The EU AI Act doesn't switch on in 2026. It already has

The EU AI Act rolls out in four waves. Two are already in force. Here's what the August 2026 deployer obligations mean for your organisation, and what to do in the next 90 days.

If you're waiting for the EU AI Act to "kick in" before you start preparing, you've missed two of its four milestones already, and the one that matters most to your organisation is now less than a year away.

That's the confusion worth clearing up. The Act didn't arrive as a single event. It arrived as a phased rollout that started in August 2024 and won't be complete until August 2027, and the wave landing in August 2026 is the one that will actually shape how most enterprises procure, deploy and operate AI.

Four dates, not one

The Act reaches full effect in stages, and knowing which stage you're in changes what "compliant" actually means today.

  • August 2024: Entry into force

The Regulation becomes law. This is the date that starts every deadline that follows, even though nothing visibly changes yet.

  • February 2025: Prohibited practices and AI literacy

Already in force. Unacceptable-risk AI uses are banned outright, and staff AI-literacy obligations begin. If your organisation hasn't addressed either of these, you're already behind, not early.

  • August 2025: General-purpose AI and governance

Also already in force. Obligations for the providers of general-purpose models (think foundation model vendors) apply, along with the wider governance and penalty framework.

  • August 2026: High-risk deployer obligations

This is the wave that lands on you, not just your AI vendor. Human oversight, logging, transparency, data governance, the majority of the Act's practical weight falls here, and it applies to deployers of high-risk systems under Annex III. On a normal enterprise procurement and rollout timeline, "August 2026" is effectively now.

  • August 2027: Full applicability

High-risk systems embedded in regulated products come fully into scope. The Act reaches complete effect.

Two waves in force, two to go, and the one in the middle of that list is the one worth losing sleep over.

Why deployer obligations catch people off guard

Most legal summaries of the Act focus on the providers, the companies building foundation models. That's a reasonable place to start, but it quietly leaves out the obligations that land on you, the organisation actually running AI in production.

If you deploy a high-risk AI system, you inherit obligations regardless of who built the underlying model. Six of them show up operationally, again and again:

Human oversight: A person must be able to intervene, override or shut the system down. Built in, not bolted on.

Fundamental rights impact assessment: Required for public bodies and providers of essential services, and it has to be a living document, not a one-time checkbox.

Logging and traceability: Every output must be reconstructable: the prompt, the retrieved context, the model used, the response given.

Data governance: If a vendor "handles that," you still need to prove you evaluated it.

Transparency: Users need to know they're talking to AI. Chatbots self-identify, AI-produced documents get labelled.

Cybersecurity: Resilience against adversarial input, including prompt injection, has to be part of your testing, not an afterthought.

What this means for your next 90 days

You don't need a transformation programme to get ahead of this, but you do need to move with intent. There are three steps that you need to follow:

Assess: Map your current and planned AI usage against the six deployer obligations above. Nine times out of ten, the gap is logging and traceability.

Interrogate your vendors: Ask where inference happens, whether your data trains their models, and what an audit trace actually looks like. If they can't show you, "the cloud" is not an answer your legal team can defend.

Pilot under real conditions: Not a sandboxed proof of concept, but one use case shipped against your actual obligations, on your actual content.

Organisations already running sovereign, glass-box AI architectures aren't scrambling for August 2026, they built the logging, the audit trail and the human-oversight paths in from the start, because those things are hard to add later. It's worth reading how that plays out at the architecture level in our breakdown of hosting and sovereignty, and what "EU AI Act aligned" actually requires when you go looking for it.

If you're specifically responsible for citizen- or customer-facing AI, the same obligations apply with an extra layer of public scrutiny, our Trusted Answers page shows what a deployment built around source citations and human hand-off looks like in practice, and this is the same pattern EPSO and Pidpa run in production today.

For the fuller picture, what sovereignty actually means once the Act lands, and the fifteen questions to run past any AI vendor before you sign, read more here: AI sovereignty: a CIO's procurement guide for the EU AI Act →

Where Dropsolid AI fits in this

Dropsolid AI is a Drupal-native, EU-sovereign platform, built by the Drupal Diamond Partner behind the EPSO and Pidpa deployments referenced above. That's not a claim we're asking you to take on faith, it's the same evidence-over-assurance standard this post has been arguing for throughout: named regions, a governed model gateway you can inspect, and an audit trace on every interaction, not just a badge on a homepage.

If you're mapping your own AI estate against the six deployer obligations, or scoping what a compliant pilot looks like before August 2026, that's exactly the conversation worth having now.

Talk to our team about where your current systems stand, or book a demo to see the sovereignty and audit-trail architecture in practice rather than in a slide.