EU AI Act, August 2026: What Applies to Software Teams

The EU AI Act reached its most consequential milestone on 2 August 2026, when Annex III high-risk obligations, Article 50 transparency duties, conformity assessment, CE marking and AI Office enforcement powers were scheduled to take effect. A subsequent Digital Omnibus package moved some of it. Both facts matter, and conflating them is how teams end up either panicking or ignoring it entirely.

What applies regardless of the delays

Article 50 transparency obligations are the part most software teams touch. In practice they mean people should know when they are interacting with an AI system rather than a human, and AI-generated content should be identifiable as such. The obligation for labelling generated content was deferred by roughly four months, to 2 December 2026.

• A chatbot should disclose that it is a machine, unless it is obvious from context.
• Synthetic content should be marked in a machine-readable way.
• Emotion-recognition and biometric categorisation systems must inform the people exposed to them.

What high-risk classification actually demands

If a system falls under Annex III, the obligations are documentation-heavy and largely engineering work:

• Technical documentation covering design, training data and testing, maintained rather than written once.
• Data governance — training, validation and test sets meeting stated quality criteria, with their provenance recorded.
• Logging sufficient for traceability and audit, retained for the system's lifecycle.
• Transparency to deployers — stated purpose, known limitations and required human oversight.
• Registration in the EU database before the system is placed on the market.

The Digital Omnibus moved the deadline for standalone Annex III systems to 2 December 2027, pending formal adoption. That is more runway, not a repeal.

What to build now, irrespective of dates

Almost everything the Act asks for is something a well-run AI system should have anyway. Building it now costs little and removes the deadline scramble:

• An inventory. Which AI systems exist, what each does, whose data it touches, which model version is in production. Most organisations cannot answer this today.
• Traceable logs. Inputs, outputs, model version and the human decisions layered on top, retained and queryable.
• Documented data provenance. Where training and evaluation data came from and what rights attach to it.
• A stated human-oversight mechanism. Not a paragraph in a policy — an actual point where a person can review and override, and evidence that it is used.
• Disclosure in the interface. Cheap to add now, awkward to retrofit across a mature product.

Why non-EU companies are reading this

The Act reaches providers placing systems on the EU market and, in defined circumstances, systems whose output is used in the EU — which is why US companies have been working to the August 2026 date. Geography of incorporation is not the test.

The pragmatic position

Treat the transparency obligations as in force and build them. Treat high-risk classification as a question to answer deliberately with counsel rather than assume away. And build the inventory and the logs regardless, because every framework that follows this one will ask for the same things.