AI Act 2026: What has changed since January and how to secure its compliance trajectory?

Since the start of 2026, the AI Act has reached a significant milestone: without fundamentally changing its structure, its scope of application has become much more concrete.  

The publication, on 28 January 2026, of the European Commission's FAQ “Navigating the AI Act” marked a useful turning point for businesses, clarifying several practical obligations and reaffirming 2 August 2026 as the date of full general applicability, while acknowledging the implementation challenges related to standards and accompanying tools. 

For organisations, the subject is therefore no longer just about understanding the regulation.  

It is now possible to choose a training pathway that is adapted to their actual exposure, their role in the AI value chain, and their ability to produce proof of compliance.  

The work announced by the Commission for 2026 on: 

  • High-risk classification,  
  • The obligations of providers and deployers,  
  • The FRIA,  
  • The substantial modification, 
  • Post-market surveillance 

… confirm this shift towards a much more operational reading of the text. 

IA Act method

AI Act, quelle est la date d'entrée en vigueur ?

What has changed since January 2026

The start of 2026 marks a useful turning point in the reading of the AI Act.  The change is not in the text itself, but in its level of concretisation.  

With the publication of the FAQ “Navigating the AI Act” On 28 January 2026, the European Commission provided long-awaited clarifications on applicable obligations, the timeline, the logic of roles, and several operational issues related to compliance.  

In other words, the market is gradually moving out of a phase of general interpretation of the regulation and entering a more demanding phase:  cits practical interpretation,  dand prioritisation, eof proof.  

This evolution is reinforced by the roadmap programme announced for 2026 by the Commission, notably on:  

  • High-risk classification, 
  • The obligations of providers and deployers,  
  • The substantial modification,  
  • Post-market monitoring,  
  • Reporting serious incidents, 
  • The template for FRIA. 
Article AI Act Schema 2

Published 28 January 2026

Why is the publication of 28 January 2026 a tipping point?

The FAQ published on 28 January 2026 is not just another educational document. It serves as a market anchor for understanding how the AI Act should be implemented within organisations. It notably reminds us that the AI Act entered into force on 1 August 2024 and that it is fully applicable from 2 August 2026, barring exceptions provided for by the regulation.

This document is important for another reason: it reinforces a much more operational understanding of the subject.

It is no longer just a question of what the regulation says, but of how a company must map its uses, define its role, organise its governance, produce its initial evidence, and prepare the topics that will become the most sensitive in the coming months.

A pivot date, but several preparation scenarios

The 2 August 2026 Today remains the reference date from which the AI Act becomes fully applicable, barring exceptions provided for in the regulation itself. It is therefore still the correct steering date for a company that wants to seriously structure its compliance trajectory.

In parallel, the European Commission has also acknowledged the practical difficulties associated with the standardisation and availability of support tools. In this context, it linked the discussion about the Digital Omnibus to a scenario in which certain rules relating to high-risk systems would only become applicable upon the provision of the necessary tools, with a maximum deadline mentioned on the official standardisation page: 2 December 2027 for the high-risk systems covered by Annex III and 2 August 2028 for certain categories falling within Annex I. If such tools become available earlier, the Commission indicates that early application would remain possible.

The right instinct is therefore neither to ignore August 2026 nor to consider that a potential postponement would solve the problem. The right instinct is to manage using scenarios: keep the 2 August 2026 as a reference cap, while building a sufficiently robust trajectory to absorb any potential schedule adjustments.

What businesses need to secure right now

For many organisations, legal sophistication isn't yet a priority.

She is in the process of tidying up.

The first sites to be secured are generally known, but are still treated unevenly:

  • Mapping of AI systems,
  • Qualification of roles,
  • Clarification of responsibilities, First documentary evidence,
  • Governance arrangements,
  • Upskilling of teams.

On this last point, the Commission furthermore recalls that the obligations of’AI literacy already apply from 2 February 2025 to providers and deployers.

Depending on the company's level of exposure, it's also necessary to start preparing more structuring topics:

  • Transparency of certain systems,
  • Human surveillance logic,
  • Incident reporting preparation,
  • Post-market monitoring,
  • Ability to produce usable documentation in the event of a check, audit or internal review.

It is precisely on these subjects that the Commission's clarification work will further strengthen market expectations during 2026.

What this changes for the compliance, legal, risk and AI departments

Perhaps the main change for 2026 is this: the AI Act can no longer be treated as a mere regulatory watch topic or a matter for innovation teams. It is becoming a subject for cross-functional coordination between compliance, legal, risk, business, IT, and governance. Decisions made now on the qualification of uses, level of exposure, pace of the programme, and evidence to be produced will have a direct impact on the credibility of the compliance trajectory in the coming months.

In this context, the right question is no longer “should we prepare?”, but rather: On what realistic, prioritised and documented trajectory should the organisation be engaged? It is this question that differentiates reactive regulatory monitoring from a genuine, driven compliance programme.

Conclusion

In March 2026, the AI Act enters a more concrete phase. Companies will now have a clearer view of the European Commission's expectations, the main projects to undertake, and how to approach the pivot date and implementation scenarios. This is the right time to transform regulatory news into an operational trajectory: governance, mapping, evidence, prioritisation and management.

Key takeaways:

The AI Act 2026 framework is more precise than in 2025.

The 2 August 2026 the reference pivot date remains, even though the Commission has proposed an adjustment scenario for certain high-risk rules.

Companies must think in terms of compliance scenarios, not on passive standby.

The projects to be undertaken already cover governance, mapping, role qualification and evidence.

Do you want to clarify your compliance scenario, prioritise the projects to undertake and structure your initial evidence?

The JEMS teams will support you in transforming the AI Act into an operational, governable and documented programme.

Our team

Franck ARCHER

Vice President

Pascal DURY

Vice President

Bouzid KERDOUN

Expert Credit Risk

Hélène GENDRON

Senior Business Analyst

Erwin MENNE

Expert Data Governance

Youness AMRI

Expert Data Governance

MORE RESOURCES