliance calendars published this very year.
And until recently it was correct. That's exactly why the mistake has spread so widely: it wasn't born from a careless reading, but from a faithful reading of a text that later changed.
The figure shows the eight areas of Annex III and recalls that classification is done system by system, against the specific letter of each point and its exceptions.
What the original text said
Regulation (EU) 2024/1689 set its timeline in Article 113. The general rule was clear: "It shall apply from 2 August 2026." It then set out three exceptions — Chapters I and II from February 2025; Chapter V, Chapter VII, Chapter XII and Article 78 from August 2025; and Article 6(1) from August 2027.
The detail that decides everything is what does not appear on that list. Annex III is triggered by Article 6(2), and Article 6(2) was not among the exceptions. It fell under the general rule.
In other words: under the original wording, Annex III's high-risk obligations were indeed enforceable from 2 August 2026. Whoever wrote that in 2025 wasn't wrong.
What changed
Regulation (EU) 2026/1744 — known as the Digital Omnibus — was published in the Official Journal on 24 July 2026 and has been in force since the 27th. Among other things, it rewrote the Article 113 timeline.
Under the current wording, the picture is this:
- Annex III (high risk), Article 26 (deployer obligations) and Article 27 (fundamental rights impact assessment): 2 December 2027.
- Annex I (high risk in already-regulated products): 2 August 2028 — it used to be August 2027.
- High-risk systems used by public authorities and deployed before 2 December 2027: 2 August 2030.
There are sixteen months between 2 August 2026 and 2 December 2027. That isn't a calendar nuance: it's the difference between an obligation many people treat as overdue and one that hasn't started yet.
Why the mistake survives
Because the repealed date keeps circulating in material nobody has revisited. An article published in March 2026 with "2 August 2026" was accurate the day it was written; today it describes a rule that no longer applies. And unlike a typo, it isn't caught on a re-read: the sentence is correct in form and only fails against a source that changed afterwards.
The same happens with the Omnibus's own date. Versions still circulate that place it in March or May 2026, corresponding to earlier stages of the legislative procedure. Publication in the Official Journal is dated 24 July 2026, and that's the one that counts.
What this means for a company using AI
Three things, and none of them is "relax until 2027."
First: check whether Annex III even applies to you. It's a closed list of eight areas, and most AI uses at a mid-sized company fall under none of them. The case that does come up often is employment: a system that scores CVs, ranks applicants or screens out candidates — what the market calls an AI-powered ATS — sits under Annex III, point 4. If that's your case, the classification and what's worth documenting from now don't depend on the date.
Second: separate what was postponed from what wasn't. The Article 50 transparency obligations weren't moved: they've been in application since 2 August 2026. A chatbot handling customers or a system that generates content has duties today, not in 2027. Confusing the two timelines is a common mistake, and what changed and what stayed the same is where it's clearest. The full application timeline, milestone by milestone, lets you check it without intermediaries.
Third: understand which obligation belongs to whom. Annex III doesn't mean that you, as the deployer, have to produce technical documentation or assess the system's conformity: that's the provider's job. Yours are the Article 26 duties — use in accordance with the instructions, human oversight, record-keeping — and, when one of the Article 27 triggers applies, the fundamental rights impact assessment, which is a distinct instrument from the GDPR Article 35 data protection impact assessment and doesn't replace it.
Sixteen months aren't an extension: they're the real deadline
The comfortable reading of this change is that there's time. The useful reading is different: the date most people had noted down was the wrong one, and whoever planned against August 2026 planned against a repealed text. That same material is still guiding decisions today.
What sets a prepared organisation apart from one that will find out too late isn't knowing the correct date. It's having one place where that date lives once, tied to the systems it applies to and to the person accountable for each one — so that when it changes again, and the Omnibus proves it does, nobody has to comb through slides, emails and spreadsheets to work out what everyone had assumed.
Keeping that at hand, with fifteen or twenty systems and eight milestones on the move, is where a spreadsheet stops working: not because it doesn't fit, but because nobody knows which copy is the right one.
Dates in accordance with Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Official Journal of the EU, 24 July 2026, in force since 27 July 2026).
This article is for informational purposes only and does not constitute legal advice.