The EU AI Act and Self-Hosted AI: What Changes in August 2026

The Act entered into force on August 1, 2024 and applies in stages (dates from the Regulation's own text):

Penalties scale to the violation: up to €35M or 7% of global annual turnover for prohibited practices, lower tiers for other breaches. The reason this page exists on an on-prem hub: the August 2026 date is when the compliance questions stop being theoretical for ordinary companies — and the survey data on the stats page shows procurement already reacting.

Question 1 — is your use case high-risk? The Act classifies by what the system does, not where it runs. Annex III lists the high-risk domains: employment decisions (CV screening, promotion), education scoring, credit and insurance eligibility, essential-services access, biometrics, critical infrastructure, law enforcement. An internal document-summarization assistant is not high-risk; the same model wired into hiring decisions is. Most business deployments described on this hub — internal assistants, RAG over documents, drafting — fall outside Annex III and face only transparency-level duties (e.g., users must know they're interacting with AI). The classification exercise, done honestly per use case, is the first deliverable. Question 2 — are you a deployer, or also a provider? The Act splits duties between the provider (who develops/places the system on the market) and the deployer (who uses it under their authority). Self-hosting an open-weight model for internal use makes you a deployer of your system. Two escalations to know about: substantially modifying a high-risk system, or placing your own AI system on the market under your name, can move you into provider territory with its heavier documentation and conformity duties. And the GPAI model provider obligations (training-data summaries, technical documentation) sit with the model's maker — Meta, Alibaba, Mistral — not with a company that downloads and runs the weights; the Act also contains carve-outs easing some GPAI duties for open-source-released models. Where exactly your deployment sits is a counsel question; the point here is that the roles are defined and self-hosting doesn't blur them.

What it does not change: your obligations. A high-risk use case carries the same deployer duties — human oversight, input-data relevance, monitoring, incident reporting, record-keeping — whether the model answers from your rack or a vendor's API. Anyone selling "on-premise = AI Act compliant" is selling a category error; run them through the vendor checklist. What it genuinely changes — evidence and dependency:

• Logging you control. Deployers of high-risk systems must keep system logs. On your own gateway, log format, retention, and completeness are your decisions, already flowing into your SIEM — not a vendor export feature with a retention window you don't set.
• A stable object to assess. Your compliance documentation describes a model version you pin and change on your schedule. API models can change under you; your assessment then describes a moving target.
• No third-country data questions inside the AI workflow. The Act interlocks with GDPR in practice; an on-prem data path removes the transfer-analysis layer from the combined review (the GDPR page covers that half).
• One less party in the accountability chain. Vendor role changes, terms updates, and subprocessor churn all generate re-review work under a combined AI-Act/GDPR posture. A self-hosted open model turns that recurring workstream into a version-pinning decision.

The honest summary: the Act is workload regulation, and self-hosting is evidence infrastructure. Companies choosing on-prem "because of the AI Act" are usually choosing it for the same reason they choose it for GDPR — not exemption, but a shorter, self-owned path to demonstrating the things the law asks them to demonstrate.

For a company running (or planning) self-hosted AI, the preparation that counsel will not object to:

1. Inventory and classify every AI use case against Annex III — most will land outside it; the ones inside get the full treatment. 2. Stand up the logging now — the gateway-with-audit-log pattern from the deployment guide satisfies the record-keeping instinct of both this Act and GDPR, and it's a day of work. 3. Pin and document model versions — which model, which weights hash, which system prompts, for each use case. Trivial to do on owned infrastructure; this becomes your technical file's backbone if a use case is high-risk. 4. Add the transparency touches — users told they're talking to AI; AI-literacy training logged (already applicable since February 2025). 5. Put the high-risk use cases through counsel before August 2026 — with the inventory, logs, and version documentation above, that conversation is short.