EU AI Act Amendments Enter Into Force

On July 27, 2026, Regulation (EU) 2026/1744 amending the EU AI Act entered into force. The Regulation introduces targeted amendments while maintaining the AI Act’s core requirements. Most notably, it gives organizations additional time to prepare for obligations applicable to high-risk AI systems.

The Regulation does not, however, suspend or defer obligations that already apply under the AI Act, including the prohibitions on certain AI practices and obligations applicable to general-purpose AI models. Nor does it alter the application date for AI Act obligations not specifically addressed by the targeted amendments, including the transparency obligations that generally apply from August 2, 2026, subject to the limited exception discussed below.

This additional time should not slow organizations’ compliance efforts. The revised deadlines will arrive quickly, and organizations should use the extension to assess their AI systems, prioritize compliance gaps, and implement the governance, documentation, testing, and monitoring measures required by the AI Act.

Key amendments include:

High-risk AI systems

• Postponement of the application of high-risk AI system obligations. The application of Chapter III, Sections 1–3 requirements and obligations is delayed:
  • For high-risk AI systems under Annex III, to December 2, 2027; and
  • For high-risk AI systems under Annex I, to August 2, 2028.
• Reduced compliance burden for Annex I, Section A high-risk AI systems: For high-risk AI systems that are safety components of products governed by Annex I, Section A, certain AI Act requirements and obligations (i.e., Articles 9–15 and 17–25) may be limited where sector-specific EU law ensures an equivalent or higher level of protection and the overall level of AI Act protection is not reduced. The Commission must adopt delegated acts identifying the systems, requirements, conditions, and scope of any such limitations by August 2, 2027. It is also clarified that providers may continue to use available sectoral conformity-assessment routes. In particular, where the relevant product legislation permits conformity assessment based on harmonized standards without third-party involvement, a provider is not required to undergo third-party assessment solely because the product incorporates a high-risk AI system.
• Adoption of a sector-specific approach for AI-enabled machinery: The Machinery Regulation has been moved from Annex I, Section A to Annex I, Section B of the EU AI Act. As a result, the EU AI Act provisions applicable to AI-enabled machinery are limited to those referred to in Article 2(2) of the EU AI Act. Additionally, the European Commission is required to incorporate relevant AI Act requirements into the Machinery Regulation through delegated acts applicable from August 2, 2028.
• Clarification of the notion of “safety component”: It is specified that a component qualifies as a safety component where its intended purpose is to prevent or mitigate risks to the health and safety of persons or property. AI systems used solely for non-safety-related functions (e.g., user assistance, performance optimization, service efficiency, automation, convenience, or quality control) do not qualify as safety components, while AI systems whose failure or malfunction could endanger health and safety are considered safety components.
• Clarification of the cooperation obligation of the initial provider of high-risk AI systems following requalification: Where another actor becomes the provider of a high-risk AI system (e.g., following a substantial modification) the original provider must cooperate closely with the new provider. This includes making available technical documentation needed for conformity assessment, disclosing known limitations and failure modes, and providing targeted technical access for testing and validation. The obligation does not apply where the original provider expressly specified that the system must not be changed into a high-risk AI system.
• Greater flexibility for post-market monitoring plans. The Commission is no longer required to adopt a binding implementing act establishing a mandatory post-market monitoring-plan template and list of required elements. Instead, it must issue guidance, including a template, by September 2, 2027. Providers of high-risk AI systems remain required to maintain a post-market monitoring system and plan.
• Simplified registration requirements for high-risk AI systems failing with the scope of Article 6.3 derogations: While registration in the EU database remains mandatory, the information required to be provided under Annex VIII is simplified.

Prohibited AI practices

• Introduction a new prohibited AI practice: As of December 2, 2026, the AI Act will prohibit the placing on the market, putting into service, or use of AI systems that generate or manipulate:
• realistic images, videos, audio, or similar material depicting an identifiable person’s intimate parts or sexually explicit activities without that person’s freely given, specific, informed, unambiguous, and explicit consent; or
• child sexual abuse material or performances, subject to limited exceptions under national law.

For providers, the prohibition covers systems designed for those purposes as well as systems for which such output is reasonably foreseeable and repeatable based on the system’s design, training, architecture, capabilities, or user-facing features, unless reasonable and sufficient technical and other safeguards are in place. For deployers, the prohibition applies where they use a system to create or manipulate such material.

Specific transparency obligation 

• Transitional period for generative-AI transparency obligations: Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video, or text content and that were placed on the market before August 2, 2026 have until December 2, 2026 to comply with Article 50(2) transparency obligation.

Provisions applicable to all AI systems

• Revision of the AI literacy obligation: While the obligation for providers and deployers to adopt measures to ensure adequate AI literacy among staff and others involved in AI use is maintained, this obligation is softened by the introduction of a caveat stating no specific level of AI literacy is expected. Further, the European Commission and the EU Member States, with the support of the AI Board, are now required to support the providers’ and deployers’ AI literacy efforts, including through the publication by the European Commission of practical examples on a single information platform.
• Introduction of a legal basis for the processing of special categories of personal data for bias detection and correction: Providers of high-risk AI systems are allowed to process special categories of personal data to detect and correct bias when it is strictly necessary and to the extent, they meet the conditions set out in this new provision. Providers and deployers of other AI systems and models, as well as deployers of high-risk AI systems, are also exceptionally allowed to process special categories of personal data for this purpose, but only when strictly necessary to prevent risks to health, safety, fundamental rights, or unlawful discrimination, and subject to the same safeguards.
• Extension of regulatory simplifications granted to Small and Medium-Sized Enterprises (SMEs) to Small Mid-Caps (SMCs): SMCs are enterprises that employ fewer than 750 people and have an annual turnover not exceeding EUR 150 million or an annual balance sheet total not exceeding EUR 129 million. These regulatory simplifications include simplified technical documentation requirements, privileged access to sandboxes, and special consideration in the application of penalties.
• Expansion of AI regulatory sandboxes and real-world testing: The amendments:
  • permit the AI Office to establish an EU-level AI regulatory sandbox for systems within its supervisory remit, with priority access for SMEs, start-ups, and SMCs;
  • strengthen coordination and governance of national sandboxes; and
  • extend real-world testing outside sandboxes to providers and prospective providers of high-risk systems covered by Annex I, Section A product legislation. Member States may also permit real-world testing of AI-enabled products covered by Annex I, Section B legislation, subject to dedicated national frameworks and safeguards.

Enforcement

• Increased exclusive enforcement powers for the AI Office: In addition to supervising compliance with obligations applicable to General-Purpose AI (GPAI) models, the AI Office is granted exclusive competence for the supervision and enforcement of:
  • AI systems based on general-purpose AI models where both the model and system are developed by the same provider, or by providers within the same undertaking, subject to specified exceptions; and
  • AI systems constituting, or integrated into, a very large online platform or very large online search engine designated under the Digital Services Act.

Within this remit, the AI Office has market-surveillance-type investigatory and enforcement powers, including powers to request information, conduct inspections, initiate investigations, accept binding commitments, impose fines and periodic penalty payments, and order corrective measures. Providers of high-risk AI systems within the AI Office’s remit must report serious incidents to the AI Office. The Commission, acting through the AI Office, is also responsible for third-party conformity assessments and testing of high-risk systems within that remit.