EU AI Act Art.71: Exercise of the Delegation — Commission Delegated Acts, Five-Year Period, and Developer Compliance Guide (2026)

EU AI Act Article 71 is the procedural engine behind the Regulation's delegated powers architecture. Throughout Regulation (EU) 2024/1689, the Commission is authorised to adopt delegated acts — legally binding regulations that supplement or amend specific provisions of the AI Act without requiring a full legislative revision. Art.71 specifies the rules governing how the Commission exercises those powers: the duration of the delegation, the conditions under which the European Parliament or Council may revoke it, and the procedure for adopting and scrutinising individual delegated regulations.

For developers and compliance teams, Art.71 is directly relevant for two practical reasons. First, delegated acts adopted under the AI Act can expand the scope of high-risk AI system categories (Art.7), alter the technical documentation requirements for GPAI models (Art.52), or update the list of AI practices subject to harmonised standards (Art.97). Second, monitoring the delegated act pipeline is a compliance obligation — a system that was not classified as high-risk at deployment may become high-risk through a subsequent Commission delegated regulation that adds a new Annex III category.

The Commission's delegated power under the AI Act runs from 1 August 2024 (the date of entry into force) for an initial period of five years, with automatic renewal unless the Parliament or Council objects.

Art.71 in the Enforcement and Delegated Powers Architecture

Art.71 is not a standalone provision — it activates and constrains delegated powers granted at multiple points in the Regulation:

Art.71(1): The Five-Year Delegation Period

Art.71(1) grants the Commission the power to adopt delegated acts as referred to throughout the Regulation, subject to the conditions laid down in Art.71.

Duration. The delegation of power is conferred for a period of five years from 1 August 2024 — the date of entry into force of Regulation (EU) 2024/1689. The delegation therefore runs until 31 July 2029, unless renewed or revoked. Under Art.71(1), the Commission must draw up a report on the delegated powers no later than nine months before the expiry of the five-year period — i.e., by 31 October 2028 — to inform the renewal decision.

Tacit renewal. The delegation is automatically renewed for periods of identical duration unless the European Parliament or the Council opposes such renewal not later than three months before the end of each period. This means that, absent explicit opposition, the Commission's delegated power continues rolling for successive five-year blocks.

Practical significance for developers. The five-year delegation window (2024-2029) covers the entire initial compliance and implementation phase of the AI Act. Annex III amendments adding new high-risk categories, GPAI threshold adjustments, and technical documentation specification changes can all be adopted within this period. Organisations that locked their compliance posture at the August 2025 applicability date without monitoring the delegated act pipeline face the risk of becoming non-compliant with no substantive change to their systems.

Art.71(2): Right of Revocation

Art.71(2) gives the European Parliament or the Council the right to revoke the delegation of power referred to in Art.71(1) at any time.

Mechanism. A revocation decision must terminate the delegation of the power specified in the decision. It takes effect the day following publication in the Official Journal of the European Union, or at a later date specified in the decision. Revocation does not affect the validity of delegated acts that are already in force — acts adopted before the revocation remains valid.

Trigger conditions. Either the Parliament or the Council can initiate revocation independently, without the consent of the other institution. Revocation has been used rarely in EU legislative history, but the right is regularly exercised in areas where institutional tensions develop over the pace or direction of Commission delegated regulation.

Developer implications. Revocation would not automatically un-classify AI systems that became high-risk through a delegated act — a revocation terminates future delegated acts but does not repeal those already in force. Developers should not treat revocation risk as a pathway to reduced compliance obligations.

Art.71(3): Notification to Parliament and Council

Before adopting a delegated act, the Commission must notify the European Parliament and the Council of its intention. Art.71(3) requires this notification to include the content of the intended delegated act, the legal basis, and the urgency procedure considerations if applicable.

This notification is the practical trigger for the scrutiny period in Art.71(4). The Parliament and Council receive the notification and must decide within the scrutiny period whether to object.

Art.71(4): The Scrutiny Period — Objection Procedure

Art.71(4) establishes the standard scrutiny procedure for delegated acts under the AI Act.

Default period. A delegated act adopted under the Regulation shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of three months of notification of that act to those institutions. This three-month window runs from the date the Commission formally notifies the Parliament and the Council of the adopted act.

Extension. At the initiative of the European Parliament or the Council, the three-month period may be extended by three months — giving a maximum scrutiny period of six months for standard delegated acts.

Effect of objection. If either the Parliament or the Council objects within the scrutiny period, the delegated act does not enter into force. The Commission may then amend or withdraw the act. Objections are binding — either institution acting alone can block a delegated act.

Effect of non-objection. If neither institution objects within the scrutiny period, the delegated act is published in the Official Journal of the European Union and enters into force on the date specified in the act (typically after a defined implementation period).

Practical workflow for developers. The scrutiny period creates a predictable window between Commission adoption of a delegated act and its legal effectiveness. Monitoring the Commission's notification to the Parliament and Council — which is published in the Official Journal under the "L" series (legislative instruments) — gives compliance teams a minimum three-month lead time before a delegated act imposes new obligations.

Art.71(5): Urgency Procedure

Art.71(5) — cross-referenced with Art.73 (urgency procedure) — allows the Commission to adopt delegated acts that enter into force immediately upon notification if an urgent reason requires it. The Parliament and Council may still object during a reduced scrutiny period; if either institution objects, the delegated act is repealed.

Urgency triggers. The AI Act does not exhaustively define urgency, but consistent with EU legislative practice, urgency is available when:

• A newly identified AI risk poses immediate harm that existing legal provisions cannot address
• A technical development in AI capabilities creates a regulatory gap requiring immediate closure
• A Court of Justice ruling requires urgent regulatory response

Developer implications. Urgency procedure delegated acts bind immediately upon notification — there is no three-month lead time. Compliance teams monitoring the delegated act pipeline should treat urgency procedure notifications as requiring immediate assessment of impact on deployed systems.

Delegated Acts Already Adopted Under Art.71

Since the AI Act entered into force in August 2024, the Commission has begun exercising its delegated powers. Key delegated regulations to monitor:

Monitoring source. The official tracking mechanism for delegated acts under the AI Act is the Commission's delegated acts register, supplemented by EUR-Lex legislative documents under document type "R_DEL" and the EU AI Office's communications on GPAI-specific delegated regulations.

Art.71 vs. Art.73: Implementing Acts Distinguished

Art.71 covers delegated acts — the most legally significant form of Commission secondary legislation, which can amend or supplement the legislative text of the AI Act. Art.73 (not covered in this guide) covers implementing acts — Commission regulations that specify uniform implementation conditions but cannot amend the legislative text.

For compliance programmes, delegated acts require substantive assessment — they can change which AI systems are regulated and how. Implementing acts require operational adjustment — they change HOW existing obligations are fulfilled without changing WHAT those obligations are.

CLOUD Act Implications of Delegated Technical Specifications

When the Commission adopts delegated acts supplementing technical documentation requirements (Art.52(4)) or GPAI model obligations (Art.53(3)), the resulting compliance artefacts — training data provenance records, adversarial testing reports, incident reporting logs, model cards, conformity assessment documentation — may be stored on US-incorporated cloud infrastructure.

CLOUD Act production orders. If delegated technical specifications require extensive documentation of AI system capabilities, training data, and security properties, and those documents are stored on US-law-governed infrastructure, they become potentially accessible to US law enforcement through a CLOUD Act production order without EU legal process. The confidentiality provisions in Art.70(6) apply to penalty proceedings, but not to the underlying technical documentation stored pre-investigation.

Practical mitigation. AI Act compliance documentation — technical documentation (Annex IV/XI), conformity assessment records, post-market monitoring reports, incident response records, and adversarial testing results — should be stored on EU-incorporated, EU-law-governed infrastructure. Delegated acts may increase both the volume and sensitivity of required documentation; architecture decisions made before delegated acts are adopted should account for this trajectory.

Python DelegatedActMonitor Implementation

from dataclasses import dataclass, field
from datetime import date, timedelta
from enum import Enum
from typing import Optional


class DelegatedActStatus(Enum):
    ANNOUNCED = "announced"       # Commission announced intent
    CONSULTATION = "consultation" # Public consultation phase
    NOTIFIED = "notified"        # Notified to EP and Council, scrutiny running
    IN_FORCE = "in_force"        # Scrutiny passed, published in OJ
    OBJECTED = "objected"        # Parliament or Council objected
    WITHDRAWN = "withdrawn"      # Commission withdrew before entry into force
    URGENCY = "urgency"          # Urgency procedure — enters into force immediately


class DelegatedActImpact(Enum):
    HIGH_RISK_CLASSIFICATION = "high_risk_classification"  # Changes what is high-risk
    GPAI_THRESHOLD = "gpai_threshold"                      # Changes systemic risk FLOPs threshold
    TECHNICAL_DOCUMENTATION = "technical_documentation"    # Changes documentation requirements
    ANNEX_UPDATE = "annex_update"                          # General annex update
    DEFINITION_UPDATE = "definition_update"                # Updates AI definition


@dataclass
class DelegatedAct:
    act_id: str
    legal_basis: str            # e.g. "Art.7(2)"
    subject_matter: str
    impact_type: DelegatedActImpact
    status: DelegatedActStatus
    notification_date: Optional[date] = None
    scrutiny_deadline: Optional[date] = None
    entry_into_force: Optional[date] = None
    is_urgency_procedure: bool = False

    def days_until_scrutiny_deadline(self) -> Optional[int]:
        if self.scrutiny_deadline is None:
            return None
        return (self.scrutiny_deadline - date.today()).days

    def is_action_required(self) -> bool:
        if self.status == DelegatedActStatus.URGENCY:
            return True
        if self.status == DelegatedActStatus.NOTIFIED:
            days = self.days_until_scrutiny_deadline()
            return days is not None and days <= 45
        if self.status == DelegatedActStatus.IN_FORCE:
            if self.entry_into_force:
                return date.today() >= self.entry_into_force - timedelta(days=90)
        return False

    def compliance_lead_time_days(self) -> Optional[int]:
        if self.status == DelegatedActStatus.URGENCY:
            return 0
        if self.entry_into_force:
            return (self.entry_into_force - date.today()).days
        if self.status == DelegatedActStatus.NOTIFIED:
            return (self.scrutiny_deadline + timedelta(days=30)).days  # approximate
        return None


@dataclass
class DelegatedActMonitor:
    organisation_name: str
    has_high_risk_ai_systems: bool
    has_gpai_models: bool
    high_risk_categories: list[int] = field(default_factory=list)  # Annex III category numbers
    gpai_flops_estimate: Optional[float] = None                      # training FLOPs count
    tracked_acts: list[DelegatedAct] = field(default_factory=list)

    def add_act(self, act: DelegatedAct):
        self.tracked_acts.append(act)

    def relevant_acts(self) -> list[DelegatedAct]:
        relevant = []
        for act in self.tracked_acts:
            if act.impact_type == DelegatedActImpact.HIGH_RISK_CLASSIFICATION:
                if self.has_high_risk_ai_systems:
                    relevant.append(act)
            elif act.impact_type == DelegatedActImpact.GPAI_THRESHOLD:
                if self.has_gpai_models:
                    relevant.append(act)
            elif act.impact_type == DelegatedActImpact.TECHNICAL_DOCUMENTATION:
                if self.has_high_risk_ai_systems or self.has_gpai_models:
                    relevant.append(act)
            else:
                relevant.append(act)
        return relevant

    def action_items(self) -> list[str]:
        items = []
        for act in self.relevant_acts():
            if act.is_action_required():
                lead = act.compliance_lead_time_days()
                if act.status == DelegatedActStatus.URGENCY:
                    items.append(
                        f"URGENT: {act.act_id} ({act.legal_basis}) enters into force "
                        f"immediately — assess impact on {act.impact_type.value} now"
                    )
                elif lead is not None and lead <= 90:
                    items.append(
                        f"ACTION REQUIRED: {act.act_id} ({act.legal_basis}) — "
                        f"{lead} days until compliance required — {act.subject_matter}"
                    )
                else:
                    items.append(
                        f"MONITOR: {act.act_id} ({act.legal_basis}) scrutiny deadline "
                        f"{act.scrutiny_deadline} — {act.subject_matter}"
                    )
        return items

    def summary(self) -> str:
        relevant = self.relevant_acts()
        urgent = [a for a in relevant if a.status == DelegatedActStatus.URGENCY]
        in_force = [a for a in relevant if a.status == DelegatedActStatus.IN_FORCE]
        scrutiny = [a for a in relevant if a.status == DelegatedActStatus.NOTIFIED]
        return (
            f"Delegated Act Monitor — {self.organisation_name}\n"
            f"  Tracked acts (relevant): {len(relevant)}\n"
            f"  Urgency procedure (immediate): {len(urgent)}\n"
            f"  In force: {len(in_force)}\n"
            f"  Under scrutiny: {len(scrutiny)}\n"
            f"  Action items: {len(self.action_items())}"
        )


# Example usage
monitor = DelegatedActMonitor(
    organisation_name="ExampleCorp AI Team",
    has_high_risk_ai_systems=True,
    has_gpai_models=False,
    high_risk_categories=[4, 5],  # Art.6(2) + Annex III cat 4 (employment), cat 5 (education)
)

annex_iii_act = DelegatedAct(
    act_id="DEL-2025-ANNEX-III-EMPLOYMENT",
    legal_basis="Art.7(2)",
    subject_matter="Expanding Annex III category 4 (employment/HR AI) to include performance monitoring AI systems",
    impact_type=DelegatedActImpact.HIGH_RISK_CLASSIFICATION,
    status=DelegatedActStatus.NOTIFIED,
    notification_date=date(2025, 6, 1),
    scrutiny_deadline=date(2025, 9, 1),
    entry_into_force=date(2025, 12, 1),
)
monitor.add_act(annex_iii_act)

print(monitor.summary())
print("\nAction items:")
for item in monitor.action_items():
    print(f"  - {item}")

Art.71 Compliance Checklist

Series Context: Chapter IX Governance, Enforcement, and Penalties

EU AI Act Art.71 analysis based on Regulation (EU) 2024/1689 as published in the Official Journal of the European Union. Delegation period runs from 1 August 2024. Delegated act tracking information is current as of April 2026 — the Commission's delegated act pipeline is subject to change. CLOUD Act conflict analysis reflects the state of EU-US data transfer frameworks as of 2025. This guide reflects the text of the Regulation as enacted and does not constitute legal advice.