On 2 August 2026, the next key stage in the application of Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, known as the EU AI Act, will begin. From this date, the Regulation enters its main phase of application, making it increasingly important for organizations to demonstrate that they manage the risks associated with the use, development or provision of AI systems.
The regime for providers of general-purpose AI models (GPAI models) is of particular importance. The obligations for providers of such models began to apply on 2 August 2025 for models placed on the market after that date. From 2 August 2026, however, the European Commission will have the power to supervise compliance and impose penalties in cases of non-compliance with these requirements.

What does this mean for organizations?
The EU AI Act introduces a phased application of requirements. Some rules are already in force, including the provisions on prohibited AI practices and the requirement for AI literacy. From 2 August 2026, the enforcement powers of the European Commission and the relevant national competent authorities will become fully applicable, together with the transparency obligations under Article 50 — including informing users when they are interacting with an AI system and labelling AI-generated content — as well as the national penalty regime.
The obligations for high-risk AI systems under Annex III have been postponed until 2 December 2027 under the recent Digital Omnibus amendments to the AI Act, while the obligations for high-risk AI systems embedded in regulated products under Annex I have been postponed until 2 August 2028.
For providers of GPAI models, the requirements include technical documentation, a policy to comply with copyright law, and a public summary of the content used for training the model. Additional requirements apply to GPAI models with systemic risk, including risk assessment and mitigation, reporting of serious incidents and cybersecurity measures.
For organizations that do not develop their own AI models but use AI systems in their activities, the date is also important. Companies should identify which AI tools they use, in which processes they are applied, what data they process, whether any of the systems fall within the scope of high-risk AI systems, and what contractual, technical and organizational measures are required.

What actions are recommended before 2 August 2026?
Organizations should review the AI systems they use and prepare a register of AI applications. They need to determine their role under the Regulation (EU) 2024/1689 — provider, deployer, importer, distributor or another operator. They should also assess whether the AI systems they use fall into the category of high-risk systems and what evidence will be required to demonstrate compliance.
A practical approach also includes introducing internal rules for the use of AI, training employees, assessing risks, reviewing contracts with AI solution providers and preparing the necessary documentation. For organizations that already maintain management systems according to ISO 9001, ISO/IEC 27001, ISO/IEC 27701 or ISO/IEC 42001, some of these requirements can be integrated into existing processes for risk management, information security, personal data protection and supplier control.

CONSEJO supports organizations in preparing for the requirements of Regulation (EU) 2024/1689 through applicability analysis, identification of AI systems, risk assessment, development of internal rules and integration of the requirements into existing management systems.

Timely preparation is essential. 25 days remain until 2 August 2026 — a period in which organizations can take the first and most important step: establishing where, how and with what level of risk they use artificial intelligence.