The 2 August 2026 EU AI Act deadline arrived, but it did not make every high-risk AI system subject to the full high-risk compliance regime.
That distinction matters.
The AI Omnibus entered into force on 27 July 2026 and changed the timing for some high-risk AI obligations. The main rules for high-risk systems covered by Annex III now apply from 2 December 2027, while the Annex I route has a separate 2 August 2028 date. At the same time, Article 50 transparency obligations became applicable on 2 August 2026.
For companies evaluating EU AI Act compliance software, the practical question is therefore not simply, “Which tool makes us compliant?”
It is: Which AI systems do we have, which rules apply to each one, and can we prove what we have done about them?
Table of Contents
What Applies From 2 August 2026 (and What Was Deferred)
The biggest mistake is treating 2 August 2026 as one universal compliance deadline.
The AI Act applies in stages, and the AI Omnibus changed some of those dates.
| Requirement | Current application date |
|---|---|
| Prohibited AI practices | From 2 February 2025 |
| GPAI obligations | From 2 August 2025 |
| Article 50 transparency obligations | From 2 August 2026 |
| Annex III high-risk AI obligations | From 2 December 2027 |
| Annex I high-risk AI obligations | From 2 August 2028 |
The practical takeaway is that businesses should not interpret the 2027 high-risk date as permission to wait until 2027 to start preparing.
Classification, documentation, risk management and governance work can take months, particularly when an organization has multiple AI systems, vendors and business owners.
There is also an important exception to the Article 50 timeline. Certain AI-generated content marking obligations have a limited transition period for AI systems placed on the market before 2 August 2026. Those systems have until 2 December 2026 for the relevant marking and detection obligation.
Annex III High-Risk Classification: Who Is Actually Covered?
Before buying compliance software, an organization needs to know which AI systems it actually needs to govern.
Article 6 provides two main routes into the high-risk category. One concerns AI systems that are safety components of products, or products themselves, covered by legislation listed in Annex I. The other covers specific AI use cases listed in Annex III.
Annex III includes areas such as:
- Biometrics
- Critical infrastructure
- Education and vocational training
- Employment
- Essential private and public services
- Law enforcement
- Migration, asylum and border control
- Justice and democratic processes
But using AI in one of these sectors does not automatically make every system high-risk.
The intended purpose and the specific conditions in Article 6 matter. For some Annex III systems, the Article 6(3) conditions can affect whether the system is classified as high-risk.
That makes Annex III classification one of the first jobs an AI compliance platform should support.
A useful system should record the AI use case, intended purpose, owner, classification decision and reasoning behind that decision. If a provider concludes that an Annex III system is not high-risk under the applicable conditions, the assessment should also be documented.
Article 50 Transparency Duties
Article 50 is the part of the August 2026 deadline that organizations need to address now.
It is also broader than the high-risk regime.
The rules cover certain AI systems that interact directly with people, generate synthetic content, perform emotion recognition or biometric categorisation, and create certain deepfakes or AI-generated text concerning matters of public interest.
For example, providers of AI systems designed to interact directly with people generally need to inform users that they are interacting with AI, unless that is obvious from the circumstances.
Providers of systems that generate synthetic audio, images, video or text have additional obligations concerning machine-readable marking of AI-generated or manipulated content.
Deployers have separate duties in areas such as emotion recognition, biometric categorisation, deepfakes and certain AI-generated publications on matters of public interest.
This creates a practical use case for EU AI Act tooling before the high-risk rules apply.
A compliance platform should help an organization identify systems within Article 50’s scope, assign the relevant obligation, document the control being used and retain evidence that the requirement has been addressed.
The point is not to create another checklist.
It is to connect the rule to the actual AI system using it.
Documentation & Conformity Evidence
EU AI Act compliance is ultimately an evidence problem.
For high-risk AI systems, technical documentation needs to contain enough information for the relevant authorities and notified bodies to assess compliance. Other obligations can involve risk management, quality management, logging, human oversight, conformity assessment, registration, post-market monitoring and incident handling.
That creates a useful test for compliance software.
Can it connect an AI system to:
- Its risk classification
- Applicable requirements
- Responsible owner
- Controls
- Technical documentation
- Assessments
- Evidence
- Incidents
- Review history
If those pieces live in separate spreadsheets and folders, an organization may technically possess the information but still struggle to demonstrate how a compliance decision was made.
The stronger approach is a traceable record that connects the requirement, decision, control and evidence.
EU AI Act Compliance Software: What Each Tool Covers
There is no single software category that guarantees EU AI Act compliance.
The market includes dedicated AI governance platforms, broader GRC products and tools focused specifically on regulatory controls. AI governance is also one of the core layers of a modern AI stack, alongside infrastructure, data, model development, deployment and observability.
OneTrust combines AI inventory, risk assessment, framework mapping, governance workflows, monitoring and evidence. Its current AI Governance offering supports EU AI Act, NIST and ISO 42001-oriented workflows and connects governance to ongoing monitoring.
Credo AI takes an AI-native governance approach. Its platform includes AI discovery and registry capabilities, risk management, compliance policy packs, governance workflows, monitoring and automated evidence generation. It specifically positions its platform around EU AI Act risk classification and conformity assessment support.
Modulos focuses heavily on controls and evidence. Its current material maps EU AI Act requirements to organizational and system-level controls and positions the platform around regulatory compliance, risk and evidence management.
The important difference is not which vendor has the longest feature list.
It is whether the platform can take you through:
AI inventory → classification → obligation → control → evidence → review
That is the workflow buyers should compare.
Vendor Coverage Matrix
A vendor matrix should help buyers understand coverage. It should not imply that software itself makes an organization legally compliant.
| Capability | Why it matters |
|---|---|
| AI inventory | Shows which AI systems are in use |
| Risk classification | Determines which requirements may apply |
| Annex III mapping | Helps identify potential high-risk use cases |
| Article 50 tracking | Addresses current transparency obligations |
| Documentation | Keeps compliance records connected to systems |
| Controls and evidence | Shows how requirements are being addressed |
| Conformity assessment support | Helps manage high-risk compliance workflows |
| Incident management | Tracks incidents and corrective actions |
| Post-market monitoring | Supports ongoing oversight |
| Audit trail | Records decisions, owners and changes |
| Regulatory updates | Helps keep requirements current |
A strong platform should make it difficult to lose the connection between a requirement and the evidence supporting it.
That is more useful than a dashboard that simply says “82% compliant.”
Gap-Assessment Checklist
Before choosing an AI governance or compliance platform, ask:
- Do we have an inventory of all AI systems, including third-party tools?
- Do we know who owns each system?
- Have we documented the intended purpose of each system?
- Have we checked both the Annex I and Annex III routes?
- Have we assessed Article 50 separately?
- Can we connect each requirement to evidence?
- Can we maintain technical documentation?
- Can we track risk assessments and human oversight?
- Can we record incidents and corrective actions?
- Can we produce an audit trail showing who made each decision?
- Can the platform distinguish obligations that apply now from those deferred to 2027 or 2028?
That last question matters particularly in 2026.
A platform based on an outdated AI Act timeline can create confusion rather than solve it.
FAQs
What changed on 2 August 2026?
Article 50 transparency obligations became applicable. The date did not bring the full Annex III high-risk regime into force. Under the current AI Omnibus timeline, the main Annex III high-risk rules apply from 2 December 2027.
Were EU AI Act high-risk obligations delayed to 2027?
For AI systems classified as high-risk under Article 6(2) and Annex III, the main application date is now 2 December 2027. The Annex I route has a separate 2 August 2028 date.
What is Annex III classification?
Annex III identifies specific high-risk AI use cases across areas including employment, education, biometrics, essential services, law enforcement, migration and justice. An organization still needs to assess the applicable Article 6 conditions rather than assuming every AI system used in one of these sectors is high-risk.
Does the EU AI Act apply to US companies?
It can. The Act can apply to organizations outside the EU when their AI systems are placed on the EU market or their outputs are used in the EU, depending on the system, activity and role involved.
What are the penalties for violating Article 50?
Article 99 specifically places Article 50 transparency violations within the category that can attract administrative fines of up to €15 million or 3% of worldwide annual turnover for the preceding financial year, whichever is higher. SMEs and small mid-cap companies are subject to the applicable lower threshold where the regulation provides for it.
What should EU AI Act compliance software actually do?
At minimum, it should help an organization maintain an AI inventory, classify systems, identify applicable obligations, manage controls and evidence, document decisions and track compliance throughout the AI system lifecycle.
The strongest platforms are not simply deadline trackers.
They help answer a more useful question:
What AI do we have, what rules apply to it, and where is the evidence?
Leave a Reply