The EU AI Act, one obligation at a time. Starting with the ones that already apply.
Regulation (EU) 2024/1689 applies in stages. Prohibitions, AI literacy and Article 50 transparency are in effect today. GhostAudit shows which of your systems each stage reaches, and helps you produce the evidence.
- Applies nowAI literacy measures (Art. 4)
Take measures to support the development of AI literacy of staff and others dealing with AI systems on your behalf. Since the Omnibus (27 Jul 2026) this is a duty to take supporting measures, not to guarantee a level of literacy.
- Applies nowProhibited practices screening (Art. 5)
Screen AI uses in sensitive contexts against the Art. 5 prohibitions (e.g. emotion recognition in the workplace, social scoring, untargeted facial-image scraping).
- Applies nowGeneral-purpose AI model provider obligations
Technical documentation, copyright policy and training-data summary for providers of GPAI models. Deployers of third-party models are not GPAI providers.
- Applies nowTransparency obligations (Art. 50)
Disclose AI interaction to people, label deepfakes and AI-generated text published on matters of public interest; providers must mark synthetic output.
- UpcomingArt. 50(2) marking grace period ends for legacy generative systems
Providers of generative systems placed on the market before 2 Aug 2026 must implement machine-readable marking of output by 2 Dec 2026 – confirm your image/video/audio generation vendors comply. New prohibitions on AI generating non-consensual intimate imagery or CSAM also apply from this date.
- UpcomingHigh-risk systems – Annex III use cases
Stand-alone high-risk uses (employment, credit, education, essential services, biometrics): provider conformity + deployer duties (human oversight, logging, monitoring, FRIA for some deployers).
- UpcomingHigh-risk systems – Annex I (AI in regulated products)
AI that is a safety component of products under EU harmonisation legislation (e.g. medical devices).
- Prohibitions and AI literacy
- Since 2 February 2025
- Article 50 transparency
- Since 2 August 2026
- Annex III high-risk
- From 2 December 2027
- Annex I regulated products
- From 2 August 2028
The timeline changed in 2026. Many summaries have not caught up.
The AI Act entered into force on 1 August 2024 and has applied in phases since. In 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, amended it; that regulation entered into force on 27 July 2026. Two changes matter most for planning:
- The obligations for high-risk systems were postponed: to 2 December 2027 for the stand-alone use cases in Annex III, such as employment, credit scoring, education and essential services, and to 2 August 2028 for AI that is a safety component of products under Annex I.
- The AI literacy duty in Article 4 was softened to a duty to take measures that support the AI literacy of staff.
What did not move: the prohibited practices in Article 5, including social scoring and emotion recognition in the workplace, have applied since 2 February 2025. Obligations for providers of general-purpose AI models have applied since 2 August 2025. And Article 50, the transparency obligations, applies from 2 August 2026.
Penalties reach up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, with lower tiers for other breaches.
First question: which of your systems does it reach?
The Act applies to providers placing AI systems on the EU market wherever they are established, to deployers using AI systems in the EU, and to providers and deployers outside the EU whose AI output is used in the EU. Most companies are deployers for most of their systems: they use AI that someone else built.
What a deployer owes depends on the use, so the starting point is an inventory that records, for each system, what it is used for and who it affects. GhostAudit builds that inventory from discovery and maps each system to the obligation tracks of the Act:
- anything used in a sensitive context is flagged for Article 5 screening;
- systems that interact with customers or generate synthetic media are flagged for Article 50;
- systems used in employment, in consequential decisions or with biometrics are flagged as likely Annex III high-risk.
Each flag shows the attribute that caused it, so you can check the reasoning.
Example workspace. Names and figures are illustrative.
- Vendor
- HireVue
- Owner
- People operations · A. Moreau
- Purpose
- Ranks applicants for customer-support roles against the posted requirements
- Affects
- Job applicants in the EU, New York City and Colorado
- Data
- Restricted · personal data
- Human oversight
- Recruiter reviews every ranked list before contact
- Risk tier
- High
- Last assessed
- 6 Nov 2026 · next review in 90 days
- EU AI Act · Annex III high risk · matched on employment useFrom 2 Dec 2027
- NYC Local Law 144 · matched on employment useIn force
- Colorado SB 26-189 · matched on consequential decisionFrom 1 Jan 2027
Transparency duties apply now.
Article 50 requires that people are informed when they interact with an AI system, that AI-generated content is marked in machine-readable form, and that deepfakes are disclosed. It also covers AI-generated text published on matters of public interest.
One date is still ahead. Providers of generative systems that were already on the market before 2 August 2026 have until 2 December 2026 to implement machine-readable marking of output. If you rely on an image, video or audio generation vendor, this is the moment to confirm that they will meet it.
GhostAudit includes an Article 50 transparency notice template. It works through your inventory, states which systems Article 50 applies to and why, and gives wording for each disclosure. Our guide to Article 50 covers the deployer's side in detail.
- AI acceptable use policyGovernance and policy · whole organizationOrganization-wide rules for selecting and using AI: approved systems, data handling, prohibited uses, risk-tier controls, training and enforcement.Basis: EU AI Act Art. 4, 5, 50; NIST AI RMF GOVERN 1-2; ISO/IEC 42001 A.2, A.9
- EU AI Act Article 50 transparency noticeTransparency and disclosure · selected systemsArticle 50 applicability by system plus approved wording for AI-interaction, AI-generated content, deep-fake and public-interest text disclosures.Basis: EU AI Act Art. 50 (from 2 Aug 2026); Regulation (EU) 2026/1744
Use the time before December 2027.
From 2 December 2027, high-risk Annex III systems need risk management, data governance, logging, human oversight and conformity assessment on the provider's side. Deployers must follow the instructions for use, assign human oversight and monitor operation, and some deployers must carry out a fundamental rights impact assessment.
The postponement is time to prepare, and the preparation is the same work an auditor will ask about: identify your high-risk uses, assess each against the requirements, and close the gaps you find.
GhostAudit's EU AI Act assessment covers the requirements a deployer needs to evidence: Articles 4 and 5, the high-risk requirements in Articles 9 to 15, deployer obligations in Article 26, the impact assessment in Article 27 and Article 50. Each is answered per system, with evidence and a remediation plan.
- Requirement-level assessment per system
- Algorithmic impact assessment template, with FRIA applicability screening
- Gaps tracked to closure, optionally as Jira tickets
Example workspace. Names and figures are illustrative.
| Art. 9 | Risk management systemRisk register v4 | Risk register v4 | Met |
| Art. 10 | Data and data governanceRemediation planned | Remediation planned | Partial |
| Art. 12 | Record-keeping and logsJira GOV-212 | Jira GOV-212 | Gap |
| Art. 13 | Transparency to deployersVendor documentation | Vendor documentation | Met |
| Art. 14 | Human oversightRecruiter review step | Recruiter review step | Met |
| Art. 26 | Deployer obligationsRemediation planned | Remediation planned | Partial |
What you can show when asked.
By working through the Act in GhostAudit you accumulate a file: a current inventory with owners and risk tiers; a record of which obligations apply to which system and why; assessments with evidence per article; approved documents; and an audit log of every decision and change.
None of that is a certificate, and no software can declare you compliant. It is the organized evidence that a market surveillance authority, a customer's procurement team or your own board will ask to see.
| Art.4 | AI literacy measures Take measures to support the development of AI literacy of staff and others operating AI systems on your behalf, appropriate to their role and the context of use (as reworded by Regulation (EU) 2026/1744; no specific literacy level is mandated). |
| Art.5 | No prohibited AI practices Confirm the system does not perform a prohibited practice (e.g. manipulative techniques, social scoring, untargeted facial-image scraping, emotion recognition at work or school). |
| Art.9 | Risk management system Establish, document and maintain a risk management process across the system's lifecycle. |
| Art.10 | Data and data governance Training, validation and test data are relevant, representative, examined for bias and governed appropriately. |
| Art.11 | Technical documentation Maintain technical documentation demonstrating conformity before placing on the market or putting into service. |
| Art.12 | Record-keeping and logging The system automatically records events (logs) sufficient to trace its functioning. |
| Art.13 | Transparency to deployers Instructions for use describe capabilities, limitations, accuracy and required human oversight. |
| Art.14 | Human oversight Natural persons can effectively oversee, interpret, override or stop the system. |
| Art.15 | Accuracy, robustness and cybersecurity Appropriate accuracy levels are declared and the system is resilient to errors and adversarial manipulation. |
| Art.26 | Deployer obligations Use per instructions, assign competent human oversight, monitor operation, keep logs and inform affected workers where applicable. |
| Art.27 | Fundamental rights impact assessment Where required (e.g. public bodies, credit scoring, insurance pricing), assess impacts on fundamental rights before first use. |
| Art.50 | Transparency obligations Inform people they are interacting with AI and mark or disclose AI-generated or manipulated content where required. |
Read the official texts
- EU AI Act: official texteur-lex.europa.eu
- Digital Omnibus on AI: Regulation (EU) 2026/1744 (EUR-Lex)eur-lex.europa.eu
- Cooley: Digital AI Omnibus delays key deadlinescdp.cooley.com
- Cuatrecasas: Digital Omnibus on AI has been publishedcuatrecasas.com
- Article 4 (consolidated text): artificialintelligenceact.euartificialintelligenceact.eu
Dates and statuses on this page were last checked against these sources on 10 November 2026. This is orientation, not legal advice.
Questions
- We are not based in the EU. Does the Act apply?
It can. It applies to providers placing AI systems on the EU market wherever they are established, and to providers and deployers outside the EU whose AI output is used in the EU.
- Were the high-risk obligations delayed?
Yes. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, postponed them to 2 December 2027 for Annex III use cases and 2 August 2028 for Annex I products.
- Does using a third-party model make us a GPAI provider?
No. The general-purpose AI model obligations fall on the providers of those models. Deploying a third-party model does not make you one.
- Does GhostAudit determine whether a system is high-risk?
It flags systems that are likely in scope based on attributes in your inventory, and shows the reason. The legal classification is a judgment for you and your counsel; GhostAudit records it and the reasoning.
See what is in use before you decide anything.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.