The EU AI Act in 2026 starts with the system you actually operate

The EU AI Act changed again five days before its broad application date. Regulation (EU) 2026/1744, the AI Omnibus, entered into force on 27 July 2026 and amended the timetable and several duties in the original Regulation (EU) 2024/1689.

That sequence explains why a slide saying “the AI Act applies in August 2026” is both true and insufficient. Different rules apply to different practices, actors, and systems. The useful starting point is one deployed AI system with a named intended purpose.

This operational framework turns classification and obligations into system-level decisions, evidence, and accountable ownership, including systems that affect people, employment, access to services, safety, or fundamental rights.

Four dates now shape the implementation plan

The current Commission implementation material identifies four main stages.

The Commission's current AI-literacy questions and answers say providers and deployers must take measures to support staff literacy, while the amended text prescribes no single level every person must attain. That makes context central. A finance approver, an event-production manager, and an engineer administering model routes face different failure modes.

Dates alone cannot classify a system. They tell the team when a rule may apply after scope, role, and category have been established.

Classify the intended purpose before choosing controls

The AI Act is risk-based, but “our vendor uses a powerful model” is not a risk classification. For many AI-system duties, the intended purpose and actual use matter.

A general writing assistant and a system ranking job applicants may use the same upstream model. Their legal analysis differs because the second use concerns employment decisions listed in Annex III. Adding a human approval screen can support oversight. It does not automatically move an employment system out of a high-risk category.

Start with a plain operating statement:

This system prepares a daily internal brief from approved project records for named production managers. It can identify conflicts and prepare a draft. It cannot rank workers, decide employment terms, send external communication, or change production records in this release.

That sentence gives legal, operational, and technical owners something they can test. A broad label such as “AI copilot” does not.

Use the official AI Act Compliance Checker as an orientation tool, then record the assumptions behind its result. The Commission positions the beta tool as orientation support rather than an official assessment.

Assign the operator role for each system

The Act allocates duties across actors. A company can be a deployer for one system and a provider for another.

• A provider develops an AI system or model, or has one developed, and places it on the market or puts it into service under its name or trademark.
• A deployer uses an AI system under its authority, outside personal non-professional activity.
• Importers, distributors, product manufacturers, and authorized representatives can have their own duties.
• A company that rebrands or substantially modifies certain high-risk systems, or changes an intended purpose so a system becomes high-risk, can acquire provider responsibilities under Article 25.

Contract language helps allocate work between parties, but it cannot simply erase a statutory role. Record who selects the purpose, who controls the release, whose name appears on the system, who changes it, and who operates it.

Compsia designs and operates custom production systems. Depending on the exact system, contract, branding, and use, Compsia and the customer may hold different roles. Skybridge being an included platform component settles none of those legal questions by itself.

Build a six-field AI system record

An enterprise inventory becomes useful when the system is its basic unit. A subscription list cannot show what the system does or who it affects.

Keep the legal classification next to the operating facts that support it. A spreadsheet row saying “low risk” becomes stale quietly. A record naming the intended purpose, version, users, and actions exposes the change that requires review.

What Skybridge taught us about evidence

While building Skybridge, we learned that product-level descriptions age faster than release evidence.

The platform has separate development and production environments, manual production promotion, per-workspace data boundaries, model routing, connector scopes, agent traces, approval records, and a changelog for material changes. Together, these controls form the accountability evidence for each released system and its assigned AI Act duties.

The Skybridge system card and production cockpit connect retrieval scope, approval evidence, retention, export, deletion, and recovery to the exact released system. This keeps every public claim anchored to system-specific proof.

The same discipline applies to legal classification. Record the current conclusion, who reviewed it, the facts it depends on, and which change would reopen it.

A practical 30-day starting plan

During the first week, identify every AI system used or being built. Include embedded features, departmental tools, internal automations, and systems bought through a larger SaaS contract.

During the second week, write the intended-purpose statement and assign provisional operator roles. Screen every use against Article 5 prohibited practices, Article 6 and Annex III high-risk categories, Article 50 transparency duties, and the separate GPAI track.

During the third week, identify immediate gaps. These may include AI interaction disclosure, staff literacy measures, a missing provider record, unclear authority over an agent action, or a use case that requires enhanced legal review.

During the fourth week, attach evidence and an owner. Set a review trigger for a new model, source, action, audience, purpose, or supplier. A classification with no change process is a photograph of a moving machine.

Compsia uses a production perimeter to make that work concrete. The customer and delivery team define one result, its people, data, actions, tests, and limits before release. The AI governance guide explains how those decisions can move from policy into operation.

Questions leaders ask about the EU AI Act

Does the EU AI Act apply to every business using AI?

The Act has a broad scope, including some providers and deployers outside the EU when the legal scope conditions are met. The duties vary by actor, system, and use. Research and prototyping before market release also receive specific treatment. Assess the exact activity rather than relying on company size or vendor location alone.

Is every generative AI system high-risk?

No. General-purpose models have a separate regulatory track, and an AI system's category often depends on its intended purpose. A generative model integrated into an Annex III employment use may participate in a high-risk system, while a different use may face transparency or other duties.

Can a vendor certify that our use is compliant?

A vendor can provide documentation and controls relevant to its component. The deploying organization still needs to assess its own purpose, configuration, data, users, and operating duties. No single platform badge decides the complete system.