In late 2026, several parts of the EU AI Act are already applying and enforceable for the provisions concerned, including AI literacy, the original prohibited practices, general-purpose AI model rules, Article 50 transparency duties and enforcement powers that began on 2 August 2026. Two further changes arrive on 2 December 2026, while the main Annex III high-risk rules apply from 2 December 2027 and Annex I product rules from 2 August 2028. A check now should therefore separate what is already enforceable from what is still in preparation, provision by provision.
What does checking now mean in late 2026?
Checking now means testing each AI system and model against the provisions that have already reached their application date, rather than treating the AI Act as one future deadline. The Act entered into force on 1 August 2024 and has applied in stages since then, so a single readiness date hides the real position. A practical check starts with an inventory of systems and models, records the intended purpose and the operator role for each one, and then asks which dated provision is engaged. The answer will differ across a portfolio: one system may already face transparency duties, another may only face preparation work for a later high-risk date, and a third may need an immediate prohibited-practice review. Keeping the provision, the date and the evidence together makes the next review faster and stops a later milestone from being mistaken for a reason to pause work that is already due.
Which rules are already applying and enforceable?
By late 2026, the general provisions and definitions, AI literacy under Article 4 and the original prohibited practices under Article 5 have applied since 2 February 2025. General-purpose AI model obligations under Chapter V and the governance provisions have applied since 2 August 2025. Article 50 transparency duties began applying on 2 August 2026, when enforcement powers also started for provisions already in application, including prohibitions, general-purpose AI rules, transparency and AI literacy. That enforcement start matters because it changes the consequence of a gap: an organisation can no longer describe an applicable duty as merely forthcoming. The check should therefore cover literacy measures, prohibition screening, model documentation and transparency implementation as live items, while recording which authority may be relevant for each provision and system.
For the broader regulatory framework, see EU AI Act timeline.
What should a transparency check cover now?
Article 50 transparency duties are targeted, so a transparency check should work through each system and output type separately instead of relying on one generic notice. The questions include whether people interact directly with an AI system, whether synthetic audio, image, video or text content is generated, and whether a deployer use involves a deepfake, emotion recognition, biometric categorisation or specified public-interest text. Provider marking duties and deployer disclosure duties are different obligations with different triggers, so the record should name the paragraph assessed, the operator carrying the duty and how the requirement is implemented in the real workflow. A limited transition for certain providers of systems already placed on the market before 2 August 2026 ends on 2 December 2026 for the Article 50(2) marking and detection obligation, and that transition should only be relied on where the system version and market date actually fit it.
What should a general-purpose AI check cover now?
Where an organisation provides a general-purpose AI model, the Chapter V obligations have applied since 2 August 2025, so the check should confirm that technical documentation, information for downstream providers, a copyright policy and a public summary of training content are in place as the Act requires, with additional duties where a model presents systemic risk. Where an organisation only uses a third-party model, the check is different: it should record the model and version, what documentation the provider supplied, what information survives downstream processing, and how the downstream system was classified on its own intended purpose. A model provider's work does not settle the downstream system's position, and a downstream team's classification does not settle the model provider's duties. Keeping those two records separate prevents a gap in one layer from being hidden by paperwork from the other.
What is still to come after late 2026?
Two specific changes arrive on 2 December 2026: new prohibitions in Article 5(1)(ba) and Article 5(1)(bb) concerning AI systems used to generate or manipulate non-consensual intimate material and material within Directive 2011/93/EU, and the end of the Article 50(2) transition described above. After that, the main high-risk milestones remain ahead: Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems under Article 6(2), and from 2 August 2028 for Annex I product systems under Article 6(1), following the amendments made by Regulation (EU) 2026/1744. Member States should have at least one AI regulatory sandbox operational by 2 August 2027, in the Service Desk wording. A planning calendar should carry each of those dates with its provision attached, so preparation for a later high-risk date is visible without suggesting that already applicable duties can wait.
Continue with what changes on 2 December 2026.
What does this guide not decide?
This guide does not decide whether any particular system is prohibited, high-risk or subject to a specific transparency duty, and it does not tell a reader what they must do for a specific system. Those questions turn on the system's intended purpose, the exact legal wording, the operator role and the facts of the deployment, and they can change when a model, integration or use changes. The guide also does not replace the consolidated legal text or official implementation guidance, and it does not cover sector law, data protection law or consumer law that may apply alongside the AI Act. Where a classification or a release decision depends on a contested interpretation, or where enforcement exposure is in issue, confirm the position with a competent authority or legal adviser and keep the reasoning, the source and the review date with the record.
Frequently asked questions
Are AI Act rules already enforceable in late 2026?
Yes, for provisions that have already reached their application date. Enforcement powers began applying on 2 August 2026 for applicable rules, including prohibitions, AI literacy, general-purpose AI model rules and Article 50 transparency duties. Later high-risk dates do not suspend those duties.
Does the 2 December 2026 date change everything?
No. It is a focused milestone covering new prohibitions in Article 5(1)(ba) and Article 5(1)(bb) and the end of a limited Article 50(2) transition for certain systems already on the market. Most other duties were already applying, and the main high-risk rules still have later dates.
Should preparation for high-risk rules wait until 2027?
No. Classification, documentation, testing, oversight design and deployment planning can take substantial lead time. The later application dates set when the high-risk requirements apply; they do not prevent an organisation from doing the preparatory work earlier.
Where should a reader check the current dates?
In the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, and in the Commission AI Act Service Desk implementation timeline. If a Service Desk article reproduces the original 2024 text, amended dates should be checked against the consolidated law.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗