EU AI Act Compliance

What it is

The EU AI Act — Regulation (EU) 2024/1689 — is the horizontal EU law for AI systems and general-purpose AI (GPAI) models. For an SAP team it is a delivery constraint: it decides which Joule scenarios, agents, predictive models (including tabular models such as SAP-RPT) and embedded AI features need a documented risk-management system, and which need little more than disclosure. It entered into force on 1 August 2024 and applies in stages. In July 2026 the timetable changed: the Digital Omnibus on AI, Regulation (EU) 2026/1744 of 8 July 2026, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Anything you learned before that date about "high-risk from August 2026" is out of date.

Why it matters

• The high-risk deadline moved: Annex III systems from 2 Dec 2027 and Annex I systems from 2 Aug 2028 (Regulation (EU) 2026/1744, in force 27 Jul 2026) — plans built on 2 Aug 2026 must be re-baselined, not cancelled.
• Classification follows the configured intended purpose, not the product: the same Joule platform is minimal-risk as a drafting assistant and high-risk as a candidate-ranking agent.
• Some obligations already bite today: Article 5 prohibitions and Article 4 literacy measures (since 2 Feb 2025), GPAI rules (since 2 Aug 2025) and Article 50 transparency (since 2 Aug 2026).

Key points

• Regulation (EU) 2024/1689, in force since 1 Aug 2024; amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 (OJ 24 Jul 2026, in force 27 Jul 2026).
• Live today: Art. 5 prohibitions and Art. 4 literacy (2 Feb 2025), GPAI obligations (2 Aug 2025), Art. 50 transparency and general application (2 Aug 2026).
• High-risk requirements (Chapter III Sections 1–3): 2 Dec 2027 for Annex III, 2 Aug 2028 for Annex I; new Art. 5 bans on non-consensual intimate material and CSAM from 2 Dec 2026.
• Omnibus also softened Art. 4 to 'take measures to support' AI literacy, simplified Art. 6(3) registration, added SMC proportionality and an EU-level sandbox.
• Provider vs deployer (Art. 25–26) is the first scoping question: building or repurposing an agent can make the customer a provider.
• Fines (Art. 99): €35m/7 % prohibited practices · €15m/3 % most operator obligations · €7.5m/1 % incorrect information.

Terms used on this page

Digital Omnibus on AI

Regulation (EU) 2026/1744 of 8 July 2026 amending the AI Act; in force 27 July 2026. Defers high-risk dates, adds two prohibitions, softens Art. 4.

Annex III

List of high-risk use cases (e.g. employment, creditworthiness, essential services, education, critical infrastructure); high-risk requirements apply from 2 Dec 2027.

Annex I

Union harmonisation legislation for products; AI that is a safety component of such products is high-risk under Art. 6(1), from 2 Aug 2028.

Article 6(3) derogation

An Annex III system is not high-risk if it does not pose a significant risk (e.g. narrow procedural or preparatory task); the provider must document the assessment.

Provider / deployer

Provider develops or places the AI system on the market under its name; deployer uses it under its authority. Substantial modification or change of purpose can turn a deployer into a provider (Art. 25).

GPAI model

General-purpose AI model (e.g. a large language model); provider obligations apply since 2 Aug 2025.

SMC

Small mid-cap enterprise, defined by the Omnibus with reference to Commission Recommendation (EU) 2025/1099; benefits from some SME-style proportionality.

Sources

1. EUR-Lex — Regulation (EU) 2024/1689 (Artificial Intelligence Act), full text
2. EUR-Lex — Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 24.7.2026
3. EUR-Lex — Regulation (EU) 2026/1744, ELI page
4. European Commission — AI regulatory framework
5. EU AI Act Service Desk — implementation timeline
6. AI Act Article 99 — penalties (consolidated reading aid)
7. SAP News — SAP unveils the Autonomous Enterprise (Sapphire 2026: sovereign model options with Mistral AI and Cohere)
8. European Commission — The European AI Office
9. artificialintelligenceact.eu — Article 6: Classification Rules For High-Risk AI Systems
10. artificialintelligenceact.eu — Article 25: Responsibilities Along the AI Value Chain
11. artificialintelligenceact.eu — Article 50: Transparency Obligations for Providers and Deployers of Certain AI Systems
12. SAP News Center — Autonomous enterprise: SAP AI agents at scale, incl. AI Governance Assistant (2026-09-22)