Key takeaways

  • 2 August 2026 activates Annex III (high-risk), Article 50 (transparency), Commission enforcement powers over GPAI, and the general penalty regime. No official extension has been confirmed.

  • The first step is classifying every system into one of four buckets: prohibited / high-risk / GPAI / minimal. Classification drives everything else.

  • A high-risk system requires technical documentation (Annex IV), quality management, documented human oversight, log retention, and an EU declaration of conformity before market.

  • Transparency (Art. 50) also applies outside high-risk: chatbots labelled as such, synthetic content marked, deepfakes disclosed, classification or emotion-recognition systems notified.

  • Penalties reach 7 % of global turnover for prohibited practices and 3 % for high-risk obligation breaches. GPAI can reach 15 M€ or 3 % of turnover.

Calendar: what enters into force on 2 August 2026

Regulation (EU) 2024/1689 has been in force since 1 August 2024 with staggered application. Key dates for a 2026 CTO:

  • 2 February 2025 (past): prohibited practices (Art. 5) and AI literacy obligations (Art. 4).

  • 2 August 2025 (past): GPAI obligations, governance, notified national authorities.

  • 2 August 2026: general application, covering Annex III high-risk systems not embedded in sectoral legislation, Article 50 transparency, Commission GPAI enforcement, and the general penalty regime in Chapter XII.

  • 2 August 2027: high-risk systems embedded in sectorally regulated products (Annex I).

The Commission has held the 2 August 2026 date despite industry pressure for an extension; AI Office consultations assume the current calendar.

Classification: is your system high-risk, GPAI, or minimal?

Once a year the platform team must inventory every AI system in use or development and apply this decision tree:

  • Is it a prohibited practice (Art. 5)? Subliminal manipulation, social scoring, real-time biometric ID in public spaces outside exceptions, criminal-prediction profiling, indiscriminate face scraping, emotion inference in workplace or education. If yes: stop: cannot be offered in the EU.

  • Is it GPAI? A model trainable with broad autonomy, integratable into downstream systems (for example, LLMs and multimodal models). If yes: Chapter V obligations (documentation, copyright, technical sheet). If additionally "systemic risk" (training compute ≥10²⁵ FLOP), reinforced obligations.

  • Is it high-risk (Annex III)? Remote biometric ID, critical infrastructure, education/training affecting access, employment (selection, evaluation), essential private services (credit, insurance), law enforcement, migration and asylum, justice and democratic processes.

  • Annex I product integration (medical devices, toys, lifts, etc.): sectoral regime plus AI Act add-ons.

  • Anything else: minimal-risk bucket. Only Art. 50 applies if relevant.

Obligations by category: checklist

High-risk (Annex III):

  • Documented quality management system.

  • Training, validation, and test data with governance policies (Art. 10).

  • Complete technical documentation (Annex IV), updated before market placement.

  • Automatic lifecycle logs (Art. 12), with a minimum six-month retention period.

  • User-facing transparency and instructions for use.

  • Effective human oversight: not a disclaimer in the manual but a person with real intervention capacity.

  • Robustness, accuracy, and cybersecurity (Art. 15), including documented adversarial tests.

  • Conformity assessment (internal or via notified body depending on the applicable annex).

  • EU declaration of conformity and CE marking.

  • Registration in the EU database (Art. 71).

GPAI (non-systemic):

  • Technical documentation of model and training data (Art. 53.1).

  • Copyright compliance policy (Art. 53.1.c).

  • Detailed training-data summary using the AI Office template.

  • Cooperation with authority on request.

GPAI with systemic risk:

  • All of the above plus model evaluation, systemic risk management, serious-incident reporting to the AI Office, reinforced cybersecurity.

Minimal risk:

  • Only Art. 50 if applicable. Voluntary adherence to a code of practice is recommended.

Annex IV technical documentation

For high-risk systems the dossier must include at least:

  • General description of the system, intended purpose, and deployment environments.

  • Design specifications: architecture, algorithmic decisions, optimisation metrics.

  • Data information: provenance, labelling, detected biases and mitigations.

  • Post-market monitoring and maintenance processes.

  • Performance metrics by demographic subgroup where relevant.

  • Logs and version traceability.

  • Risk evaluation and mitigation plan, which must be kept updated.

We keep this dossier as a Git monorepo with a model_card.yaml per system, validated by a schema in CI. The same structure serves internal audit and a potential notified-body external audit.

Transparency (Art. 50): which labels are mandatory

Even when not high-risk, Art. 50 may apply:

  • Systems that interact with natural persons (chatbots, assistants): the user must know they are interacting with an AI, unless obvious from context.

  • Synthetic content (text, image, audio, video) generated or manipulated by AI: must be machine-verifiably marked. C2PA, invisible watermarks, signed metadata are standard technical options.

  • Deepfakes: clear disclosure that content is artificially generated or manipulated.

  • Emotion-recognition or biometric-categorisation systems: notification to the affected persons.

Article 50 compliance is not optional from a technical standpoint: the mark must be machine-detectable, not just a legal note.

Penalties and the GPAI regime

Caps:

  • Prohibited practices (Art. 5): up to €35 M or 7 % of global turnover from the previous year (whichever is higher).

  • Other AI Act breaches: up to €15 M or 3 % of global turnover.

  • Misleading information to authorities: up to €7.5 M or 1 %.

  • GPAI: up to €15 M or 3 %, enforced by the Commission (not the national authority).

Spain designated AESIA (Agencia Española de Supervisión de la Inteligencia Artificial) as the national authority, headquartered in A Coruña, operational since 2025. For specific sectors it can co-exist with AEPD (personal data) and other regulators.

Downloadable template and how to use it

Downloadable PDF template: a single form with the seven check blocks, evidence space per requirement, and a gap section with owner and target date.

Download template (PDF)

How to use it:

  • Inventory your AI systems on a single sheet before opening the template.

  • Classify each into the applicable bucket (previous step).

  • For each high-risk or GPAI system, open a copy of the template and fill it in with legal, product, and platform teams.

  • Set a quarterly review schedule for the dossier.

  • Publish internally the list of systems with their compliance status: internal transparency is the first defence against audits.

For deeper coverage of operational governance for AI agents, see AI agents in the enterprise: governance and, historically, first GenAI regulations.

Reference sources are artificialintelligenceact.eu[1] (consolidated text and explorative tools), the Commission’s AI Act Service Desk[2], and the AEPD guide on GenAI and GDPR[3] (intersection with personal data protection).

Frequently asked questions

Does my chatbot have AI Act obligations even if it is not high-risk?

Yes, Article 50 on transparency also applies to minimal-risk systems: users must know they are interacting with an AI unless it is obvious from context. Synthetic content generated or manipulated by AI must be machine-verifiably marked, using C2PA, invisible watermarks or signed metadata. Deepfakes require clear disclosure, and emotion-recognition systems must notify the affected persons. The mark has to be machine-detectable, not just a legal note.

How much can I be fined for breaching the AI Act?

The caps for prohibited practices under Article 5 are up to €35 M or 7 % of global turnover from the previous year (whichever is higher). For other breaches, including high-risk and GPAI obligations, the cap is up to €15 M or 3 %, with GPAI enforced by the Commission rather than the national authority. For misleading information to authorities, up to €7.5 M or 1 %. In Spain the national authority is AESIA, headquartered in A Coruña.

What documentation must be ready before placing a high-risk system on the market?

The Annex IV technical dossier, updated before market placement. It must include the system description and intended purpose, design specifications and metrics, and data provenance and detected biases. It also covers post-market monitoring, performance by demographic subgroup where relevant, logs with version traceability and an updated risk plan. On top of that come a quality management system, automatic logs with a minimum six-month retention, a conformity assessment, the EU declaration of conformity with CE marking and registration in the EU database.

Sources

  1. artificialintelligenceact.eu
  2. AI Act Service Desk
  3. AEPD guide on GenAI and GDPR