EU delays high-risk AI rules to 2027 as US state laws multiply

EU AI Act: transparency rules apply, high-risk duties delayed

August 2, 2026 was the general application date for the EU AI Act, and the Article 50 transparency rules apply from that date, Anaconda writes. Providers must design systems such as chatbots so people know they are talking to an AI, unless that is already obvious. Providers of AI that generates audio, images, video or text must mark the output in a machine-readable format so it can be detected as AI-generated.

Deployers of emotion recognition and biometric categorization systems must tell people when these systems are used on them. Deployers must also disclose deepfakes and label AI-generated text published to inform the public on matters of public interest, unless a human has reviewed it and holds editorial responsibility.

Providers of generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) marking requirement. Since August 2, the European AI Office can also enforce the rules for general-purpose AI models.

The high-risk obligations did not arrive on schedule. The "Digital Omnibus on AI" (Regulation (EU) 2026/1744, in force since July 27, 2026) delayed requirements including conformity assessments, risk management systems and human oversight. They now apply from December 2, 2027 for Annex III high-risk systems and August 2, 2028 for Annex I systems embedded in products. Annex III covers uses such as hiring, credit scoring, education, biometrics and access to essential services. Annex I covers AI built into products already regulated under EU safety law, such as medical devices or machinery.

The delay has drawn criticism. DIGITALEUROPE says it is not enough on its own and the rules need deeper fixes. Digital-rights groups EDRi, Access Now and ECNL, with Amnesty International, say the final deal "delays key protections, weakens transparency and creates a dangerous precedent for the EU digital rulebook."

NIST, OWASP and MITRE as reference points

The NIST AI Risk Management Framework cannot be enforced on its own, but laws and frameworks keep pointing to it. On February 17, 2026, NIST's Center for AI Standards and Innovation launched the AI Agent Standards Initiative, built on industry-led standards, community-led open-source protocols and technical research into agent security and identity. In April 2026, NIST published a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. No draft has been published, and neither effort has produced finished guidance yet.

State laws show NIST's influence more directly. Colorado's original AI Act (SB 24-205) offered an affirmative defense tied to frameworks such as the NIST AI RMF or ISO/IEC 42001. The replacement law, SB 26-189 (signed May 14, 2026, effective January 1, 2027), swapped that defense for a 60-day cure period and dropped the risk management program and impact assessment requirements. Texas's TRAIGA, in effect since January 1, 2026, provides a defense where a company substantially complies with NIST's Generative AI Profile or another recognized framework.

On the technical side, the OWASP Top 10 for LLM Applications and MITRE ATLAS give security and compliance teams a shared vocabulary. Neither carries a fine, but Anaconda says both come up regularly in vendor security questionnaires and procurement reviews. The company notes that Enkrypt AI, which joined Anaconda in August 2026, red-teams models and agents across more than 300 attack categories.

US: no federal law, a growing state patchwork

The US still has no comprehensive federal AI law. A December 2025 executive order pushes for a single national standard and challenges state AI laws, but Congress has not passed preemption. The states therefore set the rules for now.

• Texas's TRAIGA has been in effect since January 1, 2026.
• California's SB 53 requires large frontier model developers to publish safety frameworks and transparency reports and to report critical safety incidents to the state.
• Illinois's HB 3773 makes discriminatory AI use by employers a civil rights violation and requires them to tell workers and applicants when AI is used in employment decisions.
• Colorado's SB 26-189 takes effect January 1, 2027.
• New York City's Local Law 144 still requires bias audits for automated hiring tools.

Because these laws differ, Anaconda says many multinationals build to the EU AI Act's higher bar and adapt for US operations rather than run separate compliance programs.

Deadlines ahead and what they mean for teams

Anaconda lists four dates: December 2, 2026 for the Article 50(2) content-marking requirement for existing generative AI systems; January 1, 2027 for Colorado's law; December 2, 2027 for EU Annex III high-risk obligations; and August 2, 2028 for Annex I systems.

The practical advice from the company is to map each system's purpose against the Annex lists and to build an evidence trail before enforcement starts, since doing so under a deadline compresses a process that benefits from more runway. Anaconda also promotes its AI Policy Builder, which produces a draft policy and framework mapping, but says it is a starting point and not a compliance assessment or legal advice. The obligations, the company stresses, are delayed, not cancelled.