Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

EU AI Act obligations for high risk AI embedded in regulated products apply by 2 August 2027

2 August 2027

By 2 August 2027, providers of artificial intelligence (AI) systems that function as safety components within products already subject to EU product legislation must comply with new requirements under Regulation (EU) 2024/1689. This deadline necessitates a thorough inventory of all such AI systems and the commencement of extensive preparatory work. Organisations must ensure their high risk AI systems meet conformity assessment, technical documentation, and post market monitoring standards.

Providers of AI systems acting as safety components in products already regulated by EU product legislation face a significant compliance deadline. Article 6(1) of Regulation (EU) 2024/1689 classifies these as high risk AI systems, mandating strict adherence to the AI Act. This requires organisations to establish robust quality management systems, conduct conformity assessments, and compile comprehensive technical documentation for each identified high risk AI system.

Organisations must also implement post market monitoring systems to continuously evaluate the performance and safety of their AI systems once deployed. This proactive approach ensures ongoing compliance and allows for prompt identification and mitigation of any emerging risks. The work involved in achieving compliance, particularly for conformity assessment and technical documentation, is substantial and requires immediate attention to avoid non compliance penalties.

Evidence of compliance will include detailed records of risk management, data governance, human oversight measures, and cybersecurity provisions. Authorities will expect to see a clear audit trail demonstrating how each high risk AI system meets the essential requirements of the AI Act before the 2 August 2027 deadline.

Regulation (EU) 2024/1689 Article 6(1) and Article 113 sets 2 August 2027 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.

Regulation (EU) 2024/1689 Article 6(1) and Article 113

Who this binds
Providers of AI systems that are safety components of products already covered by EU product legislation
What changed
What is fixed is the date the obligation begins to apply: 2 August 2027, when the remaining high risk classification route under Article 6(1) becomes applicable, extending the full high risk regime to AI inside regulated products
What to check
Inventory any AI acting as a safety component now. Conformity assessment, technical documentation and post market monitoring take longer than the runway suggests
What this does not mean
This is a date in the diary, not a new obligation published today. Nothing in force changed this morning.

Send this to your team

Providers of AI systems that are safety components of products already covered by EU product legislation must ensure compliance with the EU AI Act by 2 August 2027, requiring extensive preparatory work on conformity assessment and documentation.

Today's question

An organisation develops an AI system that functions as a safety component within a product already subject to EU product legislation. Under the AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), from what date must its high risk AI system meet the requirements on conformity assessment, technical documentation and post market monitoring?

  1. 2 August 2028
  2. 2 August 2027
  3. 2 August 2026
  4. 2 December 2027

Answer this question on the site

Worth knowing

  1. Modernizing Medicine agrees to USD 3 million data breach settlement

    Healthcare providers should care about Modernizing Medicine's USD 3 million settlement for a data breach because it demonstrates the financial penalties for failing to protect patient data under HIPAA.

  2. Ambry Genetics pays USD 700,000 penalty for HIPAA violations

    Organisations handling protected health information should be aware of the USD 700,000 penalty paid by Ambry Genetics, reinforcing the ongoing enforcement of HIPAA regulations.

  3. How a UK ruling shapes DSAR compliance

    UK privacy professionals should note that this High Court decision clarifies the boundaries of data subject access requests and the expectations for organisations responding to them.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.