Implementation Guidelines

Legal Framework

The AI Act deploys multiple implementation instruments. Article 41 authorises the Commission to adopt implementing acts establishing common specifications for high-risk AI requirements, but only after requesting a harmonised standard from a European standardisation organisation and where no reference is expected in the Official Journal within a reasonable period. Article 56 creates codes of practice as a Union-level soft-law instrument. Article 57 mandates national regulatory sandboxes operational by 2 August 2026. Article 50 imposes direct transparency duties on providers and deployers.

"The Commission may adopt, implementing acts establishing common specifications for the requirements set out in Section 2 of this Chapter"
— AI Act Art. 41

Common specifications function as a fallback: conformity grants presumption of compliance, but only where standardisation bodies have not delivered harmonised standards.

Key Developments

The EDPB has shaped implementation expectations through sectoral guidance. In Guidelines 05/2022 on facial recognition in law enforcement, the Board provided procurement and operational checklists for authorities deploying FRT systems. The EDPB-EDPS Joint Opinion 1/2026 on simplification of the digital legislative framework reveals tension between burden reduction and substantive compliance:

"this change would benefit a maximum of 1485 companies, saving each EUR 100, thus providing for total savings up to EUR 148,500 per year"
— EDPB-EDPS Joint Opinion 1/2026 §22

The modest projected savings illustrate that simplification proposals face scrutiny over whether they meaningfully reduce burden without weakening safeguards.

Status of the Debate

This topic is contested in principle, though no court split is on record yet for the AI Act's specific implementation mechanisms. The architecture layers hard-law instruments (common specifications under Article 41), soft-law mechanisms (codes of practice under Article 56), and experimental frameworks (sandboxes under Article 57). The boundaries between these layers — particularly the legal effect of codes of practice and the Commission's discretion to adopt common specifications where standardisation bodies have not delivered — remain undefined. Resolution will likely come through the first annulment actions before the General Court under Article 263 TFEU, testing whether the Commission's implementing acts respect the conditions of Article 41(1).

Practical Guidance

• Monitor standardisation timelines: Track whether the Commission has triggered Article 41(1)(a) by requesting a harmonised standard, as this is a precondition for common specifications.
• Engage with codes of practice: Providers of general-purpose AI models should participate in Article 56 processes, as codes cover obligations under Articles 53 and 55.
• Prepare for sandbox participation: National sandboxes must be operational by 2 August 2026 under Article 57; identify your competent authority early.
• Implement Article 50 transparency by design: Ensure AI systems interacting with natural persons disclose their AI nature, and mark synthetic outputs in machine-readable formats.
• Align with EDPB sectoral guidance: Where AI involves biometric data, follow the EDPB's practical checklists for necessity and proportionality assessments.