EU regulation
AI Act: roles, risks and application dates
Overview
Short answer
The AI Act distinguishes prohibited uses, high-risk systems, specific transparency duties and general-purpose AI models. Assess your role and the intended use before selecting requirements and dates. The same obligations do not apply to every AI system. Articles 2–6 and 50.
Legal status
Law in force with phased application
Checked on 11 October 2026 against the 27 July 2026 consolidation and amending Regulation 2026/1744. Distinguish high-risk dates from the general date and transitional rules.
Part 1
What the AI Act covers
Regulation (EU) 2024/1689 covers, among others, providers placing AI systems on the EU market and deployers using them. One organisation can hold several roles. Exclusions include certain research activities. The exception for purely personal, non-professional use concerns the obligations of deployers who are natural persons. Identify the system and its context before applying a generic checklist. Articles 2–3.
Part 2
When is a system high-risk?
Article 6 establishes two main routes: certain product-related systems under Annex I and uses listed in Annex III. The product route requires both the relevant product or safety function and a third-party conformity assessment requirement. The 2026 amendment clarifies that convenience or quality control alone, without a safety function, is insufficient. Annex I Section B follows the limited application in Article 2(2). Articles 2(2) and 6.
Part 3
Which dates should planning use?
Following Regulation (EU) 2026/1744, Chapter III Sections 1–3, except Article 6(5), apply from 2 December 2027 for Annex III and 2 August 2028 for Article 6(1) and Annex I. This does not postpone every other requirement. The general date remains 2 August 2026, with specific earlier and later steps. Article 1(40).
Part 4
Make the evidence usable
Describe the use case, system version, supplier, responsible person and data used. For a future high-risk system, relevant requirements include risk management, technical documentation, logging and human oversight. Start collecting the evidence explaining your classification decision. This is recommended preparation, not a requirement for every AI tool to have an identical technical file. Articles 9–16.
Part 5
A practical starting workflow
- List systems and intended uses.
- Determine your role for each system.
- Check prohibitions, risk classification and transparency separately.
- Link each obligation to its own date.
- Assign owners for evidence and changes.
Revisit the assessment when the use or system changes. Retain decisions and remaining questions so the next reviewer can understand the conclusion.
Part 6
Avoid a single AI deadline
A postponed high-risk requirement is not a general pause. AI literacy and certain prohibitions already apply; specific transparency rules have their own conditions. Systems already on the market also have transitional provisions. Do not confuse a model provider with the provider or deployer of the finished AI system. Articles 4, 50, 111 and 113.
Checklist
Key takeaways
- Start with the intended use and your organisation’s role.
- AI in a product is not automatically high-risk.
- High-risk dates differ for Annex III and Annex I.
- Tie the assessment to a defined system version.
Questions and answers
Frequently asked questions
Is all AI high-risk?
No. Intended use, product relationship and the conditions in Article 6 determine the answer.
Must every AI system carry CE marking?
No. The AI Act’s CE rules concern high-risk systems within the relevant procedure, not all software.
Do existing systems automatically follow the same date?
No. Article 111 contains specific transitional provisions; check the system’s dates and changes.
Does the AI Act replace other product rules?
No. Also map the product and data protection rules applicable to the use.
Further reading
Official sources
How Verca helps
How Verca can support the process
Verca brings together product evidence and documents with version history, providing a place for the decision record. Responsible people still need to perform the AI classification and legal assessment. Platform.