Factual overview of public EU regulatory sources and the current implementation timeline. Not legal advice.
For two years, 2 August 2026 was the date circled in every EU AI Act compliance deck: the day the high-risk rules bite, conformity assessments come due, and the public high-risk AI database opens for registrations. A lot of teams are still planning around that date. Here is the correction of record, because the date everyone circled has quietly changed — and going into this week, that gap between belief and reality is worth closing.
What the Digital Omnibus actually did
In 2026 the EU adopted a package known as the Digital Omnibus — a targeted simplification of the AI Act. Negotiators reached political agreement on 7 May 2026; the European Parliament endorsed it on 16 June and the Council gave its final green light on 29 June 2026. Its most consequential change for compliance teams is timing: the high-risk obligations for stand-alone Annex III systems are deferred from 2 August 2026 to 2 December 2027, and for AI embedded in regulated products under Annex I to 2 August 2028.
That deferral carries the Article-71 EU high-risk database with it. The registry that was supposed to start collecting high-risk system registrations on 2 August 2026 is not opening this week. If your August plan was “get ready to register in the EU database,” that project now has a 2027 clock, not a 2026 one.
So what does happen around 2 August 2026?
The date is not empty — it is just smaller than advertised. Two things are true at once, which is why the “big bang” framing misleads.
The obligations already in force stay in force. Prohibited AI practices have been banned since 2 February 2025. The general-purpose AI (GPAI) transparency and model obligations — including the requirement for GPAI providers to publish a public summary of their training content using the AI Office template — have applied since 2 August 2025. Those are live, enforceable obligations today, not future ones.
The governance and penalty architecture matures. 2 August 2026 remains the point at which the Act’s general applicability and national enforcement structure are expected to be fully in place — Member States designating competent authorities and having penalty rules on the books. What switches on around this date is enforcement capacity, not the high-risk registration wave.
The penalty regime, stated plainly
The fines are real and worth stating without drama. Under Article 99, penalties can reach up to €35 million or 7% of global annual turnover for the most serious breaches (such as prohibited practices), with lower tiers for other infringements. Crucially, these apply to the obligations that are in force — prohibited practices and GPAI duties — not to high-risk obligations that have not yet started. The correct reading is not “€35 million fines arrive on 2 August for everyone”; it is “the penalty regime backing the already-live obligations is operational, and the high-risk obligations it will eventually back are now due in late 2027.” Precision here is the difference between a compliance plan and a panic.
A new public data source — later than expected
The most interesting part of the Act for anyone who works with data is still coming: when the Article-71 database opens, registration records for high-risk systems become a brand-new public data surface — who is deploying what, in which high-risk category. That remains true. It just arrives with the December 2027 high-risk deadline rather than this August. Worth watching for; not yet here.
Who needs to act, and when
The deferral does not touch everyone equally, so it is worth being precise about who is on which clock.
- GPAI model providers are on the live clock. If you train or place a general-purpose model on the EU market, the transparency and documentation obligations already apply, and the public training-content summary is expected of you now. Nothing about your timeline changed.
- Providers and deployers of high-risk systems (Annex III categories — biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, administration of justice) are the ones who gained time. Conformity assessment, technical documentation, CE marking, and EU-database registration for these systems now line up to 2 December 2027. High-risk AI embedded in Annex I regulated products has until 2 August 2028.
- Everyone building a compliance calendar should treat 2 August 2026 as a governance-and-enforcement checkpoint and 2 December 2027 as the high-risk registration and conformity deadline — not the other way around.
When the Article-71 database does open, the public surface is expected to show registration records for high-risk systems — the provider, the system, and its high-risk category — creating a searchable public registry where none exists today. That is a genuinely new data source for anyone doing regulatory research, market mapping, or vendor due diligence. It is simply a 2027 data source, not a 2026 one.
What a compliance team can do this month
The deferral buys time on the high-risk work, but it does not mean “do nothing until 2027.” A few concrete moves make sense now:
- Re-date your plan. Anywhere your roadmap says “high-risk registration: August 2026,” change it to 2 December 2027 (Annex III) or 2 August 2028 (Annex I embedded). A plan built on the old date will have people sprinting at the wrong time.
- Confirm your GPAI obligations are actually met. If you provide or fine-tune a general-purpose model, the training-content summary and transparency duties are live now — this is the part with a present-tense deadline, and it is easy to overlook while everyone stares at the high-risk date.
- Map which of your systems are Annex III high-risk. The classification guidance is published and worth reading against your portfolio now, so that when the 2027 clock gets close you already know which systems need conformity work and eventual database registration.
- Keep a standing watch on the sources. The Omnibus is proof the timeline itself moves. A weekly automated pull of the AI Office, the Commission framework, and the implementation timeline means a change reaches you the week it publishes, not the quarter you next check manually.
Watching it as it evolves
The deadline moved. The monitoring need did not. The AI Office keeps publishing GPAI templates and guidance, the implementation timeline keeps changing (the Omnibus itself is proof), and national authorities are standing up. That is a live, moving surface across the AI Office, the Commission, and — increasingly — national bodies.
Our EU AI Act Tracker pulls it into one structured feed. Its GPAI and enforcement feeds are live today and return real records; its high-risk feed is honestly labelled a roadmap stub, with a note stating the Article-71 database was deferred to ~2 December 2027 — the tool tells you the true date rather than the old one. Run it on a weekly schedule:
{
"cronExpression": "0 8 * * 1",
"runInput": { "feeds": ["gpai", "enforcement", "high_risk"], "maxResults": 25 }
}Pricing is pay-per-event — $0.01 per run plus $0.10 per record — so a full snapshot of the current sources runs well under a dollar. When the high-risk database does open in 2027, the integration point is already in place to pick it up.
The one-line correction
2 August 2026 is a governance-and-enforcement milestone for obligations that are already live — not the launch of the high-risk database. That launch, and the conformity wave with it, moved to December 2027. Plan against the real dates.
For the fuller map of what is trackable today versus what arrives later, see our companion primer: EU AI Act Compliance Monitoring: What’s Actually Trackable Today.
This article is a factual summary of public EU regulatory sources and the current implementation timeline as of publication. It is not legal advice. For obligations specific to your organisation, consult qualified counsel.
We cover AI agents, automation, and the tools that make them work. Our mission is to make AI accessible to everyone.