Where the record stands

The Record, written in October 2026. A retrospective. This piece closes the series and was written afterwards, from the documents. Nothing in this series was published at the time it describes.

Two years and two months after the AI Act entered into force, the honest summary is that very little of it has been tested and all of it has been read.

There has been one deferral, one omnibus, two application dates that arrived, and a great deal of commentary. No association I know of has been fined. Several have been asked awkward questions by a board member who read a newspaper. The gap between the volume of the regulation and the visible consequence of it is the defining feature of this period, and it is why so much of the work went undone.

The sequence, in one place

• 1 August 2024 — the Act entered into force. Nothing applied yet.
• 2 February 2025 — the prohibitions in Article 5 and the AI literacy duty in Article 4 began to apply.
• 2 August 2025 — obligations on providers of general-purpose AI models, plus governance and penalties.
• 19 November 2025 — the Commission proposed the Digital Omnibus, including a deferral of the high-risk timetable.
• 7 May 2026 — political agreement on the AI element of the Omnibus.
• 24 July 2026 — Regulation (EU) 2026/1744 published; in force on 27 July.
• 2 December 2027 — stand-alone Annex III high-risk obligations, deferred from 2 August 2026.
• 2 August 2028 — Annex I high-risk obligations.

Everything in the first three lines applies today. Everything in the last two is a promise about the future.

What actually changed for an association

Procurement got a vocabulary. In 2024 an association asking a supplier about the AI Act got a blank look. In 2026 the same question gets an answer, and the quality of that answer is now a usable proxy for the quality of the supplier. That is a real, permanent improvement and it came from the regulation, not from the market.

The prohibitions removed some products from the catalogue. Emotion inference on staff is gone from mainstream HR software, or hidden well enough that asking the question is uncomfortable for the vendor. A line was drawn and the market moved to it.

Nothing else changed visibly. The renewals engine still runs. The events platform still runs. The membership database is where it was. This is what regulation of general-purpose technology looks like from the inside: a great deal of paper for a small number of specific prohibitions and a long list of duties that most organisations were already, vaguely, trying to meet.

What did not change, and should have

The association's own understanding of its systems. In two years I have met very few organisations that could produce a list of the tools they use that make judgements about people — not a data map, not an asset register, a list of the decisions.

That list is the whole game. It is the input to the prohibitions question, the inventory question, the oversight question, the procurement question and the board question. It takes a morning with the right three people in a room. It has been the same morning's work since August 2024, through every deadline, deferral and omnibus, and it is the single thing the last two years have demonstrated that organisations will not do until somebody makes them.

The next two years, priced

December 2027 is fifteen months away. The work required by then is not fifteen months of work. For an association with a normal estate — a CRM, a renewals engine, an events platform, a recruitment process, one or two experiments with a chatbot — it is a quarter, done properly, and then maintenance.

The risk is not the deadline. The risk is that the deferral has taught the sector that deadlines move, and that the lesson will be learned most thoroughly by exactly the organisations that can least afford to learn it.

What this series was for

Ten years from now, the useful thing to have is not a prediction. It is a record of what the rules were, when they applied, and what a sensible organisation did about it at the time.

That is what these eight pieces are: the sequence, the prohibitions, the literacy duty, the model obligations, the omnibus, the agreement, the deferral, and this. Each one is dated to a document rather than to a mood, and each is written from the vantage of somebody who watched it happen and is not selling a compliance product.

If you run a member association and you have read this far, the next step is not a policy. It is a list. Sit with the person who knows the systems and write down every tool that makes a judgement about a person. You will finish in a morning, and you will know more about your own organisation than the last two years of regulation managed to teach anybody else about theirs.

---

The Record · ← Six days before the deadline

---

Running an association? The AI Act for associations — what your body must actually do sets out the whole thing on one page: whether you are a provider or a deployer, the four duties that reach a membership body, the dates that matter, and the five items of evidence a board will ask for.