Already on the market? Article 111, the loophole the Omnibus left open

Everyone read the Omnibus headline: high-risk obligations moved to 2 December 2027. Almost nobody read what it left alone: Article 111, the transitional provision, still keys grandfathering to 2 August 2026. That one-sentence omission splits the market into three groups with wildly different obligations — and most compliance advice online does not distinguish them.

The three temporal classes

• On the market before 2 August 2026. The high-risk obligations apply only after a significant change in design (Art. 111(2)). No change — no conformity duty, indefinitely. Exception: systems intended for use by public authorities must comply by 2 August 2030 regardless. (The large-scale EU IT systems of Annex X have their own separate regime under Art. 111(1): placed on the market before 2 August 2027, compliance by 31 December 2030.)
• First placed on the market 2 August 2026 – 1 December 2027. No grandfathering. The full Chapter III stack applies on 2 December 2027 — and the conformity work (risk management, data governance, Annex IV, oversight design, conformity assessment) realistically consumes that runway.
• Placed on the market from 2 December 2027. Full compliance before market placement, no transition at all.

The significant-change trap

Article 111's protection ends at a “significant change in design” — a threshold the Act does not define and guidance has not yet settled. Retraining on new data, material parameter updates, switching the underlying foundation model, or extending the intended purpose to new contexts could each cross it. Treat every planned change to a legacy system as a classification event: assess it before shipping it, record the reasoning, and price losing grandfathering into the decision. A model swap that saves €2,000 a month and triggers the full conformity stack is not a saving.

What to document, starting now

• The placing-on-market date, with evidence — release notes, contracts, invoices, launch announcements.
• The system's design baseline as of 2 August 2026 — model, data, intended purpose, user groups.
• Every change since, dated, with a short assessment of whether it is significant — the log itself is the defence.
• Whether public authorities use it — that path has a 2030 deadline no change log can avoid.

The radar: what lands next

Being ahead of the Act now means watching five things, in this order:

• 2 December 2026— the new Article 5 prohibition (non-consensual intimate imagery) and the revised content-marking provisions, including for systems already on the market. The nearest hard date on everyone's calendar.
• Commission guidelines on high-risk classification and the significant-change threshold — drafts are circulating; when they land, every Article 111 position needs re-checking. Our rule set and changelog will record the delta.
• 2 August 2027 — legacy GPAI models (on the market before August 2025) must be Article 53-compliant.
• Harmonised standards (CEN-CENELEC JTC 21)— not expected complete before late 2026 at the earliest; their arrival defines what “presumption of conformity” concretely requires for December 2027.
• Member-state penalty regimes — national implementing rules are still landing; where you can be fined, and by whom, is becoming concrete country by country.

The assessment records the placing-on-market answer, flags the grandfathering analysis for counsel, and stamps the verdict with the rule-set version — so when the significant-change guidance arrives, you will know exactly which of your systems need a second look.