The EU AI Act's high-risk obligations bind from today
Annex III high-risk requirements under Articles 8 to 15 take effect today, covering risk management, data governance, technical documentation with ten-year retention, automatic logging, transparency, human oversight and accuracy testing. Article 50 transparency for AI-generated or AI-manipulated output activates alongside them, and GPAI fines start now for obligations that have applied since August 2025. Penalties reach €15M or 3 percent of global turnover for high-risk breaches, €35M or 7 percent for prohibited practices. The useful part for most teams is the negative: ordinary AI coding assistance does not trigger high-risk classification, because Annex III regulates specific uses such as worker management and regulated safety components. It binds if an agent evaluates or monitors developers for HR purposes, is embedded in critical infrastructure or a regulated product, or if a team fine-tunes or rebrands a model without disclosure under Article 25.