When does the EU AI Act come into force for high-risk AI systems?
The answer
EU AI Act rules for Annex III high-risk AI systems apply from December 2, 2027. High-risk categories include AI used in credit decisions, employment, healthcare, law enforcement, and essential services. If your AI touches any of these areas, you need governance infrastructure in place before that date. Not a policy document. Working technical controls that produce audit trails.
Source: SynthesisArc, 2026
The full picture
The EU AI Act rolled out in phases. Prohibited AI practices (social scoring, manipulative AI) are already banned. Transparency requirements for general-purpose AI models took effect in August 2025. On August 2, 2026, Article 50 transparency rules started to apply, and EU and national enforcement began for general-purpose AI models, prohibitions, transparency rules, and AI literacy. The Annex III extension does not postpone those obligations. The rules for Annex III high-risk AI systems apply from December 2, 2027, after the Digital Omnibus on AI, in force since July 27, 2026, extended the original deadline. High-risk AI embedded in products covered by Annex I, such as medical devices, follows from August 2, 2028.
High-risk AI includes any system that makes or substantially influences decisions about: credit and lending, employment and recruitment, healthcare treatment, law enforcement, essential public services, and education. If your AI system touches any of these categories, determine whether it falls within Annex III (December 2, 2027) or the Annex I product-safety route (August 2, 2028) before setting its compliance deadline.
What compliance looks like in practice: every high-risk AI decision must be logged with full data lineage. The system must be explainable: you need to be able to tell an affected individual why the AI made the decision it made. Human oversight must be built in. Risk management must be documented. And the system must be registered in the EU AI database.
The companies that start governance work now have time to build it correctly. The companies that wait until shortly before their applicable deadline risk scrambling, cutting corners, and hoping the regulators start slow. That is not a strategy. SynthesisArc's Claude Guard produces the documentation, audit trails, and governance controls the Act requires.
Key terminology
Apply this thinking
The SynthesisArc products that put this into production.
Go deeper
Field Notes on this topic.
Ready to put this into production?
