THE DUTIES THAT ARE ACTUALLY YOURS
You leave with a written list of the AI your organisation runs, each system classified, and the two or three duties that are genuinely yours today. Most of what you run sits outside the rules for high-risk AI systems, and once that is settled the work you paused can go ahead.
Two failure modes dominate the AI Act market. One is panic: suppliers selling urgency around deadlines that have been postponed, and compliance programmes sized for fear rather than exposure. The other is complacency: reading the postponement as permission to wait. Both are expensive.
Our reading is simpler. Some duties are already in force and carry penalties. Some arrive on a fixed calendar, and that calendar is now settled.
And most of the AI your organisation actually runs is probably not high-risk at all. The Act's risk categories are narrower than the market implies, which means the right response is rarely to stop. It is to know what you have, meet the duties that apply today, and use the runway to prepare for the ones that come.
A supplier who sells you fear of a deadline that moved is telling you something about their business model.
The Act's hardest requirements are not technical. Competence, oversight, accountability and documented judgement are organisational obligations. They are settled in the leadership team, not in a development environment. That is where we work.
If your organisation uses AI, you must take measures to support the AI literacy of the people working with it. AI literacy is the Act's own term for what most people call AI competence. Regulation (EU) 2026/1744 turned this into a duty of effort rather than a guaranteed result, but it still binds, it covers every AI system regardless of risk, and it sits with leadership.
A short list of practices is banned outright, and the list binds every provider and every deployer. Only the ban on real-time remote biometric identification is limited by purpose, to law enforcement. The rest are not: social scoring, untargeted scraping of facial images, emotion recognition in the workplace, and the two the Digital Omnibus added on generated child sexual abuse material and non-consensual intimate images. Checking the list is quick. Assuming it cannot reach you is not the same thing.
People must be told when they are interacting with an AI system, and synthetic content must be identifiable as such. These duties have applied since 2 August 2026. The next milestone on the calendar below is 2 December. The sanctions behind them are not new: the penalty regime has applied since August 2025.
The General Data Protection Regulation (GDPR) is EU law. Most AI questions are still GDPR questions first: legal basis, impact assessments, data flows to model providers. In Sweden, AI governance lands on top of an already tightened environment, not in a vacuum.
High-risk AI systems in defined use areas, among them recruitment, credit scoring, education and essential services, arrive on a fixed runway: risk management, quality management, the fundamental rights impact assessment, and conformity assessment. Product-embedded AI follows later on its own track, and public bodies must have everything they still run in compliance by 2 August 2030.
The fundamental rights impact assessment is where the market's shorthand does most damage. Article 27 names two groups: bodies governed by public law and private entities providing public services, across Annex III apart from critical infrastructure, and every deployer of a creditworthiness or life and health insurance pricing system, commercial ones included. The exemption follows use, not ownership.
The runway is only an advantage if you use it. The GDPR years showed what starting at the deadline costs: when everyone prepares at once, assessors and specialists become the bottleneck, and prices follow.
No harmonised standards under the Act have been published yet. Until then there is no presumption of conformity to lean on, and compliance is demonstrated with your own documentation. Management-system standards are useful, but they are not harmonised standards and give no presumption. Anyone selling you certainty today is selling something the law does not yet contain.
EU AI ACT DEADLINES
Verified against primary sources 10 August 2026
AI literacy duty (art. 4) and prohibited practices (art. 5), all AI systems regardless of risk level
Obligations for general-purpose model providers (ch. V), and the penalty regime (art. 99): up to EUR 35 million or 7 % of global turnover for prohibited practices, EUR 15 million or 3 % for most other infringements, EUR 7.5 million or 1 % for supplying incorrect information
Transparency duties (art. 50) and the general application date of the Act, including the market surveillance provisions in articles 73 to 94
Machine-readable marking of synthetic content for generative systems already on the market, and the two prohibitions the Digital Omnibus added on AI-generated child sexual abuse material and non-consensual intimate images
Every member state must have at least one AI regulatory sandbox operational (art. 57), moved back a year by the Digital Omnibus
High-risk obligations, Annex III use areas (recruitment, credit scoring, education, essential services, law enforcement among others): risk management, quality management and conformity assessment. The fundamental rights impact assessment (art. 27) applies from the same date. It binds bodies governed by public law and private entities providing public services, and separately every deployer of creditworthiness or life and health insurance pricing systems, commercial ones included. Critical infrastructure systems are exempt from that duty
High-risk obligations, Annex I (product-embedded AI: machinery, medical devices among others)
Providers and deployers of high-risk systems intended to be used by public authorities must have taken the necessary steps to meet the requirements and obligations, chapter III and article 27 included (art. 111(2)). The test is the system's intended use rather than who owns the operator: a private company supplying such a system to a public authority is caught exactly as the authority is. For that group the date is not relief but a backstop, because the general exemption for existing systems left substantially unchanged does not apply here
The amending regulation, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. The dates above reflect it. This module is updated as each milestone passes, and again when the first harmonised standards publish.
INSIGHTS
Article 50 has applied since 2 August 2026, and most people read AI labelling as meaning that anything AI touched has to be marked. The regulation is narrower: two of the five disclosure duties are the provider's, and the exemption for ordinary editing applies to that one. Three are left that are yours.
Read the analysis
Sweden has divided the AI Act between five authorities. The split follows the point numbers in Annex III rather than industry, which is why schools and waterworks got the same regulator.
Read the analysisThe AI Act is EU law and applies identically across the union, but enforcement is national. Sweden has named its authorities, but not in statute.
On 4 June 2026 the government allocated responsibility to five authorities in decision III:50. The split follows the point numbers in Annex III rather than sectors, which is what makes it impossible to guess.
The Swedish Post and Telecom Authority (Post- och telestyrelsen, PTS) took critical infrastructure, education, employment, essential public services and emergency services, and is also the single point of contact. The Swedish Financial Supervisory Authority (Finansinspektionen) took creditworthiness inside its own supervised perimeter and insurance, and the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) took biometrics, law enforcement, migration and justice. The Swedish Medical Products Agency (Läkemedelsverket) has medical devices. Swedac carries out no market surveillance; it designates and notifies the conformity assessment bodies.
The assignment is not a statute and expires on 31 December 2026. The powers follow from Article 74(1) and the market surveillance regulation (EU) 2019/1020, but the penalties need Swedish legislation that does not yet exist.
The practical consequence is not the one people guess. A school and a waterworks have the same supervisor, and it is the telecoms regulator. The Swedish Post and Telecom Authority and the Agency for Digital Government merge on 1 January 2027, and the government intends to name the merged agency Digitaliseringsmyndigheten.
IMY has an inspection of a region's AI transcription service in primary care underway, opened in May 2026. It rests on data protection law rather than on the AI Act, which is the useful lesson: the first supervisory pressure on AI in Sweden arrives through the GDPR.
A Swedish implementing act and a regulatory sandbox are still to come. We track both.
A small, fast, fixed-price review: which of your systems interact with people or generate content, what disclosure and marking they require, and which of those you already meet. Weeks, not months.
For organisations with use cases on the high-risk list: risk management, quality management, FRIA processes and documentation, built in calm tempo against the calendar. We sell the head start, never the panic. Our methodology tracks the standards as they publish; we will never sell you a presumption that does not yet exist.
Risk classification under the Act is built into every assessment from the start, so what you decide to build is compliant by design, not audited after.
The competence duty starts where accountability sits. We work directly with boards and leadership teams: what the Act makes you responsible for, what your AI portfolio actually contains, and which decisions are yours to make. Delivered by Ampliro, in the boardroom.
For managers and staff: role-specific tracks, documented completion, and annual updates as tools and rules change. Delivered through AIUC, our education arm.
QUESTIONS
The EU AI Act treats two groups as high-risk. Annex III lists standalone uses: recruitment, creditworthiness assessment of natural persons, education, essential public services, law enforcement, migration and justice. Annex I covers AI acting as a safety component in an already regulated product, from machinery to medical devices. Annex III duties apply from 2 December 2027, Annex I from 2 August 2028. Most AI in daily operation falls outside both.
Parts of the EU AI Act already bind you. The AI literacy duty in Article 4 and the prohibited practices in Article 5 have applied since 2 February 2025, and the obligations for general-purpose model providers and the penalty regime in Article 99 since 2 August 2025. Transparency duties in Article 50 have applied since 2 August 2026, and the high-risk duties follow on 2 December 2027 and 2 August 2028.
Waiting is only safe for the high-risk duties themselves, which Regulation (EU) 2026/1744 moved to 2 December 2027 and 2 August 2028. Nothing else moved: Article 4 and Article 5 have applied since 2 February 2025, the penalty regime since 2 August 2025, and Article 50 transparency has applied since 2 August 2026. Near a deadline, assessors and specialists become the bottleneck, and prices follow.
Yes, the EU AI Act still applies. The AI literacy duty in Article 4 has bound every organisation using AI since 2 February 2025, whatever the risk level, and transparency duties have applied since 2 August 2026 depending on what the embedded feature does. Embedded AI also belongs in your inventory: you cannot classify what you have not written down.
The EU AI Act requires it of a private company in two situations. Article 27 binds private entities providing public services exactly as it binds bodies governed by public law, across Annex III apart from critical infrastructure. It also binds every deployer of a system assessing the creditworthiness of natural persons, or pricing and assessing risk in life and health insurance, purely commercial ones included. Outside those two it does not apply. The date is 2 December 2027.
A public body must have its existing high-risk systems compliant with chapter III of the EU AI Act, Article 27 included, by 2 August 2030 under Article 111(2). That deadline holds whether or not the systems have been changed, and the general relief for systems left substantially unchanged does not apply here. The provision is not limited to public bodies either: it binds providers and deployers of high-risk systems intended to be used by public authorities, which includes a private company supplying such a system to an authority. New systems follow the ordinary dates, 2 December 2027 for Annex III.
ISO/IEC 42001 does not by itself make you compliant with the EU AI Act. It is a useful management-system standard, but it is not a harmonised standard under the Act and gives no presumption of conformity. No harmonised standards under the Act have been published yet, so compliance is demonstrated with your own documentation. We build that documentation so that it tracks the standards as they publish.
THE TERMS
This page is written in the Act's own vocabulary: provider and deployer, high-risk system, impact assessment, presumption of conformity. They rarely mean the same thing in the regulation as they do in a vendor's sales material, and the difference decides who carries the duty.
Terms explains thirty-four of them: what the word means, what it gets confused with, where it sits in the regulation, and the decision it leads to.