EU AI Act Data Rules After the Delay

The AI Act's rules for high-risk systems, including Article 10 on training, validation and testing data, were due to apply on 2 August 2026. They no longer do. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and moved those obligations to 2 December 2027 for the stand-alone high-risk uses in Annex III and to 2 August 2028 for AI built into regulated products.

A US vendor could read "delayed" as "later." That would be a mistake for three reasons. Some obligations are live now. The Act reaches providers outside the EU whose systems are placed on the EU market or whose output is used there. And EU customers are writing 2027 obligations into contracts they sign in 2026. What follows separates what is settled from what is still pending as of September 2026. It describes the law; it isn't legal advice.

What is now law

The path was quick by EU standards. The Commission proposed the omnibus on 19 November 2025. Parliament set its negotiating position in March 2026, and negotiators reached a provisional agreement on 7 May 2026. Parliament approved the text on 16 June, the Council adopted it on 29 June, and it entered into force on 27 July, the third day after publication.

For anyone who prepares or supplies training data, these are the changes that matter:

Provision	Before the omnibus	After
Article 10 and the rest of Chapter III, Sections 1–3, for Annex III systems	2 August 2026	2 December 2027
The same rules for Annex I systems (AI in regulated products)	2 August 2027	2 August 2028
Processing special-category personal data to find and correct bias	Article 10(5), providers of high-risk systems only	New Article 4a; extended, under the same safeguards, to providers and deployers of other AI systems and models and to deployers of high-risk systems
AI literacy (Article 4)	Ensure, to their best extent, a sufficient level of AI literacy	Take measures to support the development of AI literacy
Machine-readable marking of generated content, for systems already on the market	2 August 2026	2 December 2026
Supplier agreements under Article 25(4)	AI systems, tools, services, components or processes	Adds AI models to the list
SME relief, including simplified technical documentation	SMEs	Extended to small mid-cap enterprises

The omnibus also added prohibitions on AI systems that generate non-consensual intimate imagery of identifiable people or child sexual abuse material, applying from 2 December 2026.

What Article 10 will require, unchanged in substance

The omnibus rewrote Article 10's first paragraph to point at the relocated bias provision and moved paragraph 5 into Article 4a. The core obligations a data team has to evidence did not change.

Article 10(2) requires eight data governance practices for training, validation and testing sets: design choices; collection processes and the origin of the data, including the original purpose for personal data; preparation steps such as annotation, labelling, cleaning, updating, enrichment and aggregation; the assumptions about what the data measures; the availability, quantity and suitability of the data; examination for biases that could affect health, safety or fundamental rights; measures to detect, prevent and mitigate those biases; and the data gaps that stand in the way of compliance. Article 10(3) asks that the sets be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for their intended purpose. Article 10(4) adds the geographic, contextual, behavioral and functional setting where the system will be used.

Each of those maps to an artifact a well-run data pipeline already produces:

Article 10 practice	Evidence that answers it
Collection processes and origin	Data inventory and a provenance manifest with owners, licenses and dates
Preparation operations	Annotation guidelines, agreement statistics, cleaning and deduplication logs
Assumptions and suitability	Use-case specification, coverage analysis by segment and period
Examination for bias, with mitigation	Error rates and label distributions by subgroup, with the decision taken on each gap
Errors and completeness	Label audit on a sample, measured error rate, missing-field report
Setting of use	Evaluation set drawn from the deployment geography and population

Those are the same records California's AB 2013 draws on for its public disclosure, which is why we keep one manifest for both.

What US vendors owe now

Scope. Article 2(1) applies the Act to providers placing AI systems or general-purpose models on the EU market, wherever they are established, and to providers and deployers in third countries where the system's output is used in the Union. A US company with no EU office can be in scope.

General-purpose models. Obligations for providers of general-purpose AI models have applied from 2 August 2025: technical documentation, information for downstream integrators, a copyright policy, and a public summary of training content using the Commission's template. The Commission's power to fine GPAI providers applies from 2 August 2026, and models placed on the market before August 2025 have until 2 August 2027.

Most enterprises fine-tune rather than pretrain, so the threshold for becoming a provider matters. The Commission's guidelines set an indicative criterion: a downstream modifier becomes the provider of the modified model when the modification uses more than one third of the original model's training compute; if that figure is unknown, the reference point is a third of 10²³ FLOP. A worked example: fully fine-tuning an 8-billion-parameter model on 200 million tokens takes about 6 × 8×10⁹ × 2×10⁸ ≈ 9.6×10¹⁸ FLOP, more than 3,000 times below a third of 10²³. Typical enterprise fine-tunes sit far under the line, but write the estimate down; it's the first thing a customer's counsel will ask for.

Transparency. Providers of generative systems must mark outputs in a machine-readable, detectable format. Systems placed on the market before 2 August 2026 have until 2 December 2026.

Literacy. The softened Article 4 still requires providers and deployers to take measures supporting the AI literacy of staff who operate and use AI systems on their behalf.

Contracts. Article 25(4) requires the provider of a high-risk system and any third party supplying an AI system, AI model, tools, services, components or processes used in it to specify by written agreement the information, capabilities, technical access and other assistance the provider needs to comply. Annotation, data preparation and evaluation are services and processes in that sense. Agreements signed this year will still be running in December 2027, so EU buyers are asking now for provenance records, annotation protocols, support for bias examination, records retention and audit access.

Exposure once the rules apply. Breaching most operator obligations, including those of providers under Article 16, carries fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher (whichever is lower for SMEs and small mid-caps). Under the amended Article 111(2), high-risk systems placed on the market before the new dates are covered only if their design changes significantly afterwards, except systems intended for public authorities, which must comply by 2 August 2030.

What is still pending

Harmonised standards. The omnibus cites delayed standards and guidance as a reason for the new dates, and directs the Commission to request further standardisation deliverables. Until harmonised standards are published and referenced in the Official Journal, providers can't rely on them for a presumption of conformity.
Implementing detail. The Commission is to establish a simplified technical documentation form that now covers small mid-caps as well as SMEs, and delegated acts on how Annex I sectoral rules interact with the Act are due by 2 August 2027.
The separate data omnibus. A companion proposal, COM(2025) 837, would amend the GDPR and several other data laws. None of it is law yet. Parliament's committees produced a draft report on 22 June 2026, and the file is still at committee stage.

A plan for the next fifteen months

This quarter: list every system and model with EU users or EU output, and write a short memo on GPAI status for each, including the compute estimate for any fine-tune. Finish output marking for generative systems already on the market before 2 December 2026.
First half of 2027: for each likely Annex III use case, build the Article 10 evidence pack from the table above, and measure subgroup performance on an evaluation set drawn from where the system will run. Teams already using the NIST AI Risk Management Framework can file this work under its Map and Measure functions rather than starting a parallel program.
In every new contract: agree an Article 25(4) schedule with suppliers and customers that names the records, access and support each side provides, and how long records are kept.
Before 2 December 2027: run the evidence pack past counsel and fix the gaps while there is still time.

Our data provenance and compliance work produces the inventory, manifest and bias analysis as part of preparing the data, and our evaluation work produces the subgroup measurements.

Checklist

Confirm whether each system or model is placed on the EU market or produces output used in the EU.
Record GPAI provider status for every model you release, with a written compute estimate for fine-tunes.
Mark generated outputs; legacy systems by 2 December 2026.
Keep an AI literacy program for staff who build and operate AI systems.
Map Article 10(2)'s eight practices to artifacts you already produce, and fill the gaps.
Measure bias by subgroup on data from the deployment setting, and log each decision.
Put Article 25(4) terms in supplier and customer agreements now.
Track the pending standards, implementing acts and the data omnibus without building on them yet.

The EU AI Act's data rules after the delay: what US vendors still owe