The EU AI Act applies in phases. Prohibitions began in February 2025, general purpose model rules in August 2025, most remaining provisions in August 2026, and high risk system duties follow in December 2027 and August 2028 under the current timeline. A VP of engineering should classify systems first and then build logging, oversight and documentation into them.
What are the dates today?
The AI Act tracker at artificialintelligenceact.eu, last updated 31 August 2026 when we fetched it, lists these milestones. Prohibitions and AI literacy requirements apply from 2 February 2025. Rules for general purpose AI models, governance and certain penalties apply from 2 August 2025. The remainder of the Act applies from 2 August 2026 unless specified otherwise. High risk systems under Annex III have obligations from 2 December 2027, and those under Annex I from 2 August 2028. There is also a transition for synthetic content transparency: systems placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026. Dates have changed during the Act's life, so check the live page and the Official Journal.
How do you know if a system is high risk?
The European Commission describes the Act as setting risk based rules for AI developers and deployers, with most systems posing limited to no risk. Classification rests on Article 6 and the annexes. Annex III lists use areas, which include employment related uses. Annex I links to product safety legislation. Your first engineering task is a classification table: each AI system, its use, whether you are provider or deployer, and the article it falls under, reviewed with counsel.
Constructed example: a company builds a resume screening feature for HR customers. The classifier notes it supports hiring decisions, so it is likely an Annex III use. The same company also runs an internal code completion tool, which is likely outside high risk. The table makes the engineering priorities obvious.
What does high risk mean for the codebase?
The Act's articles for high risk systems include a risk management system under Article 9, record keeping through automatic logging under Article 12, human oversight design under Article 14, and accuracy and cybersecurity under Article 15. Article 15 says systems must be designed and developed to reach an appropriate level of accuracy and cybersecurity, with matching technical resilience, and to perform consistently throughout their lifecycle. Engineering can translate these into features and processes: event logs that reconstruct how the system behaved, interfaces that let a person intervene, evaluation suites that run on each release, and security testing of the model pipeline.
What about deployers?
If you buy and use a high risk system rather than build it, Article 26 puts duties on you as deployer, such as using the system according to instructions and assigning human oversight. Engineering teams that integrate third party models must record which duties sit with whom, in contracts and in architecture.
What is a sensible build order?
Start with inventory and classification. Add logging and versioning to every AI system, since it is cheap and needed anyway. Build evaluation harnesses. Design the human override paths for any system affecting people. Then write technical documentation from the artifacts you already have.
How to apply this
- Build the AI system inventory and the classification table with legal.
- Record for each system whether you are provider, deployer or both.
- Add structured logging and model and prompt versioning to each system.
- Write evaluation suites for accuracy, resilience and security issues and run them per release.
- Design and test human intervention paths for high risk uses.
- Track the official timeline monthly and update plans when dates move.
Quick check
When do high risk duties apply?
According to the tracker we fetched, from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Check the live source because dates have changed before.
What does Article 15 require?
High risk systems must be designed and developed to achieve an appropriate level of accuracy and cybersecurity, with matching technical resilience, and to perform consistently throughout their lifecycle.
Sources
- AI Act implementation timeline
- European Commission: AI Act regulatory framework
- AI Act Article 15
- AI Act Article 14
- AI Act Article 12
- AI Act Article 9
- AI Act Article 26
Last reviewed: 18 October 2026.
