What the August 2026 Deadline Actually Requires
The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024, with obligations phased in over several years rather than taking effect all at once. Prohibited AI practices under Article 5 became applicable on February 2, 2025, and obligations for general-purpose AI models under Chapter V became applicable on August 2, 2025. The next major milestone is August 2, 2026, when most obligations under Title III for high-risk AI systems, along with the associated provider and deployer duties in Articles 16 through 27, become applicable. This means enterprises operating or deploying high-risk AI systems in the EU have a defined window to establish risk management processes, technical documentation, logging capability, human oversight mechanisms, and post-market monitoring before enforcement begins. Because technical documentation and logging architecture require lead time to build rather than retrofit, treating August 2026 as a compliance deadline to prepare for now, rather than react to later, is consistent with how the Act structures these obligations.
Determining Whether a System Is High-Risk
Before any downstream obligation applies, an enterprise must determine whether a given AI system falls under the Act's high-risk classification. Article 6 and Annex III define high-risk categories, which include AI systems used in employment decisions, education access, credit scoring, law enforcement, migration and border control, critical infrastructure, and biometric identification. This classification step is foundational because it determines which obligations apply and to what degree. It also needs to be performed on a system-by-system basis, since an enterprise may operate some AI systems that qualify as high-risk and others that do not, each requiring separate treatment under the Act.
Providers and Deployers Have Distinct Obligations
The Act draws a clear line between providers, who develop or place high-risk AI systems on the market, and deployers, who use those systems under their own authority. Provider obligations are set out primarily in Article 16, while deployer obligations are set out in Article 26, and the two are not interchangeable. An enterprise building an in-house high-risk AI system carries provider-level obligations for that system, while the same enterprise deploying a third-party high-risk AI system in its operations carries a separate, narrower set of deployer obligations. Because many enterprises will hold both roles across different systems, the first governance task is mapping each AI system in use to its correct role classification before applying the checklist above.
Logging and Human Oversight: Where Runtime Controls Matter
Article 12 requires high-risk AI systems to automatically record events relevant to identifying risks and supporting post-market monitoring, but the Act does not prescribe a specific log format or retention infrastructure. This leaves enterprises to determine how logging is implemented in practice, and retrofitting logging into an already-deployed system can require architectural changes rather than a configuration update. Article 14 similarly requires that human oversight be designed into the system or implemented procedurally by deployers, with the ability to intervene, override, or stop the system when needed. Both requirements point toward the same operational need: AI systems must generate auditable records of their behavior and provide enforceable checkpoints for human control, not just documentation describing that such controls exist on paper. This is where runtime governance and policy enforcement become relevant. Trussed AI provides runtime governance and security for enterprise AI agents, including runtime policy enforcement, runtime monitoring, and audit logging, which map directly to the evidentiary needs created by Articles 12 and 14. Agent identity, permissions, and tool approval workflows also support the kind of continuous, system-level oversight the Act describes, rather than relying solely on procedural controls applied after deployment.
Conformity Assessment and Post-Market Monitoring
Article 43 sets out conformity assessment procedures that vary by risk category. Some high-risk systems require third-party assessment by a notified body, while others permit internal assessment against Annex VI. As of the most recent available guidance, harmonized technical standards being developed by CEN-CENELEC JTC 21 to operationalize these assessments had not been finalized, which introduces some interpretation risk for enterprises finalizing compliance programs ahead of the deadline. Article 72 further requires providers to implement a post-market monitoring system that collects and analyzes performance data throughout the AI system's lifecycle. This is a continuous obligation rather than a one-time certification event, meaning governance processes must persist after the August 2026 deadline rather than concluding at it. Enterprises should build monitoring and documentation-update processes with this ongoing requirement in mind, rather than treating conformity assessment as the finish line.