EU AI Act: What Actually Applies on 2 August 2026 — A Practical Compliance Checklist for Companies Building or Outsourcing AI

On 2 August 2026 the AI Office's enforcement powers on general-purpose AI models become fully operable, while the high-risk Annex III obligations are deferred to 2 December 2027 under the provisional Digital Omnibus agreement. A factual checklist for mid-market companies building or outsourcing AI agents. Not legal advice.

CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai

EU AI Act: What Actually Applies on 2 August 2026 — A Practical Compliance Checklist for Companies Building or Outsourcing AI

A milestone date and a deferred milestone, in the same week

The 2 August 2026 milestone in the EU Artificial Intelligence Act has, for most of 2025 and early 2026, been treated by the trade press as a single hard deadline. The reality in mid-2026 is more nuanced, and the nuance matters for any company building or outsourcing AI features. Two facts to anchor the rest of this article:

• On **2 August 2026**, per the **European Commission** Digital Strategy pages (digital-strategy.ec.europa.eu, "AI Act"), the **enforcement powers of the AI Office over general-purpose AI (GPAI) models become fully operable**. The AI Office acquires the authority to request information, to conduct evaluations and to impose fines on providers of GPAI models that fail to meet their obligations. The transparency obligations applicable to GPAI providers apply.
• On **7 May 2026**, a **provisional political agreement** referred to as the **Digital Omnibus** was reached among EU institutions, deferring the application of obligations for **high-risk AI systems listed in Annex III** of the AI Act from the original **2 August 2026** date to **2 December 2027**. The agreement is documented by **Gibson Dunn** ("EU AI Act Omnibus Agreement," 7 May 2026) and by **artificialintelligenceact.eu**.

This is not legal advice. Final legal application depends on the published Official Journal text, on implementing acts and on member-state guidance. The intent of this article is to give an engineering and procurement leader a factual reading of what applies on 2 August 2026 and what does not, and a practical operating checklist for the year ahead.

We discuss the operational and political adjacency of this work — including the resilient nearshore delivery model that supports it — in our companion piece on the <a href="/en/blog/us-call-center-reshoring-bills-nearshore-morocco-alternative-2026">US call-center reshoring bills and the nearshore middle path</a>.

What actually applies on 2 August 2026

On the basis of the European Commission Digital Strategy pages and the Gibson Dunn Digital Omnibus analysis, the operative items on 2 August 2026 for a company building or deploying AI in the EU are the following.

• **AI Office enforcement on GPAI providers becomes fully operable.** The AI Office can request technical documentation from providers of general-purpose AI models, can require co-operation in evaluations, and can impose administrative fines for non-compliance under the schedule set in the Act. Penalties for the most serious breaches are capped at the higher of thirty-five million euros or seven percent of global annual turnover.
• **GPAI transparency obligations apply.** Providers of general-purpose AI models must make available the technical documentation of the model, must provide downstream deployers with the information needed for those deployers to meet their own obligations, must put in place a policy to comply with EU copyright law, and must publish a sufficiently detailed summary of the training data used. The AI Office has published a template for the training-data summary.
• **Transparency obligations on AI-generated content apply.** Providers and deployers must label AI-generated or AI-manipulated content (including text published to inform the public on matters of public interest, audio, image and video) in a way that is detectable as artificially generated, with limited exceptions.
• **Governance and member-state implementation milestones land.** Member states must have designated competent authorities and must have set out their national penalty regimes. The European AI Board, the Scientific Panel and the Advisory Forum operate under the Act's governance architecture.

What is deferred under the Digital Omnibus

Per the **Gibson Dunn** analysis of the 7 May 2026 provisional agreement and tracking by **artificialintelligenceact.eu**, the principal deferral concerns **high-risk AI systems listed in Annex III**. Annex III covers, among other categories, AI systems used in employment and worker management, in education and vocational training, in essential private and public services (including credit-scoring and access to public benefits), in law enforcement, in migration and border control, and in the administration of justice and democratic processes.

Under the provisional agreement, the obligations applicable to providers and deployers of Annex III high-risk systems — including the risk-management system, the data-governance requirements, the technical documentation, the record-keeping, the transparency obligations to deployers, the human oversight measures, the accuracy, robustness and cybersecurity requirements, and the post-market monitoring — would apply from **2 December 2027** instead of 2 August 2026.

Two important qualifications. First, the agreement is provisional as of late June 2026; the final text, the formal trilogue conclusion and the Official Journal publication remain pending. Second, the deferral does not affect the GPAI obligations, the prohibitions on the practices listed in Article 5 (already in force since February 2025), or the AI Office's enforcement powers, all of which proceed on the original calendar.

The practical operating consequence: a mid-market company that is building or deploying an AI agent that is *not* an Annex III high-risk system has, on 2 August 2026, *fewer* applicable obligations than the press cycle in 2025 suggested. A company that *is* building or deploying an Annex III high-risk system has roughly sixteen extra months to operationalize the controls — but should treat that calendar as an implementation budget, not as a reason to defer the work.

A practical compliance checklist for mid-market companies

This checklist is engineering-and-procurement oriented. It is not legal advice. It is the operating program a competent in-house technical lead, working with external counsel, would put in place in the second half of 2026 for a company that is building, deploying or outsourcing AI features in the EU.

• **Inventory every AI system in scope.** A documented register that lists each AI feature, the model or models behind it, the provider (internal or external), the deployer, the data used at training and at inference, the intended purpose, the EU market on which it is deployed, and a preliminary classification (GPAI, high-risk Annex III, limited-risk, minimal-risk). Without this inventory, no other control is operable.
• **Confirm the classification per system.** For each entry, the classification under the AI Act drives the obligation set. The classification work — particularly the Annex III determination — should be done by a competent legal-and-technical pairing, documented, dated and re-reviewed on material change.
• **Build the technical documentation per model.** For internally-developed models, particularly GPAI, the technical documentation required by the Act (architecture, training data summary using the AI Office template, evaluation methodology, known limitations, intended use, foreseeable misuse). For third-party models, the equivalent documentation requested from the provider under the Act's downstream-flow obligations.
• **Publish the training-data summary.** Use the AI Office template. For providers of GPAI models, this is required from 2 August 2026.
• **Document the EU copyright compliance policy.** A published policy describing how training data is sourced consistently with EU copyright law, including the procedure for handling rights-reservation signals.
• **Implement the AI-generated content transparency.** Machine-readable labelling on AI-generated or AI-manipulated audio, image, video and synthetic text within the scope of the Act. The technical implementation typically uses content provenance standards such as C2PA, with a documented exception list for the limited cases where the Act allows it.
• **Map the obligations to downstream deployers under contract.** For any AI system you provide to another business that integrates it, the contractual flow-down of the information the deployer needs to meet its own obligations. For any AI system you deploy from a third party, the contractual flow-up that requires the provider to deliver that information on time.
• **Operate human oversight where the system is high-risk under Annex III.** Documented oversight design, qualified human reviewers, escalation paths, override capability, and the audit trail proving the oversight ran. Even with the Annex III deferral to 2 December 2027, the engineering work is materially harder than the calendar suggests; start the build now.
• **Operate the risk-management system continuously.** Risk identification, risk evaluation, risk mitigation, residual-risk acceptance, post-market monitoring, incident reporting. Not a one-off document; an operating discipline.
• **Choose a development partner that integrates compliance by design.** When the AI feature is outsourced, the documentation, the transparency labelling, the training-data summary, the copyright policy and the deployer flow-up cannot be retrofitted at delivery without rework. The partner has to operate the controls during build. This is a procurement clause, not an aspiration.

What outsourced AI development should look like under the Act

For a buyer that is outsourcing the build of an AI agent, an LLM-based product feature or an internal copilot, the operating model that holds up under the AI Act in mid-2026 has six characteristics. Each is verifiable in procurement.

• **Per-feature documentation produced during development**, not after delivery. The technical documentation lands in the repository as the feature lands; the training-data summary is produced from the actual training run; the evaluation methodology runs in CI alongside the unit and integration tests.
• **Provenance signals end to end.** When the system produces AI-generated content, the content carries the provenance metadata required for transparency labelling from the model output forward, not bolted on at the UI layer.
• **An auditable record of dataset sources and copyright posture.** Every dataset used in training carries the source, the licence, the rights-reservation handling and the inclusion decision. The artefact is a queryable dataset registry, not a slide.
• **A documented downstream-deployer information pack.** Whatever the buyer needs to provide to its own deployers, the supplier produces in the same format under contract.
• **A security and DevSecOps baseline that meets the AI Act's accuracy, robustness and cybersecurity requirements.** SBOM, secrets management, hardened CI, peer review, signed artefacts, KEV monitoring. The same controls that defend the build pipeline defend the AI system.
• **A delivery footprint that is cost-defensible at the volume of documentation the Act requires.** The compliance overhead is real; an onshore-only delivery model at Western European day rates makes it unaffordable for mid-market buyers, which is why nearshore delivery is structurally suited to this workload.

A buyer who can ask a development supplier these six questions and receive concrete answers — with examples — has a partner whose operating model already absorbs the Act. A buyer who receives a deck instead has a marketing response.

How Call IT Dev is positioned for the 2 August 2026 milestone

Our practical role for mid-market buyers in the second half of 2026 is twofold. On the build side, our <a href="/en/services/software-development">software development</a> and <a href="/en/services/ai-automation">AI automation</a> pods integrate the technical documentation, training-data summary, provenance labelling and DevSecOps controls into the standard delivery shape, on the same loaded rate. On the assurance side, our <a href="/en/services/cybersecurity">cybersecurity</a> practice handles the accuracy, robustness, secrets management and KEV monitoring requirements the Act folds into high-risk system obligations.

Delivered nearshore from Casablanca and Rabat on Central European Time, two hours by flight from Frankfurt, with native English and French and growing Spanish, German and Arabic coverage, the cost basis lets a mid-market buyer afford the compliance overhead the Act requires without the documentation work becoming the dominant line item. The economic and geographic context for buyers comparing options is documented in <a href="/en/why-morocco">Why Morocco</a>.

The bottom line

On 2 August 2026, the AI Office's enforcement powers on GPAI providers become fully operable and the transparency obligations apply. The high-risk Annex III obligations are, under the provisional Digital Omnibus agreement of 7 May 2026, deferred to 2 December 2027. A company building or outsourcing AI features in the EU should treat 2 August 2026 as a real milestone that materially reduces ambiguity about GPAI obligations, and should treat the Annex III deferral as an implementation budget rather than a reason to wait. The buyers who write the compliance posture into the procurement contract — documentation produced during build, provenance end to end, dataset registry, downstream-deployer information pack, DevSecOps baseline — will, in 2027, find out they are not exposed. The buyers who do not, will find out the other way.

This article is informational and is not legal advice. Confirm the application of the AI Act to your specific system with qualified counsel in your jurisdiction.

${CTA_AI_ACT}

**Sources:** European Commission, Digital Strategy pages on the AI Act (digital-strategy.ec.europa.eu/policies/ai-act); Gibson Dunn, "EU AI Act Omnibus Agreement" (7 May 2026); artificialintelligenceact.eu (independent tracker of the AI Act). This article describes the AI Act and the provisional Digital Omnibus agreement as published as of late June 2026 and is not legal advice.

CALL IT DEV — Software, AI and dedicated tech teams — Casablanca | Madrid | Dubai — contact@callitdev.com — +212-537-373777