2 August 2026: the EU AI Act deadline European buyers keep underestimating

On 2 August 2026, the EU AI Act's obligations on General Purpose AI (GPAI) providers become enforceable, alongside the bulk of the high-risk-system regime. The headline penalties are large enough to focus attention: up to €35m or 7% of global turnover for GPAI provider non-compliance, €15m or 3% for broader breaches.

What actually needs to exist by August

Technical documentation aligned to Annex XI. A Code of Practice adherence position — signed or reasoned. A copyright policy for training data. A summary of training content sufficient for rights-holders to understand what was used. For high-risk deployers, a fundamental-rights impact assessment and a live human-oversight regime. None of these are checkbox items and none can be written in a fortnight.

What the contract market looks like

AI Governance and Assurance leads have moved from niche to scarce inside twelve months. AddanEx placements have interim AI Governance Leads landing €1,100–1,500/day across DACH and the Benelux, with genuine dual-hat operators — AI + data protection — pricing above €1,400/day. Time-to-shortlist has widened from 14 to 24 days on the same shape since Q3 2025.

The buyer trap

Treating this as a legal problem. Legal advisers can tell you what the Act says. They cannot instrument your models, write your training-data summary, run your evals, or design your human-oversight loop. That is engineering-plus-policy work, and the people who can do it are being hired now, not in August.

The GDPR parallel — and where it breaks

The 2018 GDPR contract wave rewarded generalists who could translate legal into operational. The 2026 AI Act wave rewards operators who can also stand behind an evaluation harness and a model card. Narrower pool. Higher rates. Shorter runway.