The AI Act asks what your AI decided, and who checked it. Keep the record that answers.
The Digital Omnibus moved the AI Act's high-risk duties to December 2027 and August 2028. It did not move the transparency rules, which have applied since 2 August 2026, and it did not change what an auditor will ask for: logs of what a system did, proof a person could step in, and labels on AI-generated content. Aeroz keeps that record as a signed chain anyone can check.
- EU AI ACT · THE DATES
- 2 Aug 2026transparency, Art. 50
- 2 Dec 2026marking, gen-AI already on sale
- 2 Dec 2027high-risk, Annex III
- 2 Aug 2028high-risk in products, Annex I
- Reg. (EU) 2024/1689as amended by 2026/1744
Where it stands.
Each line names the source it was checked against.
- In force
- The AI Act entered into force on 1 August 2024. Banned practices and the duty to give staff enough AI literacy have applied since 2 February 2025; the rules for general-purpose AI models since 2 August 2025. Reg. (EU) 2024/1689, Art. 113
- Transparency, now
- Article 50 has applied since 2 August 2026. People must be told when they are dealing with an AI system, and anyone who publishes a deepfake, or AI-generated text on a matter of public interest, must say so. A machine-readable mark alone does not count as telling them. Art. 50(1), 50(4); Commission guidelines
- Machine-readable marking
- Generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to mark their output in a machine-readable way. That is the duty of the tool's provider, not of the person publishing with it. Art. 50(2); Reg. (EU) 2026/1744
- High-risk systems
- Moved by the Digital Omnibus on AI: 2 December 2027 for stand-alone high-risk systems such as those used in hiring, credit and critical infrastructure (Annex III), and 2 August 2028 for AI inside regulated products such as medical devices and machinery (Annex I). Reg. (EU) 2026/1744
- The Omnibus
- Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026. It moved dates. It did not change the risk tiers or what the high-risk duties require. OJ, 24 Jul 2026
- Who it reaches
- Providers and deployers in the EU, and providers and deployers elsewhere whose AI system's output is used in the EU. A US company selling into Europe can be in scope. Art. 2
- Fines
- Breaking the transparency rules: up to €15 million or 3% of worldwide annual turnover, whichever is higher. A banned practice: up to €35 million or 7%. Art. 99
What an auditor will ask for.
Logs, kept automatically
High-risk systems must log events automatically over their lifetime so that what they did can be traced (Art. 12). Providers keep those logs (Art. 19); deployers keep the logs under their control for at least six months (Art. 26(6)).
A person who can step in
High-risk systems must let a person understand the output, decide not to use it, and override or stop the system (Art. 14). An auditor will ask how often that happened, and who did it.
Telling people
Chatbots say they are AI. Deepfakes, and AI-generated text published on matters of public interest, carry a clear label at the latest when someone first sees them (Art. 50).
People who understand it
Anyone who runs or uses AI for a company has enough understanding of how it works, its limits and its risks (Art. 4). This has applied since 2 February 2025.
Where AI meets the records you already keep.
Most AI in supply chains flags something: a suspect unit, a temperature excursion, an exception to send to a partner. These pages cover the records those flags land in.
How Aeroz uses AI
Where we use AI, how it is labelled, and what a person still decides.
Read the guide →DSCSADSCSA, explained
Suspect-product investigations: the US pharma record an AI flag starts.
Read the guide →PlatformThe Aeroz platform
One signed record per unit, across every partner.
Read the guide →Every ruleGlobal compliance
The deadlines we track across the US, the EU and the UAE.
Read the guide →EU battery passportEU battery passport
Required from 18 February 2027 for EV, LMT and industrial batteries.
Read the guide →StandardsStandards we build on
GS1, EPCIS, ISO/IEC: the open formats under every Aeroz record.
Read the guide →Where Aeroz fits, and where it doesn't.
Every decision, signed
Register each AI system you run, then record what it decided. Inputs and outputs are kept as SHA-256 fingerprints, never as text. Each record carries the hash of the one before it and is signed by Aeroz, and the database refuses edits.
Overrides on the record
When a person approves, overrides or rejects a decision, that review joins the same chain with who, when and why. An override needs a reason. That is the human-oversight evidence Article 14 points to.
Evidence an auditor can check
Export one signed file with every record and a check of every link. An auditor can recompute the chain without Aeroz, and confirm Aeroz signed the file at /v1/records/verify.
Not a conformity assessment
Aeroz records what happened. Classifying your system, the conformity assessment and, where required, a notified body's review stay with you. Nothing here is legal advice.
EU AI Act, answered.
Did the Digital Omnibus delay the whole AI Act?
No. It moved the high-risk duties to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The transparency rules in Article 50 applied on 2 August 2026 as planned. Only the machine-readable marking duty for generative AI tools already on the market got until 2 December 2026.
Does the AI Act apply to a US company?
It can. The Act reaches providers and deployers outside the EU when their AI system is placed on the EU market or its output is used in the EU (Article 2).
What logs does the AI Act require?
High-risk systems log events automatically over their lifetime (Article 12). Providers keep the logs (Article 19), and deployers keep the logs under their control for at least six months unless other law says otherwise (Article 26(6)).
Does Aeroz store our prompts or model outputs?
No. Aeroz keeps a SHA-256 fingerprint of each input and output, plus a short label and a reference to what the decision was about. The text stays in your systems.
Will Aeroz classify our AI system?
No. Which risk class a system falls in is your assessment, and Aeroz records the class you chose. If you are unsure, the European Commission's AI Act Service Desk has a free compliance checker.
Sources: Regulation (EU) 2024/1689, the AI Act (EUR-Lex) · Cloud Security Alliance: the Omnibus and the high-risk deadline · McCann FitzGerald: Article 50 deployer duties · Reed Smith: EU AI transparency rules. Checked 6 November 2026. Not legal advice.
The EU AI Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744): transparency duties since 2 August 2026, machine-readable marking for older generative tools from 2 December 2026, high-risk duties from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Regulation
- (EU) 2024/1689
- Transparency
- since 2 Aug 2026
- High-risk
- 2 Dec 2027
- In products
- 2 Aug 2028