When do EU AI Act high-risk obligations become mandatory?

August 2, 2026, under Article 113(2) of Regulation (EU) 2024/1689. Chapter III obligations for Annex III high-risk AI systems are binding from that date. A proposed Digital Omnibus delay to 2027 has not been enacted as of June 2026.

Does the EU AI Act apply to US-based AI companies?

Yes. The Act is extraterritorial. Any AI system placed on the market or put into service in the EU must comply, regardless of where the provider is located. US health-AI vendors serving EU patients fall inside scope.

Can one risk assessment satisfy the EU AI Act, HIPAA, and GDPR?

Partially. Article 9 risk management, the HIPAA Security Risk Analysis, and the GDPR Article 35 DPIA overlap enough to merge into a unified assessment document. Breach notification timelines and human-oversight duties conflict and need separate procedures.

Is healthcare AI automatically high-risk under the EU AI Act?

Not automatically. Clinical AI that is a medical device under Regulation (EU) 2017/745 is high-risk via the Annex I product-safety route. Other healthcare AI is high-risk only if it fits an Annex III category such as essential services or administration of justice.

Can a HIPAA Business Associate Agreement authorize AI training on PHI?

No. A BAA permits PHI use for covered functions but does not authorize training models on PHI. You must either de-identify the data under Safe Harbor or Expert Determination, or obtain separate patient authorization.

Five Weeks Until EU AI Act High-Risk Day. Is Your Stack Ready?

On August 2, 2026, the EU AI Act's high-risk obligations become binding under Article 113(2) of Regulation (EU) 2024/1689. As of June 28, 2026, that leaves exactly five weeks.

If your AI product touches US health data and serves any EU resident, you don't have one deadline. You have three frameworks landing on the same system at once: the EU AI Act, HIPAA, and the GDPR.

This is the AI compliance multi-framework problem. Most teams treat each regime as a separate track. That's the expensive way to fail. The three overlap heavily on risk assessment, documentation, and data governance, but conflict sharply on breach notification and human oversight. The work that survives is a unified stack, not three parallel projects.

TL;DR

August 2, 2026 is binding law, not a proposal. A Commission "Digital Omnibus" plan to push the date to 2027 has not been enacted as of June 2026. Plan for August.
High-risk status turns on Article 6. If your system is in Annex III or is a safety component of an Annex I product (including medical devices under EU 2017/745), it is high-risk.
Risk assessment, documentation, and data governance overlap across all three frameworks and can be merged into one artifact.
Breach notification and human oversight conflict. GDPR demands 72-hour authority notice; HIPAA allows 60 days to individuals. Run separate escalation paths.
HIPAA BAAs do not authorize AI training on PHI. De-identify or get separate authorization.

Key takeaways

The EU AI Act is extraterritorial. A US vendor serving EU patients is in scope.
Annex III has eight categories. Healthcare AI usually enters via the Annex I medical-device route, not Annex III directly.
Conformity assessment for Annex III systems is self-assessment plus CE marking and EU database registration. Notified bodies enter only for Annex I product-safety cases.
Fines reach €15 million or 3% of global annual turnover under Article 99.
Build the unified documentation architecture first, then layer framework-specific add-ons.

Is the August 2, 2026 deadline actually going to hold?

Yes, as of the publish date. Article 113(2) of Regulation (EU) 2024/1689 fixes August 2, 2026 as the application date for Chapter III high-risk obligations. The AI Act Service Desk timeline confirms it, and the AI Office has published guidance and tools assuming the date is live.

In November 2025 the Commission floated a "Digital Omnibus" package that would move high-risk obligations to 2027. As of June 28, 2026 that proposal has not been adopted into law. Betting your compliance calendar on an unpassed delay is how teams end up explaining themselves to a regulator. Keep building to August 2.

The penalty math makes the bet obvious. High-risk violations carry fines up to €15 million or 3% of global annual turnover. A documented good-faith effort to meet the binding date is worth far more than a wager on a delay that may never arrive.

How do you know your AI system is high-risk?

Article 6 sets two routes to high-risk classification. The first is the Annex III route: your system appears in one of eight listed categories. The second is the product-safety route: your system is a safety component of a product covered by Annex I harmonization legislation.

Annex III covers biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and administration of justice. Healthcare AI is the trap people misread. Clinical decision-support AI is not explicitly listed in Annex III unless it touches administration of justice or essential-services eligibility.

But if the same system is a medical device under Regulation (EU) 2017/745, it is high-risk through the Annex I product-safety route.

The defensible move is a written, category-by-category analysis. Walk through each Annex III entry, state why it does or does not apply, then check Annex I. Date the document. Reassess whenever the system's intended use changes. A bare assertion that "we're not high-risk" without that paper trail is a regulator's easiest win.

One common misconception: general-purpose AI models are never high-risk. Wrong in practice. GPAI models are regulated separately under Chapter V, but a GPAI model embedded in a downstream high-risk system inherits the high-risk obligations for that system.

What does the EU AI Act actually require of high-risk providers?

Chapter III Section 2 (Articles 8 to 15) is the core. Article 9 demands a risk management system running across the entire lifecycle. Article 10 requires data governance covering bias, relevance, and data gaps. Article 11 requires Annex IV technical documentation kept for 10 years. Article 12 requires automatic logging. Article 13 requires transparency to deployers. Article 14 requires built-in human oversight. Article 15 requires accuracy, robustness, and cybersecurity.

Section 3 adds provider duties. Article 16 requires a quality management system under Article 17, 10-year documentation retention, post-market monitoring under Article 72, and serious-incident reporting under Article 73. Article 71 requires registration in the EU database before market placement. Article 27 requires a Fundamental Rights Impact Assessment from deployers acting in the public interest.

Conformity assessment under Article 43 for Annex III systems is self-assessment. You verify compliance, draw up the technical documentation, run the QMS, affix the CE mark, and register.

Notified bodies enter only for Annex I product-safety systems such as medical devices. That sounds light. It isn't. Self-assessment still means you carry the full burden of proof if a regulator asks.

Where do HIPAA, GDPR, and the EU AI Act overlap?

The three frameworks were designed independently and apply to the same system at once. The trick is mapping overlap, conflict, and additive duties separately.

Risk assessment is the cleanest overlap. The EU AI Act Article 9 risk management system, the HIPAA Security Risk Analysis under 45 CFR 164.308(a)(1)(ii)(A), and the GDPR Article 35 DPIA all demand systematic risk identification and treatment. Squire Patton Boggs practitioners Tomaszewski and Komsitsky have shown these can be merged into a single assessment document, with the GDPR DPIA's Article 35(7) triggers mapping directly onto Annex III categories. KPMG Netherlands extends the same logic to the Article 27 FRIA, sequencing the DPIA so it feeds the FRIA.

Documentation also converges. EU AI Act Annex IV technical documentation, HIPAA written policies under 45 CFR 164.316, and GDPR Article 30 records of processing activities all describe the same system. A unified documentation architecture satisfies all three by default. Retention differs: 10 years for the AI Act, 6 years for HIPAA Security Rule, processing-duration-plus-3 for GDPR. Pick the longest and hold everything to it.

Data governance overlaps on access control, audit, and bias. EU AI Act Article 10 wants bias examination and data-gap analysis. HIPAA wants minimum-necessary access and audit controls. GDPR Articles 5, 25, and 32 want purpose limitation, minimization, and security by design. One data-governance spec can carry all three.

Where do the three frameworks conflict?

Two areas break the unified-stack approach and need separate procedures.

Breach notification timing. GDPR requires notice to the supervisory authority within 72 hours and to individuals without undue delay under Articles 33 and 34. The EU AI Act requires serious-incident reporting under Article 73 within 15 days. HIPAA allows up to 60 days to notify individuals under 45 CFR 164.404. The 72-hour GDPR clock and the 60-day HIPAA clock cannot share one workflow. Build two escalation paths from the same detection event.

Human oversight. EU AI Act Article 14 requires proactive technical measures that let a human understand, correct, or override the system. GDPR Article 22 gives the data subject a reactive right to request human intervention for solely automated decisions with legal effect. HIPAA imposes no AI-specific oversight duty at all, though Section 1557 of the ACA prohibits AI being the sole basis for a healthcare coverage denial. You need technical override built in for the AI Act, an individual request channel for GDPR, and a coverage-decision guardrail for HIPAA. Three mechanisms, one product.

What is additive to each framework?

Each regime carries duties the others don't. These are the parts you cannot merge.

EU AI Act only: EU database registration (Article 71), FRIA for public-interest deployers (Article 27), post-market monitoring (Article 72), CE marking, and the Article 5 prohibited-practices list already in force since February 2, 2025.

HIPAA only: Business Associate Agreements under 45 CFR 164.504(e) for any AI vendor touching PHI, the minimum-necessary standard, individual right of access, accounting of disclosures, and de-identification under Safe Harbor or Expert Determination. Critically, a BAA does not authorize training models on PHI. You must de-identify or obtain separate authorization. The FTC has also warned that "HIPAA certified" marketing claims are deceptive, because no federal HIPAA certification exists.

GDPR only: Lawful basis under Article 6 and special-category consent under Article 9 for health data, the full data-subject rights suite (access, rectification, erasure, portability, objection), DPO requirements under Articles 37 to 39, prior consultation under Article 36, and international transfer mechanisms under Chapter V.

How do you run the five-week sprint?

The window from June 28 to August 2 is tight but workable if you sequence it. The plan below assumes a small compliance pod with legal, security, engineering, and product representation.

Week 1, classification. Inventory every AI system in development or deployment. Apply Article 6 and Annex III to each. Document the PHI assessment and the EU personal-data scope. Produce a single classification decision per system with rationale and date.

Week 2, gap analysis. Run the Article 9 gap assessment, the HIPAA Security Risk Analysis, and the GDPR DPIA in one pass. Merge them into a unified risk register. Prioritize gaps by deadline criticality.

Week 3, documentation. Draft Annex IV technical documentation, the Article 17 QMS procedures, and Article 13 instructions for use in parallel. Update PHI policies for AI-specific risks. Refresh BAAs. Draft Article 30 processing records.

Week 4, technical controls. Ship the Article 14 human-oversight override path. Implement Article 12 automatic logging. Stand up HIPAA access, audit, and encryption controls and GDPR Article 32 security measures. Configure Article 10 data governance. Test the override end to end.

Week 5, validation and registration. Register high-risk systems in the EU database. Stand up Article 72 post-market monitoring. Draft the Article 73 incident reporting procedure alongside the GDPR 72-hour and HIPAA 60-day procedures. Train personnel. Validate documentation completeness.

What this means for you

If your AI product touches health data and serves EU residents, you are already inside all three frameworks. The question is whether you build one stack or three.

Build one. Merge risk assessment, documentation, and data governance into a single artifact set, then add the framework-specific duties as layers. Run breach response as three separate clocks from one detection event.

Document your high-risk determination with a category-by-category Annex III and Annex I walkthrough, dated, and revisit it whenever the system changes. And keep building to August 2, 2026 until a signed legislative text tells you otherwise.

HIPAA, GDPR, and the EU AI Act: One Stack, Three Frameworks, Five Weeks