The EU AI Act Explained: What It Actually Requires

The EU AI Act is frequently described in single-headline terms — "the world's first comprehensive AI law" — that obscure the detail actually worth knowing: it isn't one law that switched on at a single moment. It's a framework whose obligations phase in across a multi-year schedule, with different rules applying to different categories of AI system at different times, and with the schedule itself already having been renegotiated once since the law's original passage.

The Risk-Tier Structure at the Core of the Law

The Act's basic organizing idea is a tiered risk classification: AI systems are sorted into categories — unacceptable risk (banned outright), high risk (subject to the law's most detailed compliance obligations), limited risk (subject to lighter transparency requirements), and minimal risk (largely unregulated) — with the compliance burden scaling to match the tier. A small number of AI applications, including certain forms of social scoring by governments and specific manipulative or exploitative AI techniques, are banned outright regardless of who is deploying them. High-risk systems — a category that includes AI used in contexts like employment decisions, credit scoring, law enforcement, and critical infrastructure — face the law's most extensive obligations: risk management systems, data governance requirements, technical documentation, human oversight provisions, and conformity assessments before the system can be deployed.

What Took Effect in August 2025

General-purpose AI models — the category covering large foundation models and large language models, regardless of the specific high-risk or low-risk applications built on top of them — became subject to a distinct set of obligations starting August 2, 2025. These requirements center on transparency and documentation rather than the deeper compliance apparatus reserved for high-risk systems specifically: providers must maintain technical documentation, publish a public summary of the content used to train the model (following a template the European Commission provides), and put in place measures demonstrating compliance with EU copyright law regarding training data. Models identified as carrying "systemic risk" — generally the largest, most capable models by compute and capability thresholds the Act defines — face additional obligations on top of this baseline.

What's Scheduled for August 2026

The Act's high-risk AI system obligations — the more extensive compliance regime covering systems in the specific high-risk-use categories listed in the law's Annex III — were set to take full legal effect on August 2, 2026, alongside transparency requirements under Article 50 (covering things like disclosure when a user is interacting with an AI system rather than a human) and a set of measures specifically intended to support smaller companies and startups navigating compliance. The European Commission committed to issuing detailed guidelines clarifying exactly which systems count as "high-risk" under Annex III's categories by February 2, 2026, ahead of this August deadline — guidance companies needed in hand well before the compliance obligations themselves became enforceable.

The 2026 "Digital Omnibus" Revision

The Act's implementation schedule hasn't stayed static since the law's original passage. In November 2025, the European Commission proposed a package of changes — referred to as the "Digital Omnibus" — that included a proposed delay to parts of the AI Act's original timeline, reflecting concerns raised by industry and some member states about compliance readiness for the more demanding provisions. This wasn't a unilateral Commission decision; it went through the EU's normal co-legislative process, with the European Parliament and the Council of the European Union both needing to sign off. That process concluded with final political agreement reached in May 2026, formal adoption by the European Parliament on June 16, 2026, final Council approval on June 29, 2026, and the revised provisions entering into force on July 27, 2026 — meaning the AI Act companies are actually complying with today reflects this amended 2026 timeline, not solely the law's original 2024 text.

Why the Timeline Itself Is Worth Tracking Closely

For any company actually building or deploying AI systems with EU users, the specific compliance date attached to a specific obligation matters more than the Act's overall reputation as "strict" or "the toughest AI law in the world" — a general-purpose model provider's transparency obligations were live starting August 2025, while a company deploying a high-risk hiring or credit-scoring AI system faces a materially different, more demanding compliance timeline anchored around August 2026, itself now adjusted by the mid-2026 Digital Omnibus process. Treating the EU AI Act as a single fixed rule that applies uniformly and immediately to every AI system misses both the tiered structure that determines how much a given system actually needs to comply with, and the demonstrated willingness of EU lawmakers to revisit and adjust the implementation schedule in response to real-world compliance pressure, rather than treating the original 2024 dates as immovable.