- A conversational agent delivered to EU users must disclose that it is a machine, and generated content must carry machine-readable marking: this has applied since 2 August 2026.
- High-risk conformity work moved to December 2027 and August 2028, and the classification guidelines are still draft: do not invest now in a bespoke framework.
- EN 18286:2026 is the first harmonised standard cited for this regulation: building a quality system against it is a differentiator in a European tender.
The timetable moved the opposite way to what was announced
The European Commission's official AI Act page, last updated on 19 October 2026, sets out the applicable timetable. The text entered into force on 1 August 2024, prohibitions and the AI literacy duty have applied since February 2025, governance and general-purpose models since August 2025, and general applicability since 2 August 2026.
The news lies elsewhere: rules for Annex III high-risk systems, covering biometrics, education and employment among others, will apply from 2 December 2027, and those for AI embedded in regulated products from 2 August 2028. Both deadlines were extended by the AI Omnibus, which entered into force on 27 July 2026. Advice written before the summer of 2026, announcing an August 2026 high-risk deadline, is therefore out of date.
Transparency is the only obligation enforceable today
Since 2 August 2026, the Commission's AI Office and national authorities have begun enforcing the regulation, and the transparency rules have applied. Three obligations concern a supplier directly: a conversational system must tell the user they are dealing with a machine, deepfakes must be labelled, and AI-generated or altered content must carry machine-readable marking.
This is the only part of the regulation that binds a Moroccan product aimed at European users right now. A customer-service agent, a synthetic voice on a phone system, visuals generated for a campaign: each falls within that scope. The Commission published a first list of more than 180 organisations that signed the code of practice on transparency of generated content.
No grace period is announced
One point deserves to be stated plainly, because the opposite is circulating. Several law firms assert a grace period until December 2026 for marking systems already in service. The Commission page announcing enforcement mentions none. Until that contradiction is resolved by an official source, no postponement should be promised to a client.
Caution applies the other way too. The Commission's guidelines on classifying high-risk systems are still draft, non-binding, pending the integration of consultation feedback, with no adoption date announced. The test that determines whether a product is high-risk is therefore not settled: a self-assessment carried out today may have to be redone.
A first harmonised standard to cite in tenders
On 19 October 2026, the Commission announced the publication in the Official Journal of the first harmonised standard supporting this regulation: EN 18286:2026, “Artificial intelligence — Quality management system for EU AI Act regulatory purposes”, developed by CEN and CENELEC. Providers of high-risk systems that implement it gain a presumption of conformity with the quality-management requirements of Article 17.
For a Moroccan company targeting the European market, this is a concrete and dated foothold. Building a quality management system on a standard cited in the Official Journal, more than a year before the constraint binds your European competitors, is something that can be written into a tender response. European buyers will start asking for it well before December 2027.
What European buyers themselves say
A Eurobarometer survey published on 14 October 2026 interviewed by telephone about 12,826 heads of privately owned EU SMEs and mid-caps, from 1 to 749 employees, with fieldwork in March and April 2026. It reports that 42% already use AI or some form of algorithmic management, mostly in a limited and experimental way, and that 21% plan to.
The three barriers cited come out almost level: investment cost for 50%, legal uncertainty for 49%, lack of expertise for 48%. That is exactly the commercial space for a supplier arriving with transparency handled and a quality approach anchored to a cited standard. Read it carefully: this survey covers heads of privately owned SMEs and mid-caps across the twenty-seven, not all European companies.
On the Moroccan side, data transfers still need a mechanism
A final point, often confused with the AI Act. Morocco does not appear on the European Commission's list of countries with an adequacy decision, and nothing changed on that front. Any personal-data flow from the Union to Morocco therefore still requires a dedicated mechanism, in practice standard contractual clauses together with a transfer impact assessment.
Domestically, law 09-08 remains the applicable text, and the CNDP has published no AI-specific deliberation: it still sits among its work in progress. In other words, the compliance pressure on a Moroccan company today comes from its European clients, not from a new Moroccan rule.
| Date | What applies | Status |
|---|---|---|
| 2 August 2026 | Transparency, general applicability, enforcement | In force |
| December 2026 | Prohibition on certain generated content | Upcoming |
| 2 December 2027 | Annex III high-risk systems | Postponed |
| 2 August 2028 | High-risk AI embedded in regulated products | Postponed |
Sources & methodology
This insight combines cited publications with editorial analysis. Illustrative examples are not client results. Vendor features and terms may change.