The EU AI Act's new dates for non-EU suppliers.

If you build or sell AI from outside the EU and its output is used in the EU, the AI Act can apply to you, and its timetable changed in July 2026. Regulation (EU) 2026/1744, which came into force on 27 July 2026, moved the high-risk obligations for the uses listed in Annex III to 2 December 2027, and those for AI in products covered by Annex I to 2 August 2028. Article 50’s transparency duties kept their date: they have applied since 2 August 2026, though systems already on the market have until 2 December 2026 to mark generated content.

This post sets out the dates as at October 2026, who the Act reaches, and what a supplier outside the EU can do now. It isn’t legal advice. The dates have moved once and could move again, so check the European Commission’s AI Act page and the consolidated text before you rely on one.

Does the Act reach a supplier outside the EU?

It can. Article 2 applies the Act to providers that place AI systems on the EU market or put them into service there, “irrespective of whether those providers are established or located within the Union or in a third country”. Its point (c) goes further. It covers providers and deployers established or located outside the EU “where the output produced by the AI system is used in the Union”. A system can run entirely outside the EU and still be in scope because of where its output is used.

Article 3 defines the two roles that matter most. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority. Whose name a system goes out under is central to which role a supplier holds, so record the roles in the contract for each system.

What changed in July 2026?

Regulation (EU) 2026/1744 amended the AI Act, Regulation (EU) 2024/1689, which came into force on 1 August 2024. As amended, the main dates are:

• 2 February 2025: The prohibited practices in Article 5, and the AI literacy duty in Article 4.
• 2 August 2025: Obligations for general-purpose AI models.
• 2 August 2026: The Act’s general date of application, including Article 50’s transparency duties.
• 2 December 2026: Further prohibited practices added to Article 5 in July 2026, and the end of a grace period for marking AI-generated content on systems placed on the market before 2 August 2026.
• 2 December 2027: High-risk obligations for the uses listed in Annex III.
• 2 August 2028: High-risk obligations for AI in products covered by Annex I.
• 2 August 2030: The deadline for high-risk systems intended for use by public authorities that were placed on the market before the high-risk rules applied to them.

Articles 111 and 113 of the consolidated text set these dates.

Which uses become high-risk on 2 December 2027?

Annex III lists them. Among its categories:

• in education: admission or assignment to institutions, evaluating learning outcomes, including when they are used to steer learning, assessing the appropriate level of education a person will receive or be able to access, and monitoring prohibited behaviour during tests (point 3);
• eligibility for essential public assistance benefits and services, including healthcare services, assessed by or for public authorities (point 5(a));
• evaluating the creditworthiness of individuals or setting their credit score, other than to detect financial fraud (point 5(b));
• risk assessment and pricing in life and health insurance (point 5(c));
• emergency healthcare patient triage (point 5(d));
• helping a judicial authority, or alternative dispute resolution, research and interpret facts and the law (point 8(a)).

Whether a particular system falls in a category, or an exception applies, is a question for your lawyer.

From that date, Article 26 requires deployers of high-risk systems, among other things, to assign human oversight to people with the necessary competence, keep input data relevant where they control it, monitor the system, keep its logs for at least six months, unless other law sets a different period, and inform workers and the people it affects. Under Article 27, public bodies, private bodies providing public services, and deployers of credit-scoring and life and health insurance systems must also assess a high-risk system’s impact on fundamental rights before first use. Systems for critical infrastructure are excluded, and the assessment can draw on an existing data protection impact assessment.

What applies now?

Article 50 has applied since 2 August 2026. Among its duties:

• people interacting with an AI system must be told so, unless that is obvious;
• providers of systems that generate synthetic content, including text, must mark the output in a machine-readable form that can be detected as AI-generated, using marking that is effective, interoperable, robust and reliable as far as that is technically feasible; systems placed on the market before 2 August 2026 have until 2 December 2026 to do this;
• a deployer that publishes AI-generated text to inform the public on matters of public interest must disclose it, unless the text has had human review or editorial control and someone holds editorial responsibility for it.

The prohibited practices in Article 5 have applied since 2 February 2025, and the July 2026 amendment adds further practices from 2 December 2026. Read the consolidated Article 5 for the current list.

What does Article 4 ask now?

Article 4 was amended. As amended, providers and deployers “shall take measures to support the development of AI literacy” of their staff, and it says that this obligation doesn’t require them to guarantee any specific level of AI literacy of any individual. The duty itself has applied since 2 February 2025. For a supplier, training records and written use policies are useful evidence when a client asks what was done.

What can a supplier outside the EU do now?

1. List the systems whose output is used in the EU. Point (c) of Article 2 turns on where the output is used, not where the system runs.
2. Agree the roles in writing. For each system, record who is the provider and who is the deployer.
3. Check each system against Annex III before December 2027, and against Annex I if it is, or is part of, a regulated product.
4. Build Article 50 in now. Tell users when they are dealing with AI, and mark generated content where your system creates it.
5. Plan for a representative if you’ll provide high-risk AI. Article 22 requires a provider established outside the EU to appoint an authorised representative in the EU, by written mandate, before making a high-risk system available on the EU market.
6. Keep the evidence. Test results, logs and change records for each system help your clients meet their own duties under Article 26.
7. Diarise a review. Check the consolidated text again before you rely on any date here.

If your system also handles personal data from the EU, the GDPR’s transfer rules are a separate question: see offshore AI suppliers and data in your region.