The AI Act is Regulation (EU) 2024/1689 on artificial intelligence: uniform rules for AI systems on the European Union market, with a “the higher the risk, the stricter the requirements” approach. In July 2026, the EU adopted Regulation 2026/1744 (the “Digital Omnibus” on AI) and postponed the requirements for high-risk systems: Annex III to 2 December 2027 and Annex I to 2 August 2028.
In brief
- Dates after the 2026 amendments. High-risk systems under Annex III from 2 December 2027, under Annex I from 2 August 2028. The general date of application of the AI Act, 2 August 2026, has not moved.
- Already in force: the bans on prohibited practices (from 2 February 2025), the obligations of general-purpose model providers (from 2 August 2025), transparency under Article 50 (from 2 August 2026). Two new bans added in 2026 apply from 2 December 2026.
- Not only European companies are affected. The regulation applies to providers and deployers of AI systems from third countries if the output of the system is used in the EU.
- Fines: for prohibited practices, up to EUR 35 million or 7% of worldwide annual turnover; for breaches of other obligations, up to EUR 15 million or 3%.
- The AI Act does not single out AI agents: the requirements depend on where the agent is used. An agent that makes decisions on credit or hiring falls into a high-risk area.
What is the AI Act?
The AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council. An EU regulation applies directly in all member states, without national laws. It classifies AI systems by level of risk:
- prohibited practices are banned (Article 5);
- high-risk systems are allowed subject to requirements on risk management, data, documentation, logging, transparency, human oversight, accuracy and cybersecurity;
- limited-risk systems must disclose that a person is dealing with AI (Article 50);
- the rest carry no special obligations.
There is a separate regime for general-purpose AI models (GPAI): the obligations of their providers apply from 2 August 2025.
Which dates apply after Regulation 2026/1744?
Regulation (EU) 2026/1744 of 8 July 2026 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends the AI Act and two other regulations.
| What | From |
|---|---|
| Bans on prohibited practices (Article 5) | 2 February 2025 |
| Obligations of general-purpose model providers | 2 August 2025 |
| General date of application of the AI Act, including transparency under Article 50 | 2 August 2026 (not moved) |
| Marking of synthetic content for systems placed on the market before 2 August 2026 | transition period until 2 December 2026 |
| Two new Article 5 bans added in 2026 | 2 December 2026 |
| High-risk systems under Annex III (Article 6(2)) | 2 December 2027 |
| High-risk systems under Annex I (Article 6(1)), built into regulated products | 2 August 2028 |
| Systems of public authorities already in operation | until 2 August 2030 |
A note for reading older reviews: texts from spring 2026 that wrote about “failed negotiations” and a 2 August 2026 deadline for high-risk systems are out of date.
What is a high-risk system?
High-risk systems fall into two groups.
Annex I: systems that serve as safety components of products already regulated by EU legislation: machinery, medical devices, toys, transport and others. For them, the requirements apply from 2 August 2028.
Annex III: systems used in eight areas:
- biometrics, in so far as their use is permitted;
- critical infrastructure: safety components in the management of digital infrastructure, road traffic, and the supply of water, gas, heating and electricity;
- education and vocational training;
- employment, workers’ management and access to self-employment;
- access to essential private and public services and benefits (this includes, for example, creditworthiness assessment);
- law enforcement;
- migration, asylum and border control;
- administration of justice and democratic processes.
For Annex III systems, the requirements apply from 2 December 2027.
Does the AI Act apply to a company outside the EU?
Yes, if its AI system works for the EU market. Article 2 extends the regulation to providers placing AI systems on the EU market, wherever they are located, and to providers and deployers of AI systems from third countries if the output of the system is used in the European Union.
In practice, this means that a software exporter with AI features, a service used by customers in the EU, or a supplier of a component for a European manufacturer must check its systems against the AI Act. For a company working only in Russia, the AI Act is not directly binding; Russian rules apply instead: Federal Law No. 243-FZ of 26 July 2026 and, for state information systems, FSTEC Order No. 117 (see the pages on the Russian AI law and Order No. 117 and AI agents).
What does the AI Act require of AI agents?
The AI Act has no separate chapter on agents. An agent is an AI system, and the requirements for it depend on where and for what it is used:
- The agent talks to people (support, sales): the Article 50 obligation applies, and a person must know they are interacting with an AI system unless this is obvious from the circumstances.
- The agent makes or prepares decisions in an Annex III area (credit, hiring, access to services): it is a high-risk system, with all the requirements on risk management, logging, human oversight and cybersecurity.
- The agent is built on a general-purpose model: the model provider has its own obligations, but they do not relieve whoever deploys the agent of responsibility.
For high-risk systems, the key requirements are event logging and human oversight. For an agent that acts faster than a person can check, human oversight at the level of each action does not scale. So the practical answer is that a human approves the rules, and every action is checked against them automatically, with a log that can be re-verified. This is the IS 3.0 architecture; why approving every action does not scale is explained on the page about human-in-the-loop.
What a company should do
- Determine whether the product works for the EU: customers, users, data, partners in the European Union. If so, the AI Act applies.
- Classify systems by risk level: prohibited practices, Annex III, Annex I, transparency. For agents, by the area in which they make decisions.
- Check the dates against Regulation 2026/1744: Annex III from 2 December 2027, Annex I from 2 August 2028. Transparency under Article 50 has applied since 2 August 2026.
- Build logging and oversight into the architecture, not into a policy on paper: a log of the agent’s actions that cannot be rewritten after the fact, and rules that are checked before execution.
- Map the AI Act requirements against those of other jurisdictions where you operate; for Russia, these are 243-FZ, FSTEC Order No. 117 for state systems and Federal Law 152-FZ on personal data.
Frequently asked questions
What is the AI Act in simple terms?
It is Regulation (EU) 2024/1689 on artificial intelligence: uniform rules for AI systems on the European Union market. The higher a system’s risk to people, the stricter the requirements; some practices are banned outright.
When do the AI Act rules for high-risk systems apply?
After Regulation (EU) 2026/1744: for Annex III systems from 2 December 2027, for Annex I systems built into regulated products from 2 August 2028. The bans have applied since 2 February 2025, and the general date of application is 2 August 2026.
Does the AI Act apply to companies outside the EU?
It does if an AI system is placed on the EU market or its output is used in the EU (Article 2). For a company working only outside the EU, the AI Act is not directly binding, but local rules apply; in Russia, these are 243-FZ and, for state systems, FSTEC Order No. 117.
What fines does the AI Act provide for?
For prohibited practices, up to EUR 35 million or up to 7% of total worldwide annual turnover for the preceding financial year, whichever is higher. For breaches of other operator obligations, up to EUR 15 million or up to 3% of turnover (Article 99).
Does the AI Act regulate AI agents?
Not separately. The requirements for an agent depend on its area of use: in Annex III areas (credit, hiring, access to services) an agent becomes a high-risk system, and when it talks to people, the obligation to disclose that it is AI applies (Article 50).
Sources
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), Official Journal of the EU, 24 July 2026: https://eur-lex.europa.eu/eli/reg/2026/1744/oj
Checked: 16 October 2026