The EU AI Act Has Reached an Operational Deadline: What Applies Now, What Comes Next, and What Leaders Need to Do
On 2 August 2026, the EU AI Act crossed an operational threshold. Its transparency duties began to apply, and the AI Office plus Member State authorities assumed responsibility for implementation, supervision and enforcement. The European Commission’s implementation overview confirms both changes.
The practical question is no longer whether an organisation has an AI policy. It is whether it can show where AI appears, what people are told, who owns the control and what happens when the system or use changes.
This is a leadership briefing, not legal advice. The exact scope depends on the system, role and jurisdiction; use legal, privacy, security and sector-specific advice for your own use cases.
What changed on 2 August — in plain language
Article 50 of the AI Act makes transparency an operating obligation. In practical terms, relevant organisations need to make it clear when a person is interacting with AI; relevant AI-generated or manipulated content needs to be identifiable; and deepfakes or AI-generated/manipulated text published to inform the public on matters of public interest require disclosure. The Article also contains notification duties for deployers of emotion-recognition and biometric-categorisation systems.
This is not “put an AI label somewhere on the website.” It is a set of specific questions:
Does the person know when they are interacting with a machine rather than a human?
Does the organisation know when synthetic audio, image, video or public-interest text is created or manipulated with AI?
Is the correct notice or label visible in the actual interaction or publishing flow?
Who can show that the control was checked and still works after the tool, supplier or use case changes?
The European Commission also states that, from 2 August 2026, the AI Office and Member State authorities are responsible for implementation, supervision and enforcement. This is why transparency now needs an owner and evidence—not just good intentions.
Five organisations, five different starting points
The AI Act timetable is easiest to understand through real operating contexts. These examples are illustrative, not a substitute for a classification or legal assessment.
| Organisation | The AI use | What is most immediate now | Who governs; who executes | What makes this distinct |
|---|---|---|---|---|
| A retailer | A website chatbot answers delivery and returns questions; the marketing team uses generative images | Confirm that customers understand when they are interacting with AI; identify synthetic content and the relevant disclosure route | Digital/customer-experience owner is accountable; product/web team places the notice; marketing owns asset labelling; legal/privacy validates scope | The visible risk is customer interaction and public content, not a high-risk decision. |
| An SME manufacturer | An internal assistant drafts maintenance summaries and a supplier tool generates product visuals | Inventory the tools, confirm AI literacy and distinguish internal drafting from public synthetic material | Operations leader owns the use case; IT/procurement owns supplier facts; communications owns anything published | It may have a small footprint, but still needs proof that employees know the boundary and public assets are controlled. |
| A hospital | A radiology or clinical-support system contributes to a diagnostic workflow | Map the system’s intended use, product status, human oversight, data path and clinical accountability; do not assume a generic chatbot approach is enough | Clinical sponsor and medical-device/quality leadership govern; clinical engineering, IT security and vendors execute the evidence work | A possible regulated-product / safety path means the 2028 preparation horizon is the central issue. |
| An employer | A tool ranks CVs or recommends candidates for interview | Start classification, preserve the human decision route and document what data and criteria shape the recommendation | HR executive is accountable; talent operations runs the workflow; HRIS/vendor, privacy, legal and people-risk teams provide the controls | Employment is a sensitive Annex III high-risk area with a 2027 readiness horizon. |
| A bank or essential-service provider | A model influences credit eligibility, pricing or access to an essential service | Identify whether the model materially influences access; test explanation, escalation and correction routes | Business risk owner governs; model/product/data teams execute; compliance and customer-complaint functions test redress | The central question is not labelling. It is decision impact, fairness and the ability to challenge an outcome. |
The distinction matters. A retailer may be able to fix a transparent chatbot notice this month. A hospital, employer or bank must use the coming transition period to build evidence and controls into systems that can affect health, livelihood or access.
The quick solve: 30 days for what is already in force
Do not start with a 100-page policy. Use a short PathPatron transparency control map: discover → classify → disclose → control → evidence.
1. Discover: make the AI estate visible
Ask every function: where are we using AI to interact, generate, classify, recommend, route or decide? Record the service, purpose, affected people, input data, output, human decision point and supplier. This finds the forgotten chatbot, synthetic campaign asset, voice-cloning experiment or AI-assisted public-information workflow that never made it into a formal programme.
2. Classify: identify the Article 50 queue
Create three queues:
Direct interaction: a person interacts with AI and may not reasonably realise it.
Synthetic/manipulated content: image, audio, video or public-interest text may need marking or disclosure.
Sensitive perception: emotion recognition or biometric categorisation needs a higher-alert legal, privacy and fundamental-rights review.
For each item, mark the evidence confirmed, estimate to validate, or unknown/blocking. Do not fill a compliance register with guesses.
3. Disclose: put the control in the actual flow
The web/product team may add a chatbot notice. Marketing may adjust the asset-publication checklist. The communications team may add a disclosure to public-interest text. What matters is that the notice appears at the point of interaction or publication—not in a policy that the affected person never sees.
4. Control: name the accountable person and the executors
Every relevant system needs one accountable business owner. That owner is supported by an operational executor (product, web, marketing, HR operations or clinical engineering), plus legal/privacy/security where the use requires it. “Compliance owns it” is not an operating model.
5. Evidence: retain the smallest useful proof
Keep the inventory entry, notice/label, screenshot or publishing record, supplier reference, owner, date checked and unresolved issue. If the retailer changes chatbot vendor or the hospital changes a clinical workflow, that record tells the next team what must be re-validated.
The deadline map: what is in force, what comes next
| When | Requirement and source | Who governs | Who executes now |
|---|---|---|---|
| Since 2 February 2025 | Article 4 AI literacy and Article 5 prohibited practices | Executive sponsor plus each business owner | HR/L&D, product/IT and managers tailor literacy to the people actually using or overseeing AI; legal/risk identify and stop prohibited uses. |
| Since 2 August 2025 | Governance rules and obligations for providers of general-purpose AI models, per the Commission overview | Procurement/technology leadership | Vendor management asks which model powers the service, what documentation/support exists and what changes in the supplier chain trigger a review. |
| Since 2 August 2026 | Article 50 transparency duties; implementation, supervision and enforcement | Business owner of each relevant system; board/executive governance forum oversees material exposure | Product/web/communications teams implement notices and labels; legal/privacy validate scope; the system owner maintains evidence. |
| December 2026 | Prohibition on systems generating non-consensual intimate/sexually explicit content or CSAM, via the AI Omnibus | Product/platform and safeguarding leadership | Supplier due diligence, acceptable-use terms, moderation, reporting and incident escalation are tested. |
| 2 December 2027 | High-risk systems in sensitive Annex III areas: the current timetable is set out by the Commission | The accountable executive for the affected decision—HR, clinical/operations, risk, public-service or justice leader | Cross-functional delivery team builds classification, risk management, data governance, logging, documentation, human oversight, accuracy/robustness/cybersecurity and post-market routines. |
| 2 August 2028 | High-risk AI embedded in regulated products | Product safety / quality executive | Product, quality, regulatory and supplier teams integrate AI evidence into conformity, safety and post-market processes. |
The table is deliberately not a legal checklist. It exposes the governance mistake that causes most late work: assuming a legal or AI team can implement controls in workflows owned by sales, HR, clinical, operations or product teams.
Start the preparation work now
If you may have a 2027 high-risk use case
Employment, essential services and certain health/public-sector contexts should not wait for the deadline. Start with five questions:
Scope: Does the system materially influence a listed decision, and are we provider or deployer?
Process: What happens in the normal, error and escalation cases? Where is the human decision meaningful rather than ceremonial?
Data and evidence: What data enters, where does it come from, what can be corrected, and what must be logged?
Supplier readiness: Can the vendor supply the documentation, instructions, logs and contractual support that the role requires?
Affected people: Can an employee, patient, applicant or customer understand, challenge or correct a harmful outcome where the context requires it?
The hospital, employer and bank examples share the same preparation spine. Their distinct challenge is the consequence of getting it wrong: patient safety, access to work, or access to credit/service. That is why the control threshold and the people at the table differ.
If you make regulated products
For AI systems that are safety components of regulated products, the Commission’s timeline extends to August 2028. The right move is not to invent a separate AI-governance theatre. Put AI Act readiness inside existing safety, quality, conformity assessment, supplier-management and post-market processes. Ask: where does AI change the evidence our product already needs?
If you use generative AI without a high-risk use case
Do not mistake “not high-risk” for “nothing to do.” The retailer and manufacturer examples still need Article 50 triage, AI literacy, supplier diligence, data/policy boundaries and a way to stop or correct harmful use. Their programme can be lighter; it should not be invisible.
What non-compliance can cost
Article 99 sets maximum administrative-fine levels. National procedures and the organisation’s role matter, so these are not predictions. But they make the risk concrete:
up to €35 million or 7% of worldwide annual turnover for certain prohibited practices and related data requirements;
up to €15 million or 3% for other infringements of the Regulation; and
up to €7.5 million or 1% for supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities.
Article 99 contains specific rules for undertakings, including SMEs; read the primary source, rather than relying on a headline.
The closer cost is often operational: a project paused, a supplier blocked, an affected person unable to get an explanation, a complaint that cannot be investigated, or a board learning that it cannot describe what its own system does. The retailer may lose trust; the hospital may need to halt a workflow; the employer or bank may face a decision it cannot defend.
The PathPatron test: can your organisation make AI legible?
This is where PathPatron’s framework earns its place. The AI Act is not only a legal layer dropped onto technology. It is a People, Process and Power problem:
People: who is affected, informed, accountable and able to challenge the outcome?
Process: where does the system enter the workflow, what does it change, and where is the correction/escalation route?
Power: what technology is used, which techniques keep control visible, and which regulatory/governance references belong in the Taxonomy?
That frame prevents a shallow answer. A label alone is not transparency. A risk register alone is not governance. A model card alone is not operational accountability. The work is complete only when the people, workflow, authority and evidence line up.
Keep it useful after the deadline moment
This should be maintained as a living implementation guide, not treated as a one-day news reaction. Refresh it when Commission guidance, delegated acts, harmonised standards or the high-risk timetable changes. Add short companion pieces over time: an Article 50 transparency checklist, a high-risk supplier-question set, and sector-specific examples for employment, healthcare and essential services.
That is how the topic remains relevant: it moves from “what changed on 2 August?” to “how do we keep AI legible and governable as the systems change?”
Primary sources
European Commission, AI Act implementation overview, obligations and timeline
Official Journal, Regulation (EU) 2024/1689 — AI Act: Article 4, Article 5, Article 50 and Article 99
European Commission, AI Omnibus enters into force
European Commission, guidelines on prohibited AI practices