The EU AI Act’s high-risk rules become enforceable on August 2, 2026 — and they reach further than most SMBs assume.
On August 2, 2026, the majority of the EU AI Act’s obligations — including the full high-risk regime in Annex III — become enforceable, with fines up to €35M or 7% of global turnover. Hiring, credit, and access-to-services workflows are squarely in scope.
The EU AI Act has been phasing in since August 2024. The date that matters for operators is August 2, 2026, when the European Commission’s official implementation timeline confirms that “enforcement of the AI Act starts at national and EU level” for the bulk of its provisions — including the full obligations for high-risk systems listed in Annex III.
Annex III is broader than the term “high-risk” suggests. It covers AI used in employment and worker management (résumé screening, performance tooling), creditworthiness assessment, biometric categorization, and access to essential services. A 40-person company that quietly added an AI hiring filter is closer to scope than it realizes. Penalties run up to €35 million or 7% of global annual turnover, whichever is higher.
The practical read for non-EU operators
The Act applies based on where outputs are used, not only where you are incorporated. If your AI touches EU residents — candidates, customers, users — the obligations can reach you. The cheap move is to inventory now which of your AI uses land in Annex III categories, while it is a planning exercise rather than an enforcement one.