One Month Past the EU AI Act's 2 August 2026 Application Date: What Actually Turned On, and What Still Waits Until 2027?

A month ago the AI Act stopped being something your legal team reads and became something a market surveillance authority can act on.

Not all of it. That is where most gap lists go wrong.

The Act never switched on in one go. It arrives in four waves. Three have broken, one is still a year out.

Here is the one-month audit: what became enforceable last month, what was already enforceable before it, and what is still ahead.

What did 2 August 2026 actually switch on under Article 113?

Article 113 AI Act is the entire calendar, and it fits on half a page. The base rule: "It shall apply from 2 August 2026."

Then three carve-outs. Chapters I and II from 2 February 2025. Chapter III Section 4, Chapter V, Chapter VII, Chapter XII and Article 78 from 2 August 2025, with the exception of Article 101. Article 6(1) "and the corresponding obligations in this Regulation" from 2 August 2027.

Everything the carve-outs do not name turned on last month. That residue is larger than most inventories assume:

→ Chapter III other than Section 4. Provider duties under Article 16, deployer duties under Article 26, the fundamental rights impact assessment in Article 27, conformity assessment under Article 43, registration under Article 49. → Chapter IV. The Article 50 transparency obligations, which bind you whether or not you touch high-risk. → Chapter VI. Article 57(1) requires each Member State's competent authorities to have at least one AI regulatory sandbox "operational by 2 August 2026". → Chapter VIII. The EU database under Article 71. → Chapter IX. Post-market monitoring, serious incident reporting under Article 73, market surveillance, and the remedies in Articles 85 and 86. → Article 101, held back by name from the August 2025 tranche.

Which chapters were already live before August 2026, and how does that change your gap list?

Two duties have applied since 2 February 2025, because Article 113(a) sent Chapters I and II first.

Article 4 requires AI literacy: providers and deployers "shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". Article 5 prohibits the banned practices outright.

If either still sits in your 2026 column, it is not a new obligation. It is a 19-month-old one.

The August 2025 tranche under Article 113(b) covered machinery rather than product duties: notifying authorities and notified bodies in Chapter III Section 4, general-purpose AI models in Chapter V, governance in Chapter VII, confidentiality under Article 78, and Chapter XII on penalties.

That last one has an odd consequence. Article 99 has applied since August 2025, so Member States were laying down penalty rules and, under Article 99(2), notifying the Commission of them "without delay and at the latest by the date of entry into application", while most of the conduct those penalties attach to was not yet in force. The numbers were set before the duties were.

Article 99(3): up to EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher, for breaching Article 5. Article 99(4): up to EUR 15 000 000 or 3 %, for provider obligations under Article 16, deployer obligations under Article 26, and transparency obligations under Article 50.

On 1 August 2026 the fine schedule for Article 26 existed and the Article 26 duty did not. Now both do.

Why did general-purpose AI model providers only become finable on 2 August 2026?

This is the clause the summaries drop. Article 113(b) applies Chapter XII from 2 August 2025 "with the exception of Article 101".

Article 101 is the Commission's own fining power over general-purpose AI model providers. It permits fines "not exceeding 3 % of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000, whichever is higher", where the provider intentionally or negligently infringed the relevant provisions, failed to comply with an information request under Article 91 or a measure requested under Article 93, or refused the Commission access to the model for an evaluation under Article 92.

Chapter V had already put obligations on those providers in August 2025. Article 53(1) requires model technical documentation, an information package for downstream integrators, and a policy to comply with Union copyright law.

The duty ran a full year before the Commission could fine anyone for missing it. That gap closed on 2 August 2026.

One more GPAI date, and procurement teams keep missing it. Article 111(3) gives providers of general-purpose AI models placed on the market before 2 August 2025 until 2 August 2027 to comply. The model in your stack may still be inside its own transition.

Which high-risk category is still a year away, and why is it only the Article 6(1) route?

Article 6 has two doors into high-risk, and only one is open.

Article 6(1) is the product-safety door: the AI system is a safety component of, or is itself, a product covered by the Union harmonisation legislation listed in Annex I, and that product must undergo third-party conformity assessment.

Article 6(2) is the use-case door: "AI systems referred to in Annex III shall be considered to be high-risk."

Article 113(c) defers only the first. Article 6(1) and its corresponding obligations apply from 2 August 2027. Annex III high-risk AI systems are in scope now.

Build regulated products and you have a year. Deploy an Annex III use case and you had a month ago.

The escape hatch is Article 6(3), and it is narrower than it reads. An Annex III system is not high-risk where it poses no significant risk of harm to health, safety or fundamental rights, and only where it performs a narrow procedural task, improves the result of a previously completed human activity, detects decision-making patterns without replacing the human assessment, or performs a preparatory task. Then the override: such a system "shall always be considered to be high-risk where the AI system performs profiling of natural persons".

Taking the derogation is a filed position, not a shrug. Article 6(4) requires the provider to document the assessment before the system is placed on the market, register under Article 49(2), and hand the documentation to national competent authorities on request.

Annex III also splits on conformity assessment. Article 43(2) routes "points 2 to 8 of Annex III" to internal control under Annex VI, "which does not provide for the involvement of a notified body". Point 1 follows Article 43(1).

What do the Article 50 transparency duties require from you now, even if you never build a high-risk system?

Chapter IV catches the organisations that concluded they were out of scope.

Article 50(1) puts a disclosure duty on providers of AI systems intended to interact directly with natural persons, unless that is obvious to a person who is "reasonably well-informed, observant and circumspect".

Article 50(2) is the one with engineering consequences. Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text "shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated". Systems performing an assistive function for standard editing that do not substantially alter the input data fall outside it.

Article 50(3) sits on deployers of emotion recognition and biometric categorisation systems: inform the people exposed, and process the personal data under the GDPR.

Article 50(4) covers deep fakes, and extends to text. AI-generated or manipulated text "published with the purpose of informing the public on matters of public interest" must be disclosed, unless it went through human review or editorial control with a person holding editorial responsibility.

Article 50(5) sets timing: clear and distinguishable, "at the latest at the time of the first interaction or exposure". Article 99(4)(g) prices a breach at up to EUR 15 000 000 or 3 % of worldwide turnover.

If you deploy an Annex III system, which duties are now yours rather than your vendor's?

Article 26 is a deployer article. It does not care that you bought the system rather than built it.

→ Use the system in accordance with the instructions for use, backed by appropriate technical and organisational measures. → Assign human oversight to natural persons with "the necessary competence, training and authority, as well as the necessary support". → Where you control the input data, ensure it is relevant and sufficiently representative for the intended purpose. → Monitor operation. Where use in line with the instructions may present a risk under Article 79(1), inform the provider or distributor and the market surveillance authority without undue delay, and suspend use. → Keep the logs the system generates automatically, where they are under your control, "for at least six months". → Before workplace deployment, inform workers' representatives and the affected workers. → Under Article 26(11), tell natural persons that they are subject to the system where it makes or assists decisions about them.

Article 27 adds a fundamental rights impact assessment before deployment for bodies governed by public law, private entities providing public services, and deployers of the Annex III point 5(b) and (c) systems. It covers the affected groups, the specific risks of harm, the human oversight measures, and the response if a risk materialises. Article 27(3) then requires you to notify the market surveillance authority of the results.

Public-authority deployers carry registration duties under Article 49(3), and Article 26(8) tells them not to use an unregistered Annex III system.

Article 73 sets the provider incident clock: report a serious incident immediately after establishing a causal link or its reasonable likelihood, and "in any event, not later than 15 days" after becoming aware. Two days for a widespread infringement or a serious incident under Article 3, point (49)(b). Ten days where a person has died.

And Article 86 gives the person on the other side of the decision a right to "clear and meaningful explanations of the role of the AI system in the decision-making procedure", for Annex III systems other than those in point 2.

Does AI you already had in production escape any of this under Article 111?

Partly. Article 111 legacy AI systems get a condition, not an amnesty.

Article 111(2) is the paragraph most teams lean on. The Regulation applies to operators of high-risk AI systems placed on the market or put into service before 2 August 2026 "only if, as from that date, those systems are subject to significant changes in their designs". A frozen system sits outside. Your next material redesign pulls it in.

The same paragraph carries a hard backstop: providers and deployers of high-risk AI systems intended to be used by public authorities "shall take the necessary steps to comply with the requirements and obligations of this Regulation by 2 August 2030", significant change or not.

Article 111(1) handles AI components of the large-scale IT systems listed in Annex X placed before 2 August 2027: compliance by 31 December 2030.

Then the sentence that limits all of it. Article 111(1) and Article 111(2) both open "without prejudice to the application of Article 5". The prohibitions carry no legacy relief.

Translated: "we already had it in production" is an argument about design change. It is not an argument about a prohibited practice.

FAQ: the AI Act date questions teams keep asking one month in

Is the EU AI Act fully in force now? No. Article 113 sets the general application date at 2 August 2026, but Article 6(1) and its corresponding obligations apply from 2 August 2027.

Do Annex III high-risk obligations apply yet? Yes. Article 113(c) defers only Article 6(1). The Annex III route sits in Article 6(2), which the 2 August 2026 date covers.

When can the Commission actually fine a general-purpose AI model provider? From 2 August 2026. Article 113(b) applied Chapter XII from 2 August 2025 with the exception of Article 101, and Article 101 is that fining power.

Do our existing AI systems get grandfathered? Only conditionally. Under Article 111(2), high-risk systems placed on the market before 2 August 2026 are caught once they undergo significant changes in design, with a 2 August 2030 backstop for systems intended for use by public authorities.

The mapping problem underneath the dates

None of this is hard to read. It is hard to hold in one place.

The AI Act alone runs four application dates, two routes into high-risk, a deployer article, a transparency chapter and a legacy provision, each biting a different part of your estate. Then GDPR, DORA and NIS2 land on the same systems.

That is the work Aigis GRC does as structured data. One organizational profile, deterministic mapping against 245+ regulations across 28 jurisdictions, every obligation traced to a verbatim quote from the source legal text with article-level citation.

See how the platform resolves overlapping obligations, and how risk management binds them to the risks they mitigate.

Answer once. Assess everything. Start at agrc.ai.