Regulation (EU) 2024/1689 · amended by Regulation (EU) 2026/1744
The AI Act, for a company that builds or uses AI
Which of the 25 Annex III use cases, which operator you are, and the dates as amended on 27 July 2026 decide what the AI Act asks of you.
Answer above to read the determination for your case; the full tool takes your answers with it.
Continue in the free determinationThe full determination answers every question, and keeps the reading as a dated record for €29.
At a glance
The dates, as amended
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July 2026 and moved the high-risk requirements by sixteen and twelve months. The rows are read from Article 113 as amended, on 12 September 2026; dates already passed are greyed.
- 12 July 2024
The Regulation in the Official Journal.
- 2 February 2025
Chapters I and II: the definitions, Article 4 on AI literacy, and the Article 5 prohibited practices as adopted.
- 2 August 2025
The obligations of providers of general-purpose AI models (Chapter V), the governance chapters and the penalties, notified bodies excepted until the general date.
- 27 July 2026
The Digital Omnibus on AI in force: Article 6(1a) to (1c), the rewritten Article 4, Article 17(2), Article 111(2) as amended, and Articles 102 to 110, the amendments to other Union acts.
- 2 August 2026
The general date of application: Article 50, the transparency duties for systems that interact with people or generate content, and everything not given another date.
- 2 December 2026
The two prohibitions inserted into Article 5(1), points (ba) and (bb): generating or manipulating intimate or sexually explicit material of an identifiable person without consent, and child sexual abuse material. Article 50(2) reaches generative systems already on the market by the same day.
- 2 December 2027
Chapter III Sections 1 to 3 for systems high-risk under Article 6(2) and Annex III: the requirements of Articles 8 to 15, the provider and deployer obligations of Articles 16 to 27. The original text said 2 August 2026.
- 2 August 2028
Chapter III Sections 1 to 3 for systems high-risk under Article 6(1) and Annex I, the safety components of regulated products. The original text said 2 August 2027.
- 2 August 2030
Article 111(2): high-risk systems intended for use by public authorities comply by this date whatever the day they were placed on the market.
Five tools, the cited standard, and ISO 42001
- Free checkEN 18286, the AI Act's first harmonised standardCited on 14 October 2026 for the quality management systems of AI providers. What the citation gives and what it does not, ISO 42001 beside it, and the 13 aspects of Article 17(1) to tick.
- Free checkProhibited practices, and two new bansThe ten practices of Article 5, with three possible readings each. Two apply from 2 December 2026, and Article 5(1a) decides whether they reach a generator.
- Free checkIs your AI system high-risk?The questions Article 6 asks, as amended: the product route with paragraphs 1a to 1c, the 25 points of Annex III verbatim in your language, the 6(3) conditions and the profiling override, ending in a written determination with the date the requirements apply from and what a provider or deployer then owes.
- Document writerDo you owe a fundamental rights impact assessment, and what goes in it?Article 27 reaches public bodies, private providers of public services and every deployer of credit and insurance systems. Two questions decide it; then the six elements of Article 27(1) in the Regulation's words, one field each, written as a document to file and notify.
- Document writerThe Article 4 AI-literacy record, written from a tableEvery provider and deployer owes measures, not a guaranteed level. One row per group of people: systems, context, prior knowledge, measure, when, owner; the page writes the record with the amended paragraph quoted and the ISO 42001 clauses it lives under.
- Document writerThe Article 16 provider checklistThe twelve obligations of a provider of a high-risk system, verbatim, each with the article it points to and where an ISO 42001 system keeps the evidence; a status per point, and the checklist as a document with the date it applies from.
- Document writerRegistration in the EU database, Article 49Which of the three registrations you owe, whether it goes into the restricted section or to national level, and the Annex VIII items in the Regulation's words, one field each, written as the entry to file.
- GuideISO 42001, the AI management system standardThe 38 Annex A controls, the clause register and the 24 AI Act obligations mapped to them: ten of the thirteen aspects of the quality management system Article 17 asks a high-risk provider for, as a standard a certification body can audit.
- GuideWhat StandardOS covers of ISO 42001Clause by clause, where each record lives in the product and where every software's limits are.
- GuideThe Annex A controls, one page eachEvery control with its objective, the evidence it produces and the AI Act obligation it serves where one does, in six languages.
Every free template on one page
6 articles, from the primary sources
- ArticleThe AI Act for a software company: which role you are, what applies to everyone, what applies only to a high-risk provider, the SME provisions, and the dates as amendedA software company meets the AI Act in one of six roles, and most of the Regulation only applies to two of them.
- ArticleThe AI Act after the Digital Omnibus: the dates that changed on 27 July 2026, and which ISO 42001 controls produce the evidence for Article 17's thirteen aspects and Articles 9 to 15Regulation (EU) 2026/1744, signed 8 July 2026, published 24 July, in force 27 July, moved the AI Act's high-risk dates to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, rewrote AI literacy as a duty to take measures, and made the post-market monitoring plan part of the technical documentation.
- ArticleAI literacy under Article 4 of the AI Act, as rewritten on 27 July 2026: what 'take measures' means, who it covers, what it does not require, and the record to keepArticle 4 has applied to every provider and deployer of an AI system since 2 February 2025.
- ArticleWhat a deployer of a high-risk AI system owes under Article 26 of the AI Act: the twelve paragraphs in order, the Article 27 impact assessment, when you become the provider, and the records an ISO 42001 system keepsMost companies will meet the AI Act as deployers: they buy or licence a system someone else built and use it under their own authority.
- ArticleArticle 50 of the AI Act for a company that ships or uses generative AI: the four transparency duties in force since 2 August 2026, the 2 December 2026 transition, the code of practice and the EU iconArticle 50 is the AI Act obligation that reaches a company whether or not its system is high-risk: tell people they are talking to an AI, mark generated content so machines can detect it, disclose deep fakes and AI-written text on matters of public interest, inform people exposed to emotion recognition.
- ArticleISO 42001 certification: what it asks for, what it costs, and who is actually askingISO/IEC 42001 is the AI management system standard.
What it asks of you
151 requirements in 4 groups
Obligations
122- 4(1) Build AI literacy in your staff and operators
- 5(1)(a) Never deploy subliminal or manipulative techniques
- 5(1)(b) Never exploit age, disability or social need
and 119 more
Duties
4- 49(1) Register the high-risk system before market placement
- 49(2) Register a system judged not high-risk, with the reason
- 49(3) Register as a public deployer before using the system
and 1 more
Clauses
22- 5(1a) When the two new prohibitions actually bite
- 5(1b) What does not count as manipulation
- 9(3) Cover the risks that design or information can reduce
and 19 more
Deadlines
3- 73(2) Report within 15 days of the causal link
- 73(3) Report a widespread infringement within two days
- 73(4) Report a death within ten days of the link
Ten of Article 17's thirteen aspects are an ISO 42001 system; the other three are written for the Regulation
StandardOS runs the ISO/IEC 42001 management system whose records are the process behind 24 of the obligations a high-risk provider carries, and names what the standard does not produce so it is written for the Regulation itself. The high-risk determination goes in as the first record, in six languages.
Dates are read from Article 113 of the Regulation as amended and never typed on this page. This is not legal advice, and the two texts are the ones to read: Regulation (EU) 2024/1689, Regulation (EU) 2026/1744.
Related:ArticlesFree toolsOpen datasets