Compliance · EU AI Act · High-risk AI
The EU AI Act moved its deadlines. The burden of proof did not move with them.
The Digital Omnibus on AI (Regulation (EU) 2026/1744) extended those deadlines: Annex III high-risk systems now apply 2 December 2027, and Annex I safety-component systems apply 2 August 2028. Prohibited practices have been in force since 2 February 2025, and general-purpose AI obligations since 2 August 2025.
§ 01 The high-risk burden
Annex III, Annex I, and the controls every classification expects.
Annex III enumerates the high-risk use cases: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice, democratic processes. Annex I covers AI as a safety component of products already in regulated categories (toys, machinery, medical devices, vehicles, others).
The Omnibus moved the calendar. It did not move the question an examiner is going to ask.
§ 02 The evidence
Record-keeping and human oversight, by construction.
The substrate makes record-keeping and human oversight properties of the action.
This material is informational, not legal or regulatory advice. The EU AI Act is enforced by Member State competent authorities and the AI Office at the EU level; obligations depend on classification and operator role (provider, deployer, importer, distributor). The substrate produces the record; it does not by itself make a deployment compliant. Assess your specific obligations with qualified counsel. Source: the EU AI Act, Regulation (EU) 2024/1689. Record-keeping sits at Article 12; Annex III high-risk obligations apply 2 December 2027 under the Digital Omnibus extension.
§ 03 Questions
EU AI Act timelines and obligations, answered.
What does the high-risk classification ask operators to produce?
Seven obligations at the operator level: a risk-management system, data and data governance, technical documentation, record-keeping, transparency and information to deployers, human oversight, and accuracy and robustness and cybersecurity. Record-keeping and human oversight specifically assume a durable, attributable trail an examiner can interrogate after the fact.
Is this legal or regulatory advice?
No. This material is informational. The EU AI Act is enforced by Member State competent authorities and the AI Office; obligations depend on classification and operator role. The substrate produces the record; it does not by itself make a deployment compliant. Assess your specific obligations with qualified EU counsel.