If your company classified its AI systems before Regulation (EU) 2026/1744 was published, this concerns you: that sources change is well known. What's almost never said — and it's a further step, not the same idea — is that when a source changes, the decisions made on it stop being correct without anyone touching them.
This isn't a theoretical warning. It happened in July 2026, when Regulation (EU) 2026/1744 was published.
What changed, and what it left behind
Regulation (EU) 2026/1744, published in the Official Journal of the EU on 24 July 2026, didn't just adjust details of the AI Act. Among other things:
- It set the application of Chapter III, Sections 1, 2 and 3, at 2 December 2027 for Annex III high-risk systems (the 2024 text said 2 August 2026) and at 2 August 2028 for Annex I systems (the 2024 text said 2 August 2027); for Annex I, Section B products, only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 only in so far as the high-risk requirements have been integrated in that legislation (Article 2(2)).
- It replaced Article 4 in its entirety, changing the duty to take measures to ensure, “to their best extent”, a sufficient level of AI literacy into a duty to “take measures to support the development of AI literacy”, with a closing clause stating that the obligation “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.
- It inserted two new points into the list of prohibited practices in Article 5, points (ba) and (bb), which apply from 2 December 2026.
- And it withdrew a date that Article 111(2) contained — 2 August 2026 — replacing it with a cross-reference to the date of application of Chapter III in Article 113.
Now take a diligent organisation that did its work in June. It classified its systems, noted what applied to each one and by which date, and documented its literacy measures using the Article 4 test as it stood then.
All of that work was done properly. And today, part of it is wrong. Not because it was done badly, but because the text it was based on no longer says the same thing.
Why re-reading the file doesn't catch it
Here's the mechanism, and it's what sets this problem apart from a simple "needs updating".
A classification record keeps the conclusion: this system falls into such a category, this obligation applies to it, from such a date. What it doesn't keep — almost never — is which exact wording of which article that conclusion rested on.
Without that link, when the article changes there's no way to trace the path back. The system's file still looks impeccable: well written, dated, with an owner, with its conclusion. An expired entry looks exactly like a current one.
And that's why the defect doesn't surface by reviewing what's written, which is what anyone would do. It surfaces when someone compares what's written against the regulation currently in force — which means, when there's already a reason to compare.
What the organisation would need to see it
Consider what it would take to answer this question: "the Omnibus changed Article 4 and the Annex III date; which of my decisions relied on that?"
You need to know, for every recorded decision, which articles it rested on. Not a mention in prose — "the AI Act was taken into account" — but an explicit link between the conclusion and its grounds.
With that, the question is answered in a moment: list the decisions that cite the affected articles and review only those. Without it, the options are reviewing everything — which no one does — or reviewing nothing — which is what usually happens.
That link is exactly what a spreadsheet doesn't keep, and not because the tool falls short: a spreadsheet records rows, and this is a relationship between rows and an external text that changes on its own.
What can be done without changing anything
Three things, and all three are a matter of discipline, not technology.
Note the articles, not just the conclusion. Every classification should state what it rests on. A column with the references is enough to turn review into something targeted instead of exhaustive.
Note the date of the source, not just the date of the decision. "Classified on 12 June 2026 under Article 6 as worded at the time" allows something that "classified on 12 June 2026" doesn't.
And have a trigger tied to the regulation. Not reviewing "every six months" — that gets skipped without anyone noticing — but reviewing when an amendment is published. The Official Journal has a date; the work is linking it to your own records.
Why this matters more than it seems
Because a classification isn't a document: it's the basis on which you decided what to do and what not to do.
If you concluded that a system didn't require certain measures because the obligation, for an Annex III system, was arriving on 2 August 2026 and it now arrives on 2 December 2027, the conclusion still holds — with more room to spare. But if you concluded something relying on wording that was replaced in its entirety, as happened with Article 4, what you have on file describes a duty that no longer exists in that form.
Neither case is serious today. Both would become serious the day someone asks why a given decision was made, and the answer is written against a text that can no longer be cited.
Content in accordance with Articles 2, 4, 5, 111 and 113 and Annexes I and III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Official Journal of the EU, 24 July 2026).
This article is for informational purposes only and does not constitute legal advice.