Postponed is not the same as cancelled.

The heaviest AI obligations moved to December 2027. Your duty of confidentiality did not — and a log cannot be created after the fact.

In plain words

In the summer of 2026 Europe decided to postpone the heaviest obligations for high-risk AI: they now apply from 2 December 2027. We say that plainly here, even though a postponement is bad news for anyone selling something like this.

Three things were not postponed. What your clients ask you today. The duties you already had — professional secrecy, data protection law, contractual promises. And the simplest of the three: a log only exists if it was already there at the time. Waiting does not cost you a fine; it costs you the ability to show anything about the period you spent waiting.

What applies when

The dates of the AI Act as they stand after the 2026 postponement.

  1. 1 August 2024 — in force

    The AI Act starts to apply, in stages. Each part has its own date.

  2. 2 February 2025 — prohibitions and know-how

    Prohibited uses apply. Organisations must make sure their people understand enough about AI to use it responsibly.

  3. 2 August 2025 — large models and supervision

    Rules for large general-purpose AI models, plus supervisory authorities and the power to fine.

  4. 2 August 2026 — transparency, and it applies now

    People must be able to know they are dealing with AI, and AI-generated material must be recognisable as such. This part was not postponed.

  5. 2 December 2026 — existing systems too

    The same transparency duty for systems that were already in use, plus two new prohibitions.

  6. 2 December 2027 — this is where the logging duties sit

    The heavy requirements for high-risk systems under Annex III. The system must record its own events (Art. 12), the provider keeps those logs (Art. 19), and the organisation using the system keeps logs as well (Art. 26(6)). This used to be 2 August 2026; it was postponed by an amending package (Regulation (EU) 2026/1744), published on 24 July 2026.

  7. 2 August 2028 — embedded AI

    The same heavy requirements for AI built into regulated products, such as medical devices and machinery (Annex I).

What was not postponed

Four things that wait for no European date.

  1. Your professional secrecyIt applies in full, including when you use AI. No date changes that.no postponement
  2. Data protection lawAccess, erasure, retention periods: the GDPR has applied for years and does not wait for an AI date.no postponement
  3. What your client asksVendor assessments — often from a DORA or NIS2 context — already ask how you use AI and where the data goes.happening now
  4. What you can no longer recoverFor the months in which you recorded nothing, you can show nothing later. That is not a rule, it is arithmetic.irreversible
Three questions already being asked
In a vendor assessment

Which AI do you use, and where does our data go?

A bank, government body or large client asks this in a questionnaire, with a due date. A data processing agreement from your AI vendor is a promise; what they want is a list plus evidence.

A questionnaire, not a conversation.

After an incident

Which of our files did your AI actually see?

This is the first question after any leak. Your recollection is not an answer, and a chat history at a vendor is not a log you control.

Within days, not weeks.

When a finding is disputed

Can you show this was not changed afterwards?

Without a record made at the time, it is your word against theirs. A third party who recomputes it only exists if there is something to recompute.

Cannot be fixed in hindsight.

Why waiting costs something

A log records what happened at the moment it happened. The six months you let pass now cannot be put back into it later. So when the obligations apply in December 2027, the question is not whether you have a system by then — the question is which period you can show anything about.

Read on: legal & complianceRead on: the log and checking it

This page describes the state of the rules as we understand them, not your situation, and it is not legal advice. It refers to the European AI Act (Regulation (EU) 2024/1689) and the amending package (Regulation (EU) 2026/1744, published 24 July 2026). Last checked: September 2026. Come across a word you do not know? See the glossary.

Want to know where you stand today?

Take the AI scan15 questions · result in your browser