Three milestones are now in force — the unacceptable-risk ban since 2 February 2025, GPAI obligations since 2 August 2025, and general applicability with Article 50 transparency since 2 August 2026. Next: the 2 December 2026 marking deadline, then high-risk Annex III on 2 December 2027. Brussels effect means Turkish RFPs already speak this language. The thesis-driven roadmap for serious operators.
The Dates That Define the Roadmap — Three Already Live
The EU AI Act does not arrive as a single deadline. It arrives in waves, and three of them have already landed. Prohibitions on unacceptable-risk systems became enforceable on 2 February 2025 — that ban is live now. General-purpose AI obligations took effect on 2 August 2025 — also live. General applicability and the Article 50 transparency rules followed on 2 August 2026 — live as well. Next come the 2 December 2026 marking deadline for generative systems already on the market, and then high-risk Annex III systems on 2 December 2027 (pushed back from the original 2026 date under the Digital Omnibus). Reading the regulation as a single future date is the most common mistake I see in board conversations — worse, treating it as a 2026 problem when the binding rules have been in force since early 2025. Treating it as a live calendar — and mapping your portfolio against each checkpoint — is what serious operators are already doing. The calendar is not on your wall for later; three of its checkpoints have already passed.
What Changed on 2 August 2026 — and What Didn't?
The Act now applies across the board. Since 2 August 2026, Article 50 is live: a chatbot has to tell people they are talking to a machine, deepfakes have to be labelled, and generative output has to carry machine-readable marking. The AI Office and national authorities picked up their enforcement powers the same day, and most breaches — Article 50 included — carry fines of up to €15M or 3% of global turnover. Two things moved. The Digital Omnibus — Regulation (EU) 2026/1744, published in the Official Journal on 24 July and in force since 27 July 2026 — pushed stand-alone high-risk obligations (Annex III) to 2 December 2027 and product-embedded ones (Annex I) to 2 August 2028. It also gave generative systems already on the market before 2 August a short runway: machine-readable marking is due by 2 December 2026. Systems launched after that date get no grace at all. What didn't move is the direction of travel. In early September the Commission's own list still showed about a dozen Member States, Germany and France among them, with market-surveillance authorities pending final adoption — and some teams read that as breathing room. I read it as a queue. Closer to home, Turkey still has no AI law — but the 2026–2030 AI Action Plan took effect by presidential circular on 18 August 2026, and KVKK published guidance on generative and agentic AI in March. The practical list for this quarter: an Article 50 disclosure audit of every customer-facing agent, a marking plan for generative features before 2 December, and a high-risk inventory finished long before 2027.
Risk Categories, Plain English
Four tiers. Unacceptable risk — social scoring, manipulative subliminal techniques, real-time biometric identification in public spaces with narrow law-enforcement exceptions. These have been banned outright since 2 February 2025. High risk — AI in critical infrastructure, education access, employment decisions, credit scoring, law enforcement, migration, justice. These face the heaviest documentation, testing, and post-market monitoring obligations. Limited risk — chatbots, deepfakes, emotion recognition — face transparency obligations, mostly disclosure that you're talking to a machine. Minimal risk — everything else, no formal obligation. Most enterprise AI deployments end up in high or limited. Knowing which one your system falls into is a thirty-minute legal exercise that almost nobody has done.
The Brussels Effect Hits Turkish RFPs
Turkey is not in the EU. The AI Act does not formally apply to Turkish organizations operating purely domestically. That sentence is technically correct and operationally useless. Any Turkish company with European customers, European data subjects, or aspirations to either is already negotiating contracts that reference AI Act compliance. By Q4 2025 we observed AI Act language appearing in defense procurement, fintech RFPs, and several mid-market SaaS tenders — none of which were legally required to include it. The procurement teams included it because their auditors asked for it. By the end of 2026, expect AI Act-equivalent language to be RFP standard regardless of cross-border exposure. That is the Brussels effect — regulatory gravity exported through purchase orders.
Sector-Specific Impact Inside Turkey
Defense — dual-use AI is partially exempted from the Act, but companies serving NATO partners or selling into European defense supply chains face de-facto application. BÖRÜ Pack-class systems live in this territory. Health — diagnostic AI is high-risk under the Act, period. Turkish healthtech companies aiming at European hospitals must plan for full conformity assessment. Finance — credit scoring, insurance pricing, and AML systems are explicitly named. Turkish fintechs with EU passport ambitions should already be scoping this. Public sector and education are next, with the longest tail because procurement cycles are slower. The pattern across sectors is consistent — the higher the consequence of an AI decision, the deeper the Act reaches in.
What Goes On the Roadmap
Five workstreams. AI inventory and classification — every system mapped to a risk tier with documented reasoning. Technical documentation — model cards, training data summaries, performance metrics, known limitations. The Act calls this Annex IV; we call it the file you wish you had during your last audit. Risk management system — continuous, not one-shot. Human oversight — designed into the workflow, not bolted on as a disclaimer. Post-market monitoring — the operational telemetry that tells you when a deployed model starts misbehaving. The same telemetry, incidentally, that AgentOps requires. Build the workstreams once, satisfy multiple frameworks. Trying to build separate compliance stacks for AI Act, ISO 42001, and KVKK is a budget-burning mistake.
What I Would Tell a Board Today
Three sentences. One — the AI Act is a procurement document long before it is a regulatory document, so the first cost of inaction is lost tenders, not fines. Two — the technical work to comply is roughly the same technical work to operate AI responsibly, so the marginal cost over what you should already be doing is low. Three — finish the inventory this quarter, complete high-risk classification before year-end, and treat Article 50 disclosures as overdue rather than upcoming: the 2 August 2026 general-applicability milestone has passed, and the prohibitions and GPAI rules have been in force since 2025. The calendar is fixed. The work is finite. The boards that treat this as a future problem will be answering uncomfortable questions when their first European tender response gets returned with a one-line note about AI Act readiness.