The EU AI Act and on-premise AI: what self-hosting actually changes.
Running AI on-premise does not by itself make you EU AI Act compliant. The Act regulates what an AI system does, not where it runs. What self-hosting changes is evidence: data locality, logging, and vendor independence become things you can demonstrate yourself instead of promises inherited from a provider's paperwork.
What are the EU AI Act compliance deadlines?
The deadlines changed in July 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) deferred the high-risk obligations, so most guides published before then, and most compliance emails in your inbox, still show dates that are no longer true. Here is the timeline as it actually stands:
| Date | What applies |
|---|---|
| 2 Feb 2025 | Article 5 prohibited practices (in force). |
| 2 Aug 2025 | General-purpose AI model obligations (in force). |
| 2 Aug 2026 | Article 50 transparency obligations, live now (grace period to 2 Dec 2026 for machine-readable marking on systems already on the market). |
| 2 Dec 2027 | High-risk obligations for Annex III stand-alone systems (deferred by the Omnibus). |
| 2 Aug 2028 | High-risk obligations for Annex I embedded systems (deferred by the Omnibus). |
Sources: Gibson Dunn · White & Case · Cloud Security Alliance
You have 16 months, not 16 weeks.
Anyone still telling you the AI Act “hits in August 2026” is behind. The transparency obligations of Article 50 are live today: if you deploy a chatbot, people must know they are talking to AI. The high-risk wave moved to December 2027. That deferral is not a reprieve to ignore; it is time to build your AI setup properly instead of in a panic, including deciding where your models should actually run.
Which obligations does self-hosting actually help with?
Honestly mapped, obligation by obligation: self-hosting is a real advantage in some places and irrelevant in others:
| Obligation | Does on-premise help? |
|---|---|
| Transparency (Art. 50) | Neutral. Users must know they're talking to AI wherever the model runs. |
| Logging and record-keeping (high-risk) | Yes. On your infrastructure the logs are yours: retention, format, and access are under your control, not dependent on a provider's export. |
| Data governance (high-risk) | Yes. Fine-tuning data never leaves your network, which makes provenance far easier to demonstrate. |
| Vendor chain | Yes. Fewer parties in your conformity story, and no API provider deprecating a model in the middle of your compliance cycle. |
| Risk classification | No. A high-risk use case is high-risk on your own rack too. Location changes nothing here. |
What self-hosting does not do.
It does not reclassify your system, and it does not remove any obligation. What it does is convert several paper promises into inspectable facts: where the data is, who touched it, what the model logged. If GDPR is the other half of your question, and it usually is, read how GDPR maps to LLM hosting choices.