EU AI Act dates, impact assessments and AI literacy

These records are part of Compliance Mode, on Business and Enterprise, beside the AI register. They are your organisation's own records, kept for audit; they are not legal advice.

When each duty applies#

Once a register record has an EU AI Act determination, its page lists the duties that follow, each with the day it applies from, and names the next date still to come. The AI register shows every date ahead with how many records it reaches. The dates are the Act's as amended by the AI Omnibus (Regulation (EU) 2026/1744): AI literacy and prohibited practices from 2 February 2025, general-purpose AI models from 2 August 2025, transparency from 2 August 2026, high-risk Annex III uses from 2 December 2027 and Annex I products from 2 August 2028.

Fundamental rights impact assessment#

When a determination makes a record a high-risk Annex III use and your organisation its deployer, the record asks for an assessment under Article 27. It has the six parts the Article lists:

• How the system is used (Art. 27(1)(a)): The processes in which the system is used, in line with its intended purpose: who uses it, at which step, and what its output feeds into.
• When and how often (Art. 27(1)(b)): The period of time within which, and the frequency with which, the system is intended to be used.
• Who it affects (Art. 27(1)(c)): The categories of natural persons and groups likely to be affected by its use in this context, such as applicants, policyholders, claimants or staff.
• Risks of harm (Art. 27(1)(d)): The specific risks of harm likely to affect those people, taking into account what the provider tells you under Article 13: discrimination, exclusion, wrong decisions, privacy.
• Human oversight (Art. 27(1)(e)): The human oversight measures, according to the instructions for use: who checks what, before or after the system acts, and how they can stop or override it.
• If a risk materialises (Art. 27(1)(f)): The measures taken if those risks materialise, including the internal governance arrangements and the complaint mechanisms open to the people affected.

• The human oversight part starts from what Deliverd knows: the record's oversight setting and the agents linked to it. It is a draft to edit, not a finding.
• An owner, administrator or compliance admin writes it. Someone else signs it off; the author cannot.
• After sign-off, record the day its results went to the market surveillance authority (Art. 27(3)), and its reference.
• A changed assessment is a new version. Nothing written is edited, and earlier versions stay on the record.

AI literacy log#

Under Governance → AI literacy, record a training once for everyone who took it: members by name, and people without an account one per line. Each person gets their own line, with the kind of training (course, workshop or session, briefing, self-study, other), the day, who gave it, an optional AI system it was for, and where the evidence is kept.

• A record counts for 12 months. The page shows how many members hold a current one, who has none, and who is due for a refresh within 30 days.
• A record made by mistake is withdrawn with a reason. It stays in the log, struck through.
• Export the whole log, withdrawn lines included, as CSV for an auditor or a supervisor.