docs(compliance): update EU AI Act applicability dates

[Tionne Smith (electricwolfemarshmallowhypertext)]

Related Issue

Fixes #3649.

If no related issue is linked above, you must complete "Problem & Solution", "Impact on Your Work", and "Alternatives Considered" below.

Problem & Solution

docs/compliance/eu-ai-act-checklist.md still reflected the pre-amendment EU AI Act applicability schedule.

This PR updates the checklist for Regulation (EU) 2026/1744, including the revised high-risk application dates, Article 5 timing exceptions, Article 50(2) marking transition, and amended Article 4 AI literacy wording.

Impact on Your Work

N/A — linked issue #3649 describes the impact.

Timeline

None.

Alternatives Considered

N/A — linked issue #3649 describes the requested correction.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

Core & runtime:

• agent-governance-toolkit-core
• agent-primitives
• agent-os
• agent-mesh
• agent-runtime
• agent-sre
• agent-compliance

Governance & security:

• agent-mcp-governance
• agent-rag-governance
• agent-sandbox
• agent-discovery
• agt-policies
• policy-engine

Platform & tooling:

• agent-hypervisor
• agent-lightning
• agent-marketplace
• agent-governance-toolkit-cli
• agent-governance-toolkit-integrations
• agent-governance-toolkit-protocols
• agentmesh-integrations (framework integrations)

CLI plugins:

• agent-governance CLI plugins (copilot-cli / claude-code / opencode / antigravity-cli)

Shared / other:

• schemas
• action (GitHub Action)
• examples
• docs / root

Testing

Unit Testing

N/A — documentation-only change.

Manual Testing

• git diff --check passed.
• Verified the amended dates and Article 4 wording against Regulation (EU) 2026/1744 on EUR-Lex.

Checklist

• I have linked a related issue above, or completed "Problem & Solution", "Impact on Your Work", and "Alternatives Considered"
• My code follows the project style guidelines (ruff check)
• I have added tests that prove my fix/feature works
• All new and existing tests pass (pytest)
• I have updated documentation as needed
• I have signed the [Microsoft CLA](https://cla.opensource.microsoft.com/)

Attribution & Prior Art

• This contribution does not contain code copied or derived from other projects without attribution
• Any external projects that inspired this design are credited in code comments or documentation
• If this PR implements functionality similar to an existing open-source project, I have listed it below

Prior art / related projects (if any):

AI Assistance

• I can explain every meaningful change in this PR: what it does, why, and what tradeoffs were considered
• I have run tests and verification appropriate for this change
• No part of this PR was autonomously submitted by an AI agent without my review
• I have not used AI to generate review comments on others' PRs

If AI tools materially shaped this change, briefly note what was used:

AI assistance was used for source verification and review; all changes were manually reviewed before submission.

IP, Patents, and Licensing

• This contribution does not implement patent-pending or patent-encumbered techniques
• This contribution does not require an NDA or licensing agreement to understand or use
• Any AI tools used have terms compatible with the MIT License

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[Imran Siddique (imran-siddique)]

Verified every claim against the primary source rather than reviewing the prose, because a compliance checklist with wrong dates is worse than no checklist: it is consulted by people who will not check it.

It is all correct. Regulation (EU) 2026/1744, adopted 8 July 2026 and published in the OJ L series on 24 July 2026, amends Regulation (EU) 2024/1689 as regards simplification of the harmonised AI rules. Against EUR-Lex:

• Annex III high-risk obligations, Art. 6(2) — 2 December 2027 ✓
• Annex I high-risk obligations, Art. 6(1) — 2 August 2028 ✓
• Art. 50 transparency from 2 August 2026, with a four-month grace period for systems already placed on the market, which is where your 2 December 2026 date for Art. 50(2) machine-readable marking comes from ✓
• New Art. 5(1) points (ba) and (bb) ✓

This is not a cosmetic refresh. The document previously stated "high-risk system obligations from 2 August 2026". As of today that date has passed and no longer applies, so the checklist was telling readers a deadline had arrived when it had moved by sixteen months for Annex III and two years for Annex I. Wrong in the alarming direction rather than the complacent one, but wrong either way, and this is exactly the document someone reaches for when they need to be right.

Citing the amending regulation in the header rather than silently editing the dates is the correct form. A reader who remembers the old schedule needs to see why it changed, and "as amended by Regulation (EU) 2026/1744" is what lets them check you.

The Art. 4 rewrite is a genuine improvement too. "Outside the scope of a runtime governance toolkit" was a boundary claim with no reasoning; the new text says what Art. 4 obliges and then why the toolkit boundary sits where it does, including that the toolkit is not responsible for proving any individual's literacy level. Marking the quote as paraphrased rather than presenting it as the article text is the right correction.

Three red checks, all mechanical. Developer Certificate of Origin needs a sign-off (git commit --amend -s). Spell-check changed files flags GPAI, Harmonised and deployers, all legitimate terms of art from the regulation itself, so they belong in .cspell-repo-terms.txt. Validate docs frontmatter is the repo-wide stale-branch artifact fixed by #3619 earlier today, which clears on a rebase.

No approve bit on this repo, so a comment, but once those three are sorted I would merge it.

[Tionne Smith (electricwolfemarshmallowhypertext)]

Imran Siddique (@imran-siddique) Thanks for that. All three mechanical checks are fixed now: DCO sign-off added, the legitimate cspell terms are allowlisted, and the branch is rebased onto current main.

PR is updated and ready for another look.

[Prayag (prayagupa)]

Hey Tionne Smith (@electricwolfemarshmallowhypertext) following files need to be updated as well,

ls -l docs/compliance/
-rw-r--r-- 1 prayagupa prayagupa   6594 Aug  6 12:49 data-provenance-model.md
-rw-r--r-- 1 prayagupa  prayagupa   7819 Aug  6 12:49 fria-template.md
-rw-r--r-- 1 prayagupa  prayagupa  22134 Aug  6 12:49 mcp-owasp-top10-mapping.md
-rw-r--r-- 1 prayagupa  prayagupa   7726 Aug  6 12:49 post-market-monitoring.md

[Tionne Smith (electricwolfemarshmallowhypertext)]

Prayag (@prayagupa) Thanks — I checked all four against #3649 and the current repo.

I found:

• data-provenance-model.md: stale 2 August 2026 high-risk deadline
• fria-template.md: same stale deadline
• post-market-monitoring.md: same stale deadline
• mcp-owasp-top10-mapping.md: stale EU AI Act (Aug 2026) framework reference

I’ll update those four references to reflect the amended split dates: Annex III / Art. 6(2) from 2 December 2027 and Annex I / Art. 6(1) from 2 August 2028, and refresh the review dates where applicable.

Also noticed while checking:

• mcp-owasp-top10-mapping.md does not have the same explicit deadline block as the other three; its issue is the shorthand framework label
• the amendment means we should avoid replacing these with one blanket “new deadline” because the high-risk dates are now split by Annex III vs Annex I

I’ll keep the pass limited to those stale references only.

[liamcrumm]

Please fix DCO so that CI passes

[liamcrumm]

Fix DCO

[Tionne Smith (electricwolfemarshmallowhypertext)]

Fix DCO

Corrected liamcrumm