Is my AI system grandfathered under the EU AI Act?

Updated 9 August 2026 for Regulation (EU) 2026/1744.

Systems already on the market are grandfathered only conditionally, and the cut-off is no longer a fixed date. A high-risk AI system placed on the market or put into service before the date Chapter III applies to it — 2 December 2027 for Annex III systems, 2 August 2028 for Annex I — stays outside most of the Regulation under Article 111(2) until "significant changes" in its design. The Article 5 prohibitions apply regardless, synthetic-content systems owe Article 50(2) by 2 December 2026, and public-authority and Annex X systems face 2030 deadlines.

Quick answer

• The main rule, re-anchored: high-risk systems on the market or in service before "the date of application of Chapter III referred to in Article 113" are covered "only if, as from that date, those systems are subject to significant changes in their designs" (Article 111(2), as replaced by Regulation (EU) 2026/1744) — that is 2 December 2027 for Annex III systems and 2 August 2028 for Annex I (Article 113, third paragraph, point (c), as amended), sixteen and twenty-four months later than the 2 August 2026 originally fixed.
• The nearest deadline here: providers of synthetic audio, image, video or text systems placed on the market before 2 August 2026 owe Article 50(2) by 2 December 2026 (Article 111(4), added by the same amendment).
• The undefined term: "significant changes" has no operative definition. Recital 177 reads it as "equivalent in substance" to "substantial modification" (Article 3, point (23)) — but recitals are not operative law.
• No escape from Article 5: both grandfathering clauses are "without prejudice" to the prohibitions, which have bound every system since 2 February 2025.
• Hard deadlines anyway: public-authority high-risk systems by 2 August 2030 (Article 111(2)); Annex X systems on the market or put into service before 2 August 2027 by 31 December 2030 (Article 111(1)); GPAI models on the market before 2 August 2025 by 2 August 2027 (Article 111(3)).

What does Article 111(2) actually say?

The operative sentence, in full, as replaced by Regulation (EU) 2026/1744:

"Without prejudice to the application of Article 5 as referred to in Article 113, third paragraph, point (a), this Regulation shall apply to operators of high-risk AI systems, other than the systems referred to in paragraph 1 of this Article, that have been placed on the market or put into service before the date of application of Chapter III referred to in Article 113, only if, as from that date, those systems are subject to significant changes in their designs."

Four things follow. "Operators" is a defined term covering providers and deployers alike (Article 3, point (8)). The cut-off is no longer a fixed date but a pointer that moves with Chapter III. The trigger is prospective — only changes "as from that date" count. And the exemption is from the Regulation as a whole: an unchanged system escapes the full high-risk requirements, not just parts of them.

Two cautions. The provision says "the date of application of Chapter III" in the singular, but Chapter III now has two dates; the natural reading is that each system takes its own route's date — nothing settling it is in our source corpus as of 12 August 2026; verify before relying. And the window has not closed — anything placed on the market or put into service before that date still qualifies.

What counts as a "significant change"?

The Regulation does not define it, and no definition is in our source corpus as of 12 August 2026 — verify before relying.

What the Regulation does offer is recital 177: "the concept of significant change should be understood as equivalent in substance to the notion of substantial modification". Article 3, point (23) defines "substantial modification" as:

"a change to an AI system after its placing on the market or putting into service which is not foreseen or planned in the initial conformity assessment carried out by the provider and as a result of which the compliance of the AI system with the requirements set out in Chapter III, Section 2 is affected or results in a modification to the intended purpose for which the AI system has been assessed"

Two caveats. Recitals are interpretive aids, not operative provisions — a court would weigh recital 177 but is not bound by it. And the wording does not quite line up: the recital speaks of significant changes in "design or intended purpose", while the operative text says only "designs". Whether a pure purpose change ends grandfathering is genuinely open.

The conservative reading: treat any change made on or after your system's Chapter III date, not foreseen in the original design, that affects compliance or intended purpose as ending the grandfathering. Article 43(4) reinforces the borrowed logic — a substantial modification triggers a fresh conformity assessment, while changes "pre-determined by the provider at the moment of the initial conformity assessment" and documented in the technical documentation do not count, even for systems that continue to learn.

And whoever makes the substantial modification can become the system's provider under Article 25(1), point (b) — before customising a legacy system, read when a deployer becomes a provider.

Do the prohibitions apply to grandfathered systems?

Yes, without exception. Article 111(1) and Article 111(2) each open "Without prejudice to the application of Article 5", cross-referring to the prohibitions' date. A legacy system running social scoring or workplace emotion recognition — the latter outside the medical and safety exception — has been unlawful since 2 February 2025 under Article 5(1), first subparagraph, points (c) and (f), at the Act's highest penalty tier. Start any audit with the prohibited practices guide.

Which legacy systems get a hard deadline anyway?

Public-authority systems. Article 111(2), second sentence, as replaced: "In any case, the providers and deployers of high-risk AI systems intended to be used by public authorities shall take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030." No design change is needed — the clock runs regardless.

Annex X large-scale IT systems. Article 111(1) covers AI components of the large-scale EU IT systems listed in Annex X — the Schengen Information System, the Visa Information System, Eurodac and others. Those "placed on the market or put into service before 2 August 2027 shall be brought into compliance with this Regulation by 31 December 2030". One placed on or after 2 August 2027 gets no transitional period at all.

Is there a deadline for synthetic-content systems already on the market?

Yes — the nearest deadline here. Regulation (EU) 2026/1744 added Article 111(4), with no counterpart in the original text:

"Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026."

Not Article 111(2): no high-risk limitation, no change trigger, and a fixed cut-off.

Article 50(2) is the marking duty — outputs "marked in a machine-readable format and detectable as artificially generated or manipulated", by solutions "effective, interoperable, robust and reliable as far as this is technically feasible". Its exception carries over: it does not apply "to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences". Article 50 has applied since 2 August 2026; Article 111(4) gives pre-existing systems four months to retrofit.

Are GPAI models grandfathered too?

Briefly, yes. Article 111(3): "Providers of general-purpose AI models that have been placed on the market before 2 August 2025 shall take the necessary steps in order to comply with the obligations laid down in this Regulation by 2 August 2027." Unlike Article 111(2), this is a deferral, not a conditional exemption — there is no change-based trigger, and the amendment did not touch it. Models placed since then have owed compliance from the start, because Chapter V — the GPAI chapter — has applied since that date (Article 113, third paragraph, point (b)). See the GPAI guide and the EU AI Act timeline.

What this means for you

If you're a provider: Put every high-risk system in an inventory first — record when each one was placed on the market or put into service, and on what evidence, then set that against its route's Chapter III date (2 December 2027 or 2 August 2028). Then gate your release process: every change to a grandfathered system gets assessed against the Article 3, point (23) criteria before it ships, in writing. The Regulation gives no grace period once grandfathering ends, so the compliance work comes first. Complipath's register keeps each system's classification and reasoning attached, so the assessment is on record next to the system it protects.

If you're a deployer: Your exemption is only as stable as your vendor's changelog: a significant design change by the provider pulls the system, and your obligations with it, into scope whether or not you asked for it. Ask vendors of systems predating your Chapter III date how they assess releases against Article 111(2), in writing, and check your own customisation plans against Article 25. If a vendor's system generates synthetic content and shipped before 2 August 2026, ask what it is doing about Article 50(2) by 2 December 2026. If you are a public authority, or deploy a system intended for one, plan against 2 August 2030 — grandfathering buys time there, never permanence.

Which of yours were in service before the cut-off?

Classify your system now — 7 questions on the main line, plus follow-ups where they apply, no account, and the classification runs in your browser: answers stay there unless you choose to keep the result.

FAQ

Are AI systems deployed before August 2026 exempt from the EU AI Act? The date changed. Article 111(2), as amended by Regulation (EU) 2026/1744, runs from the date Chapter III applies — 2 December 2027 for Annex III systems, 2 August 2028 for Annex I — and high-risk systems placed before it are covered only if their designs then change significantly. The Article 5 prohibitions apply regardless.

What counts as a "significant change" under Article 111(2)? The operative text does not define it. Recital 177 says it should be understood as equivalent in substance to "substantial modification" — Article 3, point (23): a change not foreseen in the initial conformity assessment that affects compliance or the intended purpose. The amendment did not touch this wording.

Does grandfathering cover the prohibited practices? No. Article 111(1) and (2) both open "without prejudice to the application of Article 5". A prohibited practice in a legacy system has been unlawful since 2 February 2025, exposed to the Act's highest fines — up to €35 million or 7% of turnover.

When must GPAI models placed on the market before August 2025 comply? By 2 August 2027, under Article 111(3). This is a fixed deferral, not a conditional exemption — no design-change trigger applies. Models placed on the market on or after 2 August 2025 get no deferral: Chapter V, the GPAI chapter, has applied since that date under Article 113, third paragraph, point (b).

Sources: Regulation (EU) 2024/1689 (EUR-Lex), Articles 3, 5, 25, 43, 50, 111 and 113, Annex X, recital 177. Article 111(2) is quoted as replaced, and Article 111(4) as added, by Regulation (EU) 2026/1744 (EUR-Lex), in force 27 July 2026; Article 111(1) and Article 111(3) were not amended, and the 2 August 2030, 31 December 2030, 2 August 2027 and 2 February 2025 dates on this page are unchanged. Recital 177 is the recital of the 2024 Regulation and has not been restated for the amended Article 111(2) — nothing in our source corpus as of 12 August 2026 tests whether it still reads across to a moving cut-off; verify before relying. No definition of "significant changes" for Article 111(2) is in our source corpus as of 12 August 2026 — the Commission's guidelines on the AI-system definition touch Article 111(2) only in a footnote naming its grandfathering clause, and that footnote describes the provision in its pre-amendment wording, so the guidelines predate the Article 111(2) this sentence is about and could not have defined its terms; verify before relying. Recital 177 is the only interpretive aid inside the Regulation, and recitals are not binding operative provisions — the reading here is the conservative one, and the Court of Justice has the final word.