When does the EU AI Act apply to high-risk systems?

Most high-risk obligations in Annex III enter into application on 2 August 2026. Embedded systems in regulated products have an extended transition until 2 August 2028. General-purpose AI (GPAI) obligations have applied since 2 August 2025.

Providers, deployers, importers, and distributors of AI systems placed on the EU market - even if the provider is outside the EU - when the AI system or its output is used in the Union.

How does Hootleash help?

Hootleash automates Articles 9 through 17 by capturing risk management, data governance, record-keeping, transparency, human oversight, and accuracy as live runtime evidence, then exports defensible packs for notified bodies and supervisory authorities.

EU AI Act · Articles 9–17 & GPAI

Be ready for August 2026 - and the next political trilogue.

The high-risk obligations of the EU AI Act enter into application on 2 August 2026. General-purpose AI obligations have been live since 2 August 2025. Hootleash gives providers and deployers a turnkey path to Article 9–17 compliance - and to whatever the AI Omnibus eventually delivers.

Apply for design partnership Talk to a compliance lead

Timeline

The dates your legal team should be planning around.

2 Feb 2025
Prohibited AI bans
Article 5 in force.
2 Aug 2025
GPAI obligations live
General-purpose AI model rules apply.
2 Aug 2026
High-risk obligations
Most Article 9–17 obligations and Annex III enforcement begin.
2 Aug 2028
Embedded products
Extended transition for AI in regulated products.

Article-by-article

Every high-risk obligation, pre-modelled.

Article 9

Risk management system

A continuous, iterative risk management process across the AI lifecycle. Hootleash ships the workflow, the documentation, and the evidence.

Article 10

Data and data governance

Quality criteria for training, validation, and test datasets. Hootleash captures lineage, bias mitigation, and representativeness checks.

Article 11

Technical documentation

Annex IV documentation auto-generated from the live system - no last-minute hunt for design docs.

Article 12

Record-keeping

Automatic logs of events relevant to risk and post-market monitoring. WORM-sealed and signed.

Article 13

Transparency & deployer information

Generate user-facing instructions, intended-use statements, and limitations from declarative inputs.

Article 14

Human oversight

Define and prove human-on-the-loop and human-in-the-loop controls - with measurable interventions.

Article 15

Accuracy, robustness, cybersecurity

Continuous metrics, adversarial tests, red-team campaigns, and signed attestations.

Articles 16–17

Provider obligations & QMS

Quality management system, conformity assessment, CE marking, and post-market monitoring.

GPAI

General-purpose AI obligations - live now.

Maintain technical documentation per Annex XI / XII for every GPAI model used in production.
Document training data summary and copyright policy.
Implement systemic-risk evaluations for GPAI models with significant capabilities.
Establish an incident reporting workflow for serious incidents and malfunctions.
Publish a sufficiently detailed summary of training content used.

Ready when you are

Schedule a 30-minute EU AI Act readiness review.

We're building Hootleash in private design partnership with a small number of regulated enterprises. If you run autonomous AI in production, get in touch.

Apply for design partnership Talk to us

Pre-launch · design partner program open · early access 2026