The EU AI Act’s high-risk AI obligations take effect on 2 August 2026, requiring documented risk management, conformity assessments, and board-level oversight from all organisations deploying AI in the EU. With GPAI governance already active since August 2025, mid-market firms face an urgent compliance window that demands integrated action across legal, technology, and risk functions.
The EU AI Act’s high-risk enforcement deadline of 2 August 2026 imposes multi-layered obligations on both AI providers and deployers operating in the European market. With enterprise readiness still structurally weak, boards and senior leadership must accelerate AI governance programs now to avoid material regulatory and reputational exposure.
The EU AI Act introduces sanctions exposure exceeding GDPR, with fines up to €35 million or 7% of global turnover and full high-risk system compliance required by August 2026. Mid-market companies must treat AI governance as a standalone workstream — not an extension of existing data privacy programs.
The EU AI Act’s transparency rules take effect in August 2026, and GPAI governance obligations are already enforceable — creating an overlapping compliance burden alongside GDPR for any mid-market organisation deploying AI in Europe. CFOs and General Counsel must prioritise AI inventory, documentation, and vendor risk controls now.
The EU AI Act and GDPR are converging into a single, integrated compliance challenge for organizations deploying AI systems across European markets. CFOs, General Counsel, and board members must now treat AI governance as a core enterprise risk management priority — not a standalone technology issue.
GDPR fines have surpassed €7.1 billion, with over 60% of penalties issued since January 2023 — and enforcement is intensifying beyond Big Tech. With the EU AI Act reaching full force in August 2026, organizations face a converging regulatory stack that demands board-level accountability and mature governance programs.
A provisional EU Council–Parliament agreement on the AI Act delays high-risk compliance deadlines to 2027–2028 but accelerates transparency and watermarking rules to December 2026. CFOs and General Counsel must now sequence compliance investment carefully and align AI governance with existing GDPR frameworks.
The EU AI Act provisional deal extends high-risk compliance deadlines to 2027–2028 but accelerates watermarking and transparency obligations to December 2026. CFOs and General Counsel must reprioritize now — the near-term compliance burden is heavier than the headlines suggest.
The EU AI Act’s provisional deadline extensions shift high-risk AI compliance obligations to December 2027 and August 2028 — but penalties remain unchanged and the AI-generated content transparency deadline arrives in December 2026. Here is what executive teams must prioritise now.
The European Commission’s proposals to revise GDPR and the EU AI Act — including a delay of high-risk AI rules to December 2027 and projected savings of €5 billion by 2029 — represent a structural shift in EU digital governance. For CFOs, General Counsel, and board members, the reforms create strategic opportunity, but enforcement gaps and existing obligations demand immediate attention.