Required by regulation
Artificial Intelligence Act (AI Act)
The original date for high-risk systems no longer applies. Those under Annex III were postponed to 2 December 2027 — but what applies today is not limited to them.
Who it is for
Organisations that use AI systems built by someone else — in the language of the Regulation, deployers — and organisations that supply or develop them, providers. Most organisations are the first kind, and that is where obligations are most often misread.
It also concerns organisations that already work on data protection. The AI Act builds on the same inventory of systems, and the fundamental rights impact assessment can build on the data protection impact assessment.
A postponement is not a cancellation
Regulation (EU) 2026/1744 amended the AI Act and moved the dates for the requirements on high-risk systems: to 2 December 2027 for systems under Annex III and to 2 August 2028 for systems under Annex I.
The original date, 2 August 2026, no longer applies to high-risk systems.
That does not mean nothing is happening. One group of obligations was postponed. The prohibitions, AI literacy and transparency kept their dates, with one transitional period for marking, described below — and they already apply.
What applies today
Where an organisation only uses AI — and most do — three things apply.
Prohibited practices have applied since 2 February 2025, regardless of who built the system. They include the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions, except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons (Article 5(1)(f)), and, under the conditions of Article 5(1)(c), evaluating people by a so-called social score.
AI literacy. The amendment replaced Article 4. Providers and deployers of AI systems now have to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. The new wording adds: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” What counts is therefore the measures taken, not what a particular person knows — but without any measure there is nothing to show.
Transparency. Where a system interacts with people or generates content, it must be clear that AI is involved. This has applied since 2 August 2026. Providers of systems generating synthetic content that were placed on the market before 2 August 2026 have until 2 December 2026 to meet the marking requirement.
Where an organisation supplies or develops AI, classification comes first — and after the amendment, earlier answers are worth checking again.
What has been postponed
2 December 2027 — high-risk systems under Annex III, including the area “Employment, workers’ management and access to self-employment” (Annex III, point 4)
2 August 2028 — high-risk systems under Annex I
Where a fundamental rights impact assessment is required and some of its obligations are already met through a data protection impact assessment under Article 35 GDPR, the amendment allows the deployer to include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof in the fundamental rights impact assessment (Article 27(4)). The earlier assessment is therefore not wasted work.
Where our role ends
We are not a notified body and we do not carry out conformity assessment of AI systems. Where the Regulation requires third-party conformity assessment, a notified body carries it out.
We do not provide legal advice. We work with the Regulation as a compliance framework; legal interpretation of a specific case belongs to a lawyer.
No one audits their own work. Documentation we prepared is reviewed independently by someone else, not by us.
We neither develop nor supply AI systems, so we have no reason to recommend one over another.
Related
The inventory of AI systems comes from the same asset inventory as risk analysis, and the fundamental rights impact assessment builds on the work done under GDPR.
More on the timetable in The AI Act: what applies today and what was postponed, and on everyday use of AI tools in AI tools and personal data.
Legal position verified as of 23 October 2026. Sources: https://eur-lex.europa.eu/eli/reg/2026/1744/oj, https://eur-lex.europa.eu/eli/reg/2024/1689/oj
How we help
Packages, scope and indicative price
Inventory of AI systems in the organisation
There are usually more than management thinks, and most are in no register. Nothing else can be done without this step.
Classification
For each system: whether it falls under a prohibition, under transparency obligations, under the high-risk category, or under none of them. After the amendment, earlier classifications are worth revisiting.
AI literacy
Measures for the people who use AI on your behalf — typically training and a record of it. The obligation is to take measures, not to guarantee a level of knowledge.
Transparency obligations
What to mark, how and where — including wording that holds up.
Fundamental rights impact assessment
Where it is required. If you have a data protection impact assessment under GDPR, we build on it rather than repeating it.
We do not list prices on this page. We agree the scope and the price with you in advance — the quotation follows the initial assessment.
What determines the price
The price is determined by scope, not by the size of the company. Effort is driven mainly by an additional site, an additional information system in scope, a supplier that has to be assessed, and a second jurisdiction. Each such extension adds roughly a third to a half to the effort. We agree the scope at the initial assessment and the quotation states the number of days as well.
Frequently asked
What people ask us most often
Has the date for high-risk systems changed?
Yes. Regulation (EU) 2026/1744 moved it: to 2 December 2027 for systems under Annex III and to 2 August 2028 for systems under Annex I. The postponement concerns the obligations for high-risk systems; the prohibitions, AI literacy and transparency kept their dates.
Does the AI Act apply to us if we only use AI?
It can. Prohibited practices have applied since 2 February 2025, regardless of who built the system. Transparency obligations have applied since 2 August 2026. And the AI literacy obligation applies to deployers as well as to providers. Which of this applies where is what the inventory and classification establish.
How did the amendment change the AI literacy obligation?
Article 4 was replaced. Providers and deployers now have to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. The new wording states: “This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” The obligation remains; what is assessed is the measures.
We already have a GDPR data protection impact assessment. Does it help?
Where a fundamental rights impact assessment is required and some of its obligations are already met through your data protection impact assessment under Article 35 GDPR, yes: the amendment allows the deployer to include cross-references to the relevant sections of that data protection impact assessment or include relevant parts thereof in the fundamental rights impact assessment (Article 27(4)). Not every deployer has to carry out a fundamental rights impact assessment — we check first whether it applies.
Do you issue certificates of conformity under the AI Act?
No. We are not a notified body and we do not issue certificates under this Regulation. Where it requires third-party conformity assessment, a notified body carries it out. We prepare you, classify systems and build the documentation.
Tell us which AI tools you use
A list of tools — or just the departments that use them — is enough to start. We will tell you which parts of the AI Act apply where and what the work involves.