The EU AI Act High-Risk Date marks the day from which the most substantial compliance duties of the European Union's Artificial Intelligence Act (AI Act) become enforceable. Falling on 2 August 2026, exactly 24 months after the regulation entered into force, this date triggers obligations for providers and deployers of AI systems classified as high-risk under the Act's risk-based framework. The AI Act, proposed by the European Commission on 21 April 2021 and approved by the European Parliament on 13 March 2024 and the EU Council on 21 May 2024, establishes a common regulatory framework for Artificial intelligence across the EU, applying extraterritorially to providers outside the bloc if they have users within it.
The high-risk category encompasses AI systems that pose significant threats to health, safety, or fundamental rights, including those used in health, education, recruitment, critical infrastructure management, law enforcement, and justice. From the high-risk date, these systems must comply with security, transparency, and quality obligations, undergo conformity assessments, and in some cases require a Fundamental Rights Impact Assessment before deployment. The date is part of a staggered timeline in which provisions of the Act become operational gradually over 6 to 36 months, with the high-risk obligations arriving at the 24-month mark.
Regulatory Timeline and Staging
The AI Act entered into force on 1 August 2024, but its provisions were designed to phase in over time to allow stakeholders to adapt. The first prohibitions on unacceptable-risk applications, such as social scoring and real-time remote biometric identification in public spaces, took effect on 2 February 2025, six months after entry into force. General-purpose AI obligations, including transparency requirements for foundation models, became applicable on 2 August 2025. The high-risk date of 2 August 2026 represents the third major milestone, applying the most extensive set of duties to a broad range of AI systems.
A fourth phase, covering high-risk AI systems embedded in products already regulated by other EU legislation, such as medical devices and machinery, is scheduled for 2 August 2027. This staggered approach reflects the Act's product-safety model, where regulatory duties are assigned to providers and deployers, and these duties become more demanding as potential impacts on health, safety, or fundamental rights increase. The European Commission designed this timeline to give developers, particularly small and medium enterprises, time to build compliance mechanisms into their product life cycles.
Scope of High-Risk Classification
High-risk AI systems are defined in Annex III of the Act and cover eight specific areas: biometric identification and categorisation of natural persons; management and operation of critical infrastructure; education and vocational training; employment, worker management, and access to self-employment; access to and enjoyment of essential private services and public services and benefits; law enforcement; migration, asylum, and border control management; and administration of justice and democratic processes. Systems in these areas are presumed high-risk unless they perform narrow procedural tasks, improve the result of previously completed human activity, or do not affect the rights of individuals.
The classification is dynamic. The list of high-risk applications can be expanded over time without modifying the AI Act itself, through delegated acts from the European Commission. This flexibility allows the regulation to respond to emerging uses of Machine learning and Deep learning technologies. Providers must evaluate their systems both before placing them on the market and throughout their life cycle, with obligations to maintain technical documentation, implement risk management systems, ensure data governance, and enable human oversight.
Conformity Assessments and Fundamental Rights Impact Assessments
A central requirement from the high-risk date is the conformity assessment, a procedure that verifies whether an AI system meets the Act's requirements before it can be placed on the EU market. For most high-risk systems, providers conduct a self-assessment against harmonised standards, while systems in certain categories, such as biometric identification, require involvement of a notified body. The assessment covers data training practices, model performance, cybersecurity measures, and the accuracy and robustness of the system.
For high-risk systems used in public administration, law enforcement, or essential services, deployers must also conduct a Fundamental Rights Impact Assessment (FRIA) before deployment. This ex ante review identifies and mitigates potential impacts on fundamental rights, describing which individuals and communities are affected, possible harms, and providing a basis for public and institutional scrutiny. The FRIA requirement builds on earlier work on algorithmic impact assessments and is meant to ensure that AI deployment does not disproportionately infringe on rights protected under EU law.
Citizens gain new procedural rights from the high-risk date. They can submit complaints about AI systems to national supervisory authorities and receive explanations of decisions made by high-risk AI that affect their rights. These rights do not create individual causes of action under the Act itself, as it is a form of product regulation, but they complement existing remedies under the General Data Protection Regulation and national laws.
Obligations for Providers and Deployers
Providers of high-risk AI systems must establish a quality management system, maintain technical documentation, implement post-market monitoring, and take corrective action when systems present risks. They must also ensure that training, validation, and testing data are relevant, representative, and free of bias where feasible. Transparency obligations require that users are informed when interacting with an AI system, and that systems are designed to allow human oversight, including the ability to interpret outputs and intervene or halt operation.
Deployers, the organisations that use high-risk AI in a professional context, have separate duties. They must use systems according to instructions, assign human oversight to appropriately trained personnel, monitor for signs of risk, and report serious incidents to authorities. Deployers in the public sector must register their systems in an EU database before deployment. These duties apply regardless of whether the deployer is based in the EU, as the Act can apply extraterritorially to providers and deployers with users within the EU.
Relationship to General-Purpose AI and Generative Models
The high-risk date operates alongside a separate category for general-purpose AI, added during the legislative process in 2023 to address the rise of Generative AI systems like ChatGPT. General-purpose models, including Large language models built on Transformer (architecture) architectures, are not automatically high-risk but face their own transparency requirements. Open-source models must publish training data summaries and copyright policies, while closed-source models face broader transparency duties. High-impact models requiring more than 10^25 floating-point operations to train must undergo additional evaluations for systemic risks.
The distinction matters for the high-risk date because some general-purpose AI systems may be deployed in high-risk contexts. A foundation model used in recruitment or healthcare, for example, could trigger high-risk obligations for the deployer, even if the model itself is regulated under the general-purpose category. The Act's framework assigns duties to both the model provider and the deployer, creating overlapping compliance responsibilities. The General-Purpose AI Code of Practice, published on 10 July 2025, provides voluntary guidance on transparency, copyright, and safety, but does not replace the mandatory high-risk requirements.
Enforcement and Governance
The high-risk date activates enforcement mechanisms overseen by national supervisory authorities and the European Artificial Intelligence Board, which promotes national cooperation and ensures consistent compliance. Each EU member state must designate a market surveillance authority responsible for monitoring high-risk systems, conducting checks, and imposing penalties for non-compliance. Fines can reach up to 35 million euros or 7 percent of global annual turnover for violations involving prohibited practices, with lower but still substantial fines for other breaches.
The European Commission maintains a public database of high-risk AI systems, which deployers in the public sector must use for registration. The Act also encourages the development of harmonised standards by European standardisation organisations, which will provide technical specifications for compliance. Where standards are not yet available, providers can rely on common specifications adopted by the Commission. This governance structure is designed to ensure that the high-risk date leads to meaningful oversight rather than merely formal compliance.
Impact on Industry and Innovation
The high-risk date has significant implications for AI developers and users across sectors. Companies developing AI for medical diagnosis, educational assessment, hiring, or law enforcement must redesign their workflows to meet the Act's requirements. This includes documenting data provenance, implementing risk management processes, and ensuring audit trails. The compliance burden is substantial, but the Act allows for lighter approaches for systems considered less sensitive, and most AI applications, such as video games and spam filters, fall into the minimal-risk category and are not regulated.
For non-EU providers, the extraterritorial reach of the Act means that companies in the United States, China, and elsewhere must comply if they offer high-risk AI systems to EU users. This has led to global convergence in AI governance practices, as many multinational firms apply the Act's standards across their operations. The high-risk date also interacts with other EU digital regulations, including the General Data Protection Regulation and the proposed AI Liability Directive, creating a complex but coherent regulatory landscape for Artificial intelligence in Europe.