EU AI Act High-Risk Rules Effective August 2026: 5-Step Compliance Guide for Japanese Companies

The EU AI Act (Regulation (EU) 2024/1689) high-risk AI system rules become fully applicable from August 2, 2026. Japanese companies placing AI systems on the EU market are subject to extraterritorial application under Article 2.

Japanese companies are subject to the AI Act if: 1. They place AI systems on the EU market 2. Their AI outputs are used in the EU 3. They enter the EU market through EU-based importers, distributors, or representatives

1. Conformity assessment (Art. 43) — pre-market evaluation, internal or by third-party body for certain uses
2. CE marking (Art. 48) — declaration of conformity
3. Risk management system (Art. 9) — lifecycle risk identification and mitigation
4. Data governance (Art. 10) — training/validation/test data quality, bias detection
5. Technical documentation (Art. 11) — 10-year retention
6. Logging (Art. 12) — automatic logs accessible to authorities
7. Transparency (Art. 13) — user instructions, capability and limitation disclosure
8. Human oversight (Art. 14) — meaningful human supervision design
9. Accuracy, robustness, cybersecurity (Art. 15)
10. Fundamental Rights Impact Assessment (FRIA) (Art. 27) — required for certain deployers

Higher than GDPR's €20M / 4% benchmark. SMEs apply the percentage figure.

Step 1 (by June 2026): AI System Inventory — list all EU-market AI systems; classify against Annex III categories. Step 2 (by July 2026): Conformity Assessment Prep — select third-party body where required; design risk management system; prepare technical documentation. Step 3 (by August 2026): Operational Setup — appoint EU Authorized Representative; establish data governance; implement logging infrastructure. Step 4 (At application date): User Disclosures — EU-language instructions; capability and limitation statements. Step 5 (Ongoing): Continuous Monitoring — post-market monitoring; serious-incident reporting; periodic re-assessment.

• METI's AI Operator Guidelines (April 2024 v1.0): complementary but voluntary
• APPI: high-risk AI involving personal data triggers triple-layer compliance (APPI + AI Act + GDPR)
• Copyright Act Art. 30-4: Japan's training data exception coexists with EU AI Act's GPAI training-data summary disclosure obligation

The EU AI Act high-risk system regime takes effect on August 2, 2026, and Japanese companies are within scope through extraterritorial application. With penalties reaching 7% of global annual revenue, immediate action is needed: inventory, assessment, operations, disclosure, monitoring. Companies in HR Tech, medical devices, and financial services should begin EU Authorized Representative appointment and conformity assessment by June 2026.

For AI regulatory compliance, consult an attorney experienced in IT and international law.