Regulation (EU) 2024/1689 sets cybersecurity and accuracy expectations for high-risk AI systems. Article 15 covers accuracy, resilience, and cybersecurity, including resistance to attempts that alter use or performance. Article 9 requires a risk-management system, and that system is supposed to include testing. For many SaaS teams shipping LLM features, the practical question is not the legal text alone. It is what evidence you can hand to a customer, investor, or internal compliance lead when they ask how you tested against adversarial abuse.
The Digital Omnibus on AI moved several application dates.
A timeline maintained by the Future of Life Institute, updated 31 August 2026 from the amended text, puts Chapter III (including Articles 9 and 15) for Annex III high-risk systems at 2 December 2027, and for Annex I product systems at 2 August 2028. Article 50 transparency obligations applied on 2 August 2026. Annex III rules are not in force yet. Planning still matters because technical documentation and testing habits take time to build.