Just Days Left Before the EU AI Act Takes Effect for High Risk AI Deployers

A Deadline That Felt Far Away and Now Is Not

On August 2, 2026, Articles 9 through 17 and Article 26 of the EU AI Act, Europe's AI regulatory framework, take legal effect across the European Union, covering the obligations of organizations that deploy AI systems classified as high risk under Annex III of the law. According to analyses from Kiteworks and law firm Holland and Knight, most organizations are still not ready for the deadline, despite it having been known for over a year.

What Now Applies to High Risk AI Deployers

Article 26 sets direct obligations for companies that deploy, not just develop, high risk AI systems: effective human oversight, compliance with the system provider's instructions, ongoing operational monitoring and incident reporting to market surveillance authorities. Buying an AI tool from a reputable vendor is no longer enough, the company using it now also answers for how the tool is operated day to day.

Mandatory Transparency Under Article 50

The same day, Article 50's transparency obligations take effect, requiring clear disclosure whenever a person is interacting with an AI system, machine detectable labeling on synthetic content, and explicit watermarking requirements for deepfakes. These rules apply across every EU member state simultaneously, with no additional country by country transition period.

Fines of Up to 3% of Global Revenue

The penalty ceiling is steep: up to 15 million euros or 3% of a company's global annual revenue, whichever is higher, according to Legiscope's rundown of the AI Act's fine schedule. Some analyses cite even higher figures, up to 35 million euros or 7% of global revenue, for specific violations tied to prohibited AI practices.

It Applies to Companies Outside the EU Too

According to a Holland and Knight advisory aimed at US companies, the AI Act has extraterritorial reach: it covers any company, from any country, whose high risk AI system is used by people inside the European Union, regardless of where the company is based. That includes, in principle, Brazilian companies serving European customers with AI systems that fall into the law's high risk categories, such as certain credit scoring, recruitment or risk assessment tools.

Why This Matters for Brazilian Agencies and SMBs

The vast majority of Brazilian automation and customer service agencies do not operate high risk AI systems or serve customers in the European Union, so the August 2 deadline is not a direct obligation for most. Even so, it is worth watching closely: Article 50's transparency requirements, such as clearly disclosing when a customer is talking to a chatbot rather than a human, are already recommended good practice in Brazil and are likely to become the norm here too, as PL 2338/2023 moves through Brazil's Congress. Companies that already adopt this kind of transparency by default will be ahead of the curve once Brazilian regulation starts formally requiring the same.