Editorial disclosure: This report was prepared with AI assistance and reviewed against the European Commission’s primary-source materials by the ZiaSign editorial team.
The European Commission says a political agreement reached on May 7, 2026 changes the implementation sequence for parts of the EU AI Act. Under the timeline described by the Commission, rules for AI systems used in certain high-risk areas—including biometrics, critical infrastructure, education, employment, migration, asylum, and border control—will apply from December 2, 2027. Rules for high-risk systems integrated into regulated products such as lifts or toys will apply from August 2, 2028.
At the same time, the Commission’s AI Act overview continues to identify August 2026 as the start of the Act’s transparency rules. For legal, procurement, privacy, and AI-governance teams, that means the headline is not “compliance has been postponed.” The dates and obligations now need to be separated carefully by system category and role.
Prohibited-practice and AI-literacy obligations began applying
Existing vendor controls should already address prohibited uses and responsible user training
August 2, 2025
Governance rules and obligations for general-purpose AI models began applying
Customers need evidence and cooperation clauses from relevant model providers and downstream vendors
August 2026
Transparency rules come into effect
Contracts should allocate responsibility for notices, machine-interaction disclosure, and marking or labelling covered AI-generated content
December 2, 2027
Commission says rules for systems in certain high-risk areas will apply under the political agreement
Buyers and vendors gain transition time, but should use it to validate classification, documentation, controls, and audit evidence
August 2, 2028
Commission says product-integrated high-risk rules will apply
Product manufacturers and embedded-AI suppliers need a longer conformity and evidence roadmap
The legal position depends on the final applicable legislation, the system’s classification, and each party’s role. Businesses should verify the latest official text and obtain legal advice rather than relying on a summary or a contract template alone.
The Commission’s current AI Act overview says the transparency rules come into effect in August 2026. These rules address situations where people should know that they are interacting with AI and where certain AI-generated or manipulated content requires disclosure or labelling.
This matters for contracts because transparency is rarely controlled by one party. A model provider may supply technical signals; an application vendor may design the user experience; and a customer may determine the deployment context and final communication to users. If the agreement simply says “vendor will comply with the AI Act,” the operational handoffs can remain undefined.
A better contract identifies who must:
determine whether a particular disclosure obligation applies;
supply machine-readable or technical marking capabilities;
display notices to end users;
preserve records showing when notices were shown;
notify the other party when product changes affect transparency controls; and
Require the vendor to describe the system’s intended purpose, deployment limitations, model dependencies, and known classification assumptions. The agreement should require notice before a change that could alter the system’s regulatory classification or risk profile.
2. Provider, deployer, importer, and distributor responsibilities#
Do not assume “vendor” and “customer” map neatly to statutory roles. State which party performs each operational responsibility and require cooperation if facts later change the legal role allocation.
Define responsibility for chatbot notices, synthetic-content marking, deepfake disclosures, user-facing explanations, and evidence that required notices were presented. Include acceptance criteria for the relevant product surfaces.
Set a schedule for technical documentation, instructions for use, model or system cards where relevant, risk records, testing summaries, logging capabilities, and supporting evidence required for audits or regulator requests.
AI products can change through model swaps, fine-tuning, retrieval updates, safety-policy changes, and new subprocessors. Require advance notice for material changes and a reassessment path when the change affects intended purpose, accuracy, oversight, data use, or transparency.
Specify which party creates and retains logs, how long they are available, what identifiers are included, and how logs can be exported for investigations. Logging obligations should be reconciled with privacy, security, confidentiality, and data-minimisation requirements.
Document where human review is mandatory, who has authority to pause or override the system, and how high-impact or anomalous outcomes are escalated. Contractual service levels should never turn a missed review deadline into automatic approval.
Define notification windows, severity criteria, evidence preservation, root-cause support, and responsibility for regulator communications. Avoid wording that prevents either party from meeting a mandatory reporting deadline.
Require visibility into critical upstream providers and flow down the controls needed to support the customer’s obligations. Address what happens when an upstream model, hosting provider, or training-data practice changes materially.
Include a remediation process, suspension rights for material compliance risk, transition assistance, evidence export, and termination rights where the system cannot lawfully or safely be used for the contracted purpose.
A 30-day action plan for legal and procurement teams#
Inventory active AI vendors. Record system purpose, users, affected individuals, jurisdictions, and upstream models.
Separate transparency from high-risk obligations. Do not apply one generic deadline to every control.
Map roles for each deployment. Confirm which entity supplies, integrates, operates, or deploys the system.
Review user-notice controls. Test whether required notices are visible, accurate, accessible, and logged.
Request current evidence. Ask vendors for documentation and change histories relevant to their actual role and product.
Update change-control clauses. Cover model substitutions, new features, new subprocessors, and material policy changes.
Create an exception workflow. Route unresolved classification or evidence gaps to legal, privacy, security, and AI-governance owners.
Track the final legislative process. The Commission describes a political agreement and implementation sequence; teams should monitor the final legally applicable measures and guidance.
The transition should be used to improve evidence and operating controls—not to pause preparation.
How this update differs from our earlier checklist#
ZiaSign’s earlier EU AI Act vendor contract checklist provides a broad clause-review framework. This report addresses the new timeline information and the immediate distinction between August 2026 transparency duties and later high-risk dates described by the Commission.
Teams using the earlier checklist should refresh its deadline assumptions while retaining the underlying controls for documentation, human oversight, auditability, incident response, and change management.
This report summarises public regulatory information for operational planning. It is not legal advice. Verify the final applicable legal text, guidance, system classification, and jurisdiction with qualified counsel.