EU AI Act Compliance Deadline 2026: What You Must Do Now

What becomes binding on August 2, 2026

1. Prohibited AI practices (Article 5)

The prohibitions on "unacceptable risk" AI came into force February 2, 2026 and are already enforceable. If your AI system uses subliminal manipulation, exploits vulnerable groups, deploys real-time remote biometric identification in public spaces without authorization, or operates social scoring systems, you must stop immediately. There are no grace periods remaining on these provisions.

2. General-Purpose AI (GPAI) model obligations

If you develop or place a GPAI model on the EU market, the full Article 53 obligations apply August 2, 2026. These include technical documentation, transparency information for downstream operators, and an acceptable-use policy. Providers of GPAI models with systemic risk (trained on more than 10^25 FLOPs) have additional obligations including adversarial testing and incident reporting to the EU AI Office.

3. Transparency obligations: Article 50

Any AI system that interacts with natural persons (chatbots, voice agents, synthetic media generation) must comply with Article 50 from August 2, 2026. Users must be informed in a clear, timely manner that they are interacting with AI, unless this is obvious from context. Emotion recognition and biometric categorization systems must also inform subjects of their operation.

4. Registration: Article 49 and the EU AI Act database

High-risk AI systems listed in Annex III must be registered in the EU AI Act database before being placed on the market. Providers must complete registration via the European AI Office portal. Some standalone high-risk systems required earlier registration; full Annex III high-risk registration enforcement applies December 2, 2027 (a one-year deferral confirmed by the Digital Omnibus proposal), but registration preparation should begin now.

5. Enforcement authority and penalties

From August 2, 2026, national market surveillance authorities have full enforcement power. Penalties reach:

• €35 million or 7% of global annual turnover for prohibited AI violations
• €15 million or 3% of global annual turnover for most other violations
• €7.5 million or 1.5% of global annual turnover for providing incorrect information to authorities

Who is in scope

The EU AI Act applies to any provider, deployer, or importer of AI systems that:

• Places AI on the EU market, regardless of where the company is incorporated
• Whose AI output is used or affects persons located in the EU
• Is established in the EU

This means a US-incorporated fintech whose AI credit-scoring model serves EU customers is in scope. A Singapore SaaS company whose chatbot has EU users is in scope. Geographic incorporation is not a defense.

The compliance checklist: what to complete before August 2

The common compliance gaps we see in fintech and AI companies

After working with AI companies preparing for August 2026, we see the same gaps repeatedly:

• No AI inventory: Companies do not have a complete list of their AI systems. Without an inventory you cannot classify risk, assign accountability, or demonstrate compliance to an authority.
• Chatbot transparency missing: Customer service and sales chatbots lack Article 50 disclosure. This is the fastest, most visible compliance item and the most commonly overlooked.
• Third-party AI not tracked: Companies that use AI via API (OpenAI, Mistral, Cohere, etc.) believe the model provider handles compliance. As the deployer, you retain obligations under the Act.
• GPAI scope confusion: Fine-tuned models, RAG pipelines, and orchestration layers may qualify as GPAI systems under the Act. Many companies have not assessed this.
• No designated AI compliance owner: The regulation requires identifiable accountability. "Everyone" owns compliance means no one does.

The cost of waiting

Companies that begin compliance work in Q3 2026 will face three compounding problems: enforcement has already started, the organizational and technical work takes 6-12 weeks minimum, and conformity documentation for Annex III systems requires specialist knowledge that takes months to develop internally.

The Big 4 consultancies charge €200,000-€400,000 for a full EU AI Act conformity package. Regulatory technology subscriptions run €25,000 per year with no delivered compliance. Neither option results in a signed, submittable compliance package in the timeframe available before August 2026.