Is your EU AI Act content out of date?
Paste a compliance policy, a vendor questionnaire response, a board paper or a published guide. This checks it against 16 claims the current Regulation contradicts and shows you what the law now says. Nothing is uploaded.
80 days to 2 December 2026 — two new Article 5 prohibitions, and Article 50(2) marking for generative systems already on the market. Full timeline →
How do I know if my EU AI Act guide is out of date?
The clearest single test is the high-risk date. If a document says Annex III high-risk obligations apply from 2 August 2026, it was written before Regulation (EU) 2026/1744 entered into force on 27 July 2026 and is out of date.
Reg. (EU) 2024/1689 as amended by Reg. (EU) 2026/1744 · more questions on this page
Does this reach your organisation?
- Yes if you place an AI system on the EU market, or put one into service in the EU, wherever you are established.
- Yes if you are established in the EU and use an AI system under your own authority.
- Yes if you are outside the EU and the output your system produces is used in the Union.
No EU entity and no EU customers of record is not an exemption. Article 2 turns on market placement and on where output is used. Check your position in 12 questions →
Runs entirely in your browser. Nothing is uploaded, logged or stored, and no email is required. This is a heuristic check, not legal advice. How we source this →
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
A request for information from the AI Office asks which AI systems you run, what each is for, which role you hold, and what is documented. The reply itself is penalty-bearing. Twenty minutes covers the same ground while nothing turns on the answer.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Why this exists
Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved the high-risk dates, replaced Article 4 in full, and added two prohibitions. Every compliance document written before that date describes an AI Act that no longer exists.
That includes material still ranking on page one of Google. We ran this checker against five widely-read EU AI Act guides in September 2026. Two carried a claim the current Regulation contradicts: one dated the high-risk deadline to August 2026, and one specified a 72-hour serious incident window, which is the GDPR Article 33 breach deadline rather than anything in Article 73.
A note on that number. An earlier draft of this page said four of five. That was based on a looser rule set which also flagged statements that are defensible, describing ISO/IEC 42001 as a foundation for AI Act work is fair, and saying major requirements applied from 2 August 2026 is true of Article 50, Article 49 and enforcement powers. We tightened the rules so the tool does not flag text that is merely unwelcome, and corrected this figure to match what it now finds. Why we publish corrections →
The three fastest tells
- “High-risk applies from 2 August 2026.” It is now 2 December 2027 for Annex III, 2 August 2028 for Annex I.
- “Report serious incidents within 72 hours.” That is GDPR Article 33. Article 73 is 15 / 10 / 2 days.
- “High-risk breaches carry €35M or 7%.” They carry €15M or 3%. The 7% tier is Article 5 only.
What this checks
Sixteen rules, each traced to a provision. High severity means the claim is contradicted by the current text; medium means it is misleading or commonly misapplied.
| Claim it looks for | Provision |
|---|---|
| High-risk obligations dated to August 2026 | Art. 113, as amended |
| 7% penalty tier attached to high-risk or transparency | Art. 99(3), 99(4) |
| A 72-hour incident reporting window | Art. 73 |
| ISO/IEC 42001 as harmonised or conferring presumption | Art. 40 |
| Certification equated with compliance | Arts. 43, 47 |
| Pre-amendment Article 4 wording | Art. 4, as amended |
| Sandboxes dated to August 2026 | Arts. 57–58 |
| The Digital Omnibus described as pending | Reg. (EU) 2026/1744 |
| Harmonised standards described as available | Art. 40 |
| Article 50 described as deferred | Art. 50 |
| GPAI obligations described as future | Arts. 51–56 |
| A claim that AI Act fines have been issued | — |
| Human review presented as an exit from high-risk | Art. 6(3) |
| The UK described as within the EEA | Art. 2 |
| SMEs described as exempt | Art. 99(6) |
| The AI Act described as delayed generally | Reg. (EU) 2026/1744 |
Status labels on this page
Verified fact: Every provision, date and penalty tier referenced by the rules above, checked against the consolidated Regulation and the Commission's published enforcement framework.
Expert analysis: The selection of which claims to check, the severity grading, and the assessment that four of five tested guides carried a contradicted claim.
Unsettled: Whether any penalty decision has been adopted. We found none in primary sources and do not repeat unverified figures.
A flag on your own policy is worth twenty minutes
If this found something in a document your organisation relies on, the same question applies to the rest of it: which AI systems you run, what each is for, which role you hold, and what is documented. That is also what a request for information from the AI Office asks.
Not sure where you sit?
The classifier maps your system against Articles 5, 6, 50 and Annex III. Twelve questions, no email.
What happens if this is not in order
Enforcement powers have applied since 2 August 2026. The AI Office can issue requests for information, evaluate models, interview staff and inspect premises. Three reporting channels are live: a public complaint tool, a whistleblower tool your own staff can use securely, and a complaints channel for downstream customers.
Penalties run to €35M or 7% for Article 5 prohibitions and €15M or 3% for other operator obligations including high-risk and Article 50. Separately, an incorrect or misleading reply to a request for information carries up to €7.5M or 1% — you can be substantively compliant and still penalised for how you answered. What is enforceable today →
Frequently asked
How do I know if my EU AI Act guide is out of date?
The clearest single test is the high-risk date. If a document says Annex III high-risk obligations apply from 2 August 2026, it was written before Regulation (EU) 2026/1744 entered into force on 27 July 2026 and is out of date. That amendment moved stand-alone Annex III systems to 2 December 2027 and Annex I embedded systems to 2 August 2028.
Other reliable signals are a 72-hour incident window, which belongs to the GDPR and not to Article 73, and the 7 percent penalty tier attached to high-risk, which applies only to Article 5 prohibited practices.
What changed in the EU AI Act in July 2026?
Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.
It deferred Chapter III Sections 1 to 3 high-risk obligations to 2 December 2027 and 2 August 2028, replaced Article 4 in full, added two new Article 5 prohibitions applying from 2 December 2026, deferred national regulatory sandboxes to 2 August 2027, and expanded the AI Office's supervisory competence. It did not defer Article 5, Article 4, Chapter V general-purpose AI, Article 49 registration or Article 50 transparency.
Is this checker legal advice?
No. It is a heuristic pattern check that compares text against a published list of claims which the current Regulation contradicts. It runs entirely in your browser, transmits nothing, and cannot read context, jurisdiction or intent. It will miss things and it will occasionally flag correct text, particularly where a document quotes an error in order to correct it. Treat a flag as a prompt to check the provision, not as a finding.
Does the checker store what I paste?
No. Everything runs in your browser using JavaScript on this page. Nothing is uploaded, logged or stored, and there is no email gate. You can disconnect from the network and it will still work.