All news
Regulation May 8, 2026 10 min

AI Act and DPO: how the DPO role changes with deployer obligations entering into force in August 2026

From August 2, 2026, obligations for deployers of high-risk AI systems (art. 26 AI Act) apply: what every operational DPO needs to know

UPDATE (July 2026): this calendar has changed

The Digital Omnibus package, adopted by Parliament on 16 June 2026 and by the Council on 29 June 2026, deferred the high-risk obligations: 2 December 2027 for Annex III (stand-alone systems) and 2 August 2028 for Annex I (AI embedded in regulated products). The Article 50 transparency duties remain confirmed for 2 August 2026. The text below is the version published before the amendment and is kept for documentary continuity.

Deadline August 2, 2026

From August 2, 2026, the obligations of articles 26 and 27 of the AI Act apply for deployers (users) of high-risk AI systems. If your client uses AI systems for recruiting, credit scoring, HR management, biometrics, student evaluation, or critical public services, you have less than 3 months to implement the compliance framework.

The 8 high-risk categories (Annex III)

  • Biometrics (identification, categorization, emotion recognition)
  • Critical infrastructure (traffic management, water/gas/electricity supply)
  • Education and training (admission, evaluation, monitoring)
  • Employment, worker management, access to self-employment
  • Access to essential private/public services
  • Law enforcement (crime risk, polygraphs, evidence reliability)
  • Migration, asylum, border control
  • Administration of justice and democratic processes

DPO's role: 5 concrete actions by July 2026

  • Inventory of AI systems used by your clients
  • Risk classification: assess if each system falls under Annex III
  • Map provider-deployer contracts
  • Update GDPR Art. 30 registers with AI references
  • Prepare FRIA template based on EDPB guidelines 02/2026

Practical tip

If you are DPO of a company with more than 100 employees, it's very likely that at least one AI system in HR (CV screening, performance management) falls under Annex III. Start there.

Official source:AI Act - EU Regulation 2024/1689

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Regulation
nullathe decision on a worker taken by the algorithm alone, from 23 October

A dismissal decided by the algorithm is void: from 23 October in Italy

Published in Official Gazette no. 234 of 8 October 2026 and in force since 23 October, decree no. 179/2026 provides that final decisions on the employment relationship cannot be based solely on automated processing, that the worker may request an understandable explanation, and that decisions taken in breach are void. In parallel, AI systems affecting work organisation enter the risk assessment under Article 28 of decree 81/2008. For a DPO this is the rare case where the consequence is not economic but civil, and it changes how the check is framed.

Oct 08, 2026New 8 min
Regulation
3signals that make notification due

Poland's UODO: not every breach must be notified. Public-register data on one side, PESEL, health and financial data on the other

If an invoicing system leaks only a sole trader's name, business name, tax number and registered address, already public in the business register, risk is normally unlikely. If it also leaks the national ID number, purchase details revealing health, or financial data, notification is due. Either way, the decision goes into the internal register.

Oct 05, 2026New 5 min
Regulation
120days to charge you, not to fine you

The 120 days are not the deadline to fine you: they are the deadline to charge you

Anyone who built an appeal on the authority's delay should re-read the calendar. The Court clarifies three things: the complaint procedure and the sanctioning procedure are autonomous, so overrunning the nine-to-twelve months on the complaint does not extinguish the power to fine; the 120 days are for notifying the charge, not for imposing the fine; and they run from the «definitive finding», which is not the first notice but the moment the authority can assess every element — including the hearing of your side. After the charge, only the five-year limitation period remains.

Sep 20, 2026 7 min