EU AI Act in Force: A Checklist for the AI Features You Ship
Enforcement started on 2 August 2026. The European Commission's AI Office and national authorities now demand documents, inspect models and fine the systems the Act bans, and every chatbot that speaks to a person has to tell them it is a machine. The high-risk chapter moved off this year: the AI Omnibus postponed it to 2 December 2027. Two clocks tick at once, and this is the five-module checklist I run before an AI feature ships.
The dates, straight from the Commission
| Date | What applies |
|---|---|
| 2 Feb 2025 | Nine prohibited practices, the first eight enforceable from this day |
| 2 Aug 2026 | Article 50 transparency, AI Office enforcement powers, GPAI rules |
| 2 Dec 2026 | Machine-readable marking for generative systems already on the market; the ninth prohibition |
| 2 Dec 2027 | High-risk duties for Annex III systems: recruitment, credit scoring, exam marking, biometrics |
| 2 Aug 2028 | High-risk duties for AI embedded in products the EU already regulates |
What your feature owes today
Article 50 covers four situations whether or not the system was ever classified high-risk: an AI system that talks to people, synthetic audio, image, video or text, emotion recognition or biometric categorisation, and deepfakes or AI text on matters of public interest. If your feature answers a customer, it says it is AI. If it generates content, the output carries machine-readable marks; systems placed on the market before 2 August 2026 have until 2 December 2026 for that marking alone. On 20 July 2026 the Commission published guidelines for these obligations and a first list of 180 signatories to the transparency Code of Practice.
The prices are public: up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for transparency breaches, the higher figure each time.
The five modules I run before a feature ships
- AI inventory. Every model behind the feature with its provider named. When you deploy a model yourself, the deployer duties land on you.
- Classifier. One line per system: prohibited, Article 50 transparency, Annex III high-risk (recruitment, credit, exam marking), or outside the scope. Each line cites its article or annex.
- Gap list. What each classification owes today, what it owes from December 2027, and who owns each item, in a document the team reads.
- Documentation and logs. Technical documentation, risk assessment, activity logs. A launch of mine sat paused for three weeks in 2024 because no transcript carried a deletion date; that rebuild became the audit trail I describe in Why Your AI Agent Needs a Compliance Layer.
- Continuous monitoring. The regulation amended itself within two years of entering into force, so I re-read this checklist every quarter and watch model drift beside it.
Compliance is interface work
Half of Article 50 is what a person sees: the disclosure line, the label, the human who approves the outbound message. Audit trail and human-oversight state belong on the screen, where an operator answers "who approved the forty messages" without a two-day reconstruction. I build those states into the product in Designing Interfaces That Act: The Agentic UI Guide, and the records an auditor asks for here match the ones a regulated domain raises in Design for Web3: Where Trust Meets Regulation.
What the platforms cost
Vanta and Drata start around $10,000 a year in 2026 and climb with add-ons; a SOC 2 audit on top runs $15,000 to $50,000. Both collect security evidence for customer questionnaires. The Annex III line, the gap document and the quarterly re-read stay with your team; no subscription maps your features to the regulation.
What I am not
I am not a lawyer and national authorities run their own procedure inside this framework, so treat this as an engineering checklist rather than legal advice. What I do first: list every model the product talks to, mark which ones speak to people, and write the one-line disclosure the chatbot shows. High-risk duties arrive on 2 December 2027, and an audit trail built while the deadline is a calendar entry costs less than one built under questioning. Send me your stack list on the contact page and I will tell you which features are Annex III candidates and what breaks first.