Since 2 August 2026, most of the EU AI Act is enforceable. The bans on prohibited practices, the AI literacy duty, the transparency rules for chatbots and generated content, and the obligations for providers of general-purpose AI models all apply today. What moved is the heaviest part: the high-risk regime for AI used in hiring, credit, education and essential services now starts on 2 December 2027, and for AI embedded in regulated products on 2 August 2028.
Many organisations still work from the old timeline, which put almost everything on 2 August 2026. This guide sets out the timeline as it stands in November 2026, what the Digital Omnibus changed, how to classify your AI use, what non-compliance can cost and which steps make sense now. Our AI Act impact check turns that into a personal profile for your organisation in a few minutes.
What the Digital Omnibus changed
The European Commission proposed the Digital Omnibus on AI on 19 November 2025, when it was clear that implementation was falling behind. The European Parliament adopted it on 16 June 2026 and the Council on 29 June. It was published as Regulation (EU) 2026/1744 on 24 July and entered into force on 27 July 2026.
The reason was practical. The harmonised standards that providers need to meet the high-risk requirements were not ready, and many member states had not set up their supervisory authorities. Gibson Dunn calls it a deferral rather than a dismantling: the risk-based architecture and the core obligations remain.
The main changes:
- High-risk deadlines move. Stand-alone systems listed in Annex III must comply from 2 December 2027 instead of 2 August 2026. AI that is a safety component of products under Annex I follows on 2 August 2028. Systems already on the market before those dates are only caught if they are substantially modified afterwards, and AI used by public authorities has until 2 August 2030.
- Two new prohibitions. From 2 December 2026, AI that generates realistic non-consensual intimate imagery of real people, including nudifier apps, and AI that generates child sexual abuse material are banned, according to Orrick’s analysis of the final text.
- AI literacy recalibrated. Providers and deployers must still take measures to build the AI literacy of their staff. They no longer have to guarantee a specific level, and the Commission and member states now have to support organisations, SMEs in particular, with practical examples.
- Small mid-caps join the SME regime. Companies that are no longer SMEs but have fewer than 750 employees and either up to €150 million in turnover or a balance sheet of up to €129 million get simplified documentation, priority access to sandboxes and lower fine caps.
- A stronger AI Office. The Commission’s AI Office gains exclusive supervision of AI systems built on a general-purpose model from the same provider or group, and of AI integrated into very large online platforms and search engines.
- A grace period for legacy marking. Generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking to their output.
- Narrower overlap with product law. AI in machinery is now handled through the Machinery Regulation, and the Commission must request unified standards that cover the AI Act and sector rules together.
The EU AI Act timeline as it stands
The AI Act is a regulation, so it applies directly in every member state. These are the dates that matter after the Omnibus.
| Date | What applies | Who is affected |
|---|---|---|
| 2 February 2025 | Prohibited practices and AI literacy | Every provider and deployer |
| 2 August 2025 | Obligations for general-purpose AI (GPAI) models | Model providers such as OpenAI, Anthropic, Google and Mistral |
| 2 August 2026 | Article 50 transparency, national enforcement, AI Office fining powers over GPAI providers | Anyone running chatbots, generating content or publishing deepfakes |
| 2 December 2026 | Two new prohibitions, legacy marking deadline | Providers of image and video generation |
| 2 December 2027 | High-risk systems in Annex III | HR, education, banks, insurers, public services |
| 2 August 2028 | High-risk AI in Annex I products | Makers of medical devices, toys and lifts |
| 2 August 2030 | Legacy high-risk systems used by public authorities | Public bodies |
The August 2026 rules reach far more organisations than the high-risk regime. If your website has a chatbot, people must be told they are dealing with AI unless that is obvious. Deepfakes must be disclosed. AI-generated text published to inform the public on matters of public interest must be labelled too, unless a human reviewed it and someone holds editorial responsibility. The Commission published a voluntary Code of Practice on marking and labelling AI-generated content on 10 June 2026, and final guidelines on Article 50 followed in July. We looked at what that means for image tools in our piece on ChatGPT Images 2.6.
How to classify your AI use
The AI Act classifies use, not technology. The same language model can be minimal risk in one company and high risk in the next, depending on what it is used for.
- Prohibited. Social scoring, harmful manipulation, exploiting vulnerabilities, emotion recognition in the workplace or in education, untargeted scraping to build facial recognition databases, biometric categorisation by sensitive traits, certain predictive policing and, from December 2026, nudifier apps.
- High risk. AI that decides or helps decide about people in the eight Annex III areas: biometrics, critical infrastructure, education, employment and worker management, access to essential services such as credit and life or health insurance, law enforcement, migration and border control, and justice and democratic processes. Plus AI that is a safety component of a product under EU harmonisation law.
- Transparency risk. Chatbots, generative AI, deepfakes, and emotion recognition or biometric categorisation that is not prohibited.
- Minimal risk. Most AI: spam filters, translation, internal writing assistants, product recommendations. The general AI literacy duty still applies.
An Annex III system may escape the high-risk label if it only performs a narrow procedural task or prepares a human decision without steering it. The exit is narrow. The Commission’s draft classification guidelines of 19 May 2026 make clear that you must document the assessment and still register the system, and any Annex III system that profiles people is always high risk.
Your role then decides your obligations. A provider develops an AI system or places it on the market under its own name. A deployer uses it professionally. Most organisations are deployers. Deployers of high-risk systems must follow the instructions for use, assign human oversight to people with the competence, training and authority to do it, keep logs for at least six months, and inform workers and affected people. Public bodies, providers of public services, and banks and insurers using AI for credit or insurance pricing must also carry out a fundamental rights impact assessment. Rebrand or substantially modify a system and you become its provider.
What non-compliance can cost
Fines under Article 99 come in three tiers:
| Infringement | Maximum fine |
|---|---|
| Prohibited AI practice | €35 million or 7% of worldwide annual turnover |
| Most other obligations, including transparency and high-risk requirements | €15 million or 3% of turnover |
| Incorrect or misleading information to authorities | €7.5 million or 1% of turnover |
Large companies face whichever is higher. SMEs, and since the Omnibus small mid-caps, face whichever is lower. An SME with €4 million in turnover therefore risks at most €120,000 for a transparency breach, not €15 million. AI literacy has no EU-level fine of its own, so penalties for it are left to member states.
GPAI providers fall under Article 101, with fines of up to €15 million or 3%. That is no longer theoretical. The AI Office’s powers became applicable on 2 August 2026, and on 29 August it sent its first formal requests for information to GPAI providers, Matheson reports. No fine had been announced at the time of writing.
Enforcement is a patchwork, for now
Member states had to designate their market surveillance authorities by 2 August 2025. Several missed that date. In Belgium, the telecom regulator BIPT is lined up to become the AI watchdog, but public broadcaster VRT reported in late July 2026 that no authority had been formally appointed. The Netherlands put its implementation bill out for consultation from April to June 2026, with ten existing regulators sharing the work and the Dutch data protection authority and digital infrastructure inspectorate coordinating.
That gap does not suspend the rules. The obligations apply directly, courts can hear claims, the AI Office supervises GPAI providers EU-wide, and data protection authorities keep their GDPR powers over AI that processes personal data. In practice, many organisations meet the AI Act first through procurement: large customers and public buyers already ask suppliers for their AI inventory and risk classification.
Is the AI Act holding back European innovation
The record of the past eighteen months points less at the rules themselves than at how slowly they were made usable:
- The high-risk classification guidelines were due by 2 February 2026. The draft arrived on 19 May 2026 and the final text is planned for the end of the year.
- The first harmonised standard, EN 18286 on quality management systems, was only cited in the Official Journal in October 2026. Standards for risk management, data and cybersecurity are still in draft.
- National enforcement structures are incomplete, so organisations often do not know who to ask.
That uncertainty has a cost. A 2022 appliedAI survey of over a hundred European AI start-ups put the expected compliance cost for a high-risk system at €160,000 to €330,000, with one in five expecting more. A February 2026 survey by ACT | The App Association, cited by TechRound, found that 58% of EU and UK developers had delayed launches because of regulation.
The counterweights are real too. Most AI sits in the minimal-risk class, and transparency duties are cheap to meet. The Omnibus lightened the load for smaller and mid-sized companies. And the EU is investing alongside the rules: EuroHPC opened its call for up to seven AI gigafactories on 30 July 2026, while the existing AI factories offer compute access to start-ups and SMEs. Mistral releasing Large 4 with open weights shows European labs keep shipping strong models under this framework. For the scale-up side of the debate, see our interview with Rudy Aernoudt on AI and scale-ups.
What to do before December 2027
- Build an AI inventory. List the AI systems and tools you use and build, who uses them and for what. Include AI features inside existing software such as your CRM, HR suite or finance tools.
- Record role and risk class per system. Provider or deployer? Prohibited, Annex III, transparency or minimal? Write down the reasoning, especially if you rely on the Article 6(3) exception.
- Remove anything prohibited. Check in particular for emotion recognition of employees in call-centre, video or productivity software. It has been banned since February 2025, except for medical or safety reasons.
- Fix transparency now. Add a clear AI notice to chatbots and voice agents, label deepfakes, and agree internally how AI-generated images and text are marked.
- Document AI literacy. Role-based training, an internal AI policy and a record of who completed what. No certificate is required, but evidence helps.
- Prepare high-risk use cases. If you use AI in recruitment, worker evaluation, credit or insurance pricing, ask your vendors how they will be ready by December 2027 and put it in the contract.
- Ask your model providers for documentation. If you build on GPT, Claude, Gemini or Mistral, the provider must give downstream builders the information they need. That duty has applied since August 2025.
The AI Act impact check on this page does the first two steps with you. You tick the AI you use or build, your size and the steps you have already taken, and get the risk class per use case, your personal deadlines, the maximum fine exposure and an action plan ranked by urgency. It is no substitute for legal advice, but it shows where to start. The check also has its own page: EU AI Act impact check. For an official second opinion, the Commission’s AI Act Service Desk offers a compliance checker and the full annotated text.
Frequently asked questions about the EU AI Act
Has the EU AI Act been delayed?
Only in part. The Digital Omnibus moved the high-risk rules to 2 December 2027 and 2 August 2028. Prohibitions, AI literacy, GPAI obligations and the Article 50 transparency rules kept their original dates.
Does the AI Act apply if we only use ChatGPT or Copilot?
Yes, lightly. You must take AI literacy measures and label AI content correctly when you publish it. If you use such a tool to make decisions about people, for example to screen job applicants, that use can become high risk even though the tool itself is general-purpose.
Does the AI Act apply to companies outside the EU?
Yes. It applies to providers placing AI on the EU market and to providers and deployers outside the EU whose AI output is used in the EU.
Do chatbots have to say they are AI?
Yes, since 2 August 2026, unless it is obvious to a reasonably well-informed user. A short notice at the start of the conversation usually suffices.
What is a small mid-cap under the AI Act?
A company that is no longer an SME but has fewer than 750 employees and either up to €150 million in turnover or up to €129 million in balance sheet total. Since July 2026 it gets the same relief as SMEs.
The deadline that matters is not in the regulation
December 2027 looks distant, but most organisations will feel the AI Act through their customers long before a regulator calls. Procurement teams are already writing AI requirements into tenders. Suppliers who can show an inventory, a documented risk classification and a literacy plan win those tenders, and the ones still waiting for the final standards will be catching up in 2027.
