EU AI Act Timeline: Every Deadline After the Digital Omnibus

As of October 2026, the EU AI Act is already partly in force. Prohibited practices and AI literacy have applied since 2 February 2025, general-purpose AI rules since 2 August 2025 and Article 50 transparency since 2 August 2026. The Digital Omnibus pushed high-risk obligations back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Key takeaways

• The AI Act entered into force on 1 August 2024 and applies in stages, with the last transitional deadline on 2 August 2030.
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, is adopted law. It moved only the high-risk deadlines and added two new prohibitions; it did not pause the whole Act.
• Article 50 transparency duties (chatbots, deepfakes, AI-generated content) have applied since 2 August 2026, with a short grace period to 2 December 2026 for machine-readable marking on generative systems already on the market.
• Stand-alone high-risk systems listed in Annex III, such as CV screening or credit scoring, must comply from 2 December 2027.
• Your real deadline depends on your role (provider or deployer) and on which tier each AI system falls into, so start with an inventory, not a calendar.

Why the EU AI Act has so many dates

Regulation (EU) 2024/1689 was designed as a phased law. The legislators front-loaded the obligations that need the least preparation (stopping banned practices, training staff) and gave more time for the obligations that require engineering work, documentation and, in some cases, third-party conformity assessment. The official text on EUR-Lex sets the core schedule in Article 113; the Digital Omnibus then amended several of those dates in July 2026. A readable version of the amended Article 113 entry-into-application rules is a useful companion.

That staging is why "when does the EU AI Act come into force?" has no single answer. The Act is in force. What changes from date to date is which chapters apply, and to whom. If you want the background on the Act's structure first, read our EU AI Act guide; if you already know which systems you run and want to see where you stand, the free EU AI Act readiness assessment maps your answers to the obligations that apply to you and writes your first governance documents.

The full EU AI Act timeline, 2024 to 2030

The table reflects the Act as amended by Regulation (EU) 2026/1744, as of October 2026.

What already applies today (October 2026)

Prohibited practices and AI literacy (since 2 February 2025)

Eight categories of AI use have been banned since February 2025, including social scoring, manipulative techniques that cause significant harm, untargeted scraping of facial images and emotion recognition in workplaces and schools. The detail, including the two new bans added in 2026, is in our article on prohibited AI practices under Article 5.

AI literacy applied on the same day. The Digital Omnibus has since rewritten Article 4: the amended text frames the duty as taking measures to promote AI literacy among staff and others operating AI on your behalf, rather than ensuring a sufficient level. It is still a live obligation, so a documented training approach remains sensible.

General-purpose AI models (since 2 August 2025)

Providers of GPAI models, the companies that train foundation models, must keep technical documentation, give downstream providers the information they need, have a copyright policy and publish a summary of training content. Models with systemic risk carry extra duties under Article 55. Most organisations are downstream users here, not providers. See GPAI obligations and the Code of Practice for where the line sits.

Transparency under Article 50 (since 2 August 2026)

This is the obligation many businesses missed because they assumed "the AI Act was delayed". It was not delayed for transparency. Since 2 August 2026, a customer-service chatbot must tell people they are talking to an AI unless it is obvious, deployers of deepfakes must disclose them, and providers of generative systems must mark outputs in a machine-readable way. The only relief is for generative systems already on the market before 2 August 2026, whose providers have until 2 December 2026 to add marking. Our Article 50 transparency guide covers the practical steps.

What is still coming

2 December 2026: two new bans and the end of the marking grace period

The Omnibus added prohibitions on AI systems used to create non-consensual intimate imagery (so-called "nudifier" apps) and child sexual abuse material. If you run a platform that hosts third-party generative tools, check your acceptable-use terms and content controls before this date.

2 December 2027: Annex III high-risk systems

This is the deadline most companies outside regulated product sectors care about. An HR team using an AI tool to rank job applicants, a lender using a credit-scoring model, or a university using AI to assess exams will be deploying high-risk AI. Providers need a risk management system, data governance, technical documentation, logging, human-oversight design, conformity assessment, CE marking and EU database registration. Deployers need to follow instructions for use, assign competent human oversight, keep logs for at least six months and inform workers and affected people. The full list is in our guide to high-risk AI systems and Annex III.

2 August 2028: AI inside regulated products

Where AI is a safety component of a product already covered by EU harmonisation law, such as a medical device or industrial machinery, the AI Act obligations are folded into the existing conformity route. The Omnibus moved this from August 2027 to August 2028 to line up with sector rules and standards.

2 August 2030: public-sector legacy systems

Public authorities that deploy high-risk systems already in use get until 2 August 2030. Private-sector legacy systems are handled differently: under Article 111, high-risk systems placed on the market before the relevant application date are, broadly, only caught if they undergo significant changes in design afterwards. Read the amended transitional provisions carefully before relying on this.

Was the EU AI Act delayed?

Partly. The Digital Omnibus on AI delayed the high-risk obligations by roughly 16 months for Annex III systems and 12 months for Annex I products, mainly because harmonised standards and Commission guidance were not ready in time. It did not delay prohibitions, AI literacy, GPAI obligations or Article 50 transparency, and it added new bans. Treat the extra time as a planning window, not a reprieve.

How to turn the timeline into a plan

1. List every AI system you build, buy or use. Include embedded features such as Microsoft Copilot, CRM lead scoring and vendor chatbots.
2. Record your role for each system. Provider and deployer duties differ sharply, and a deployer who rebrands or substantially modifies a high-risk system can become its provider.
3. Assign a tier and a date. Use the four EU AI Act risk tiers to tag each system, then attach the deadline from the table above.
4. Close the "already applies" gaps first. Prohibited uses, AI literacy measures and Article 50 disclosures are enforceable now.
5. Start high-risk work in 2026, not 2027. Conformity assessment, documentation and vendor contracts take months, and procurement cycles are long.

Frequently asked questions

Has the EU AI Act been passed?

Yes. Regulation (EU) 2024/1689 was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It was amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force on 27 July 2026. Both are adopted EU law and directly applicable in every Member State without national transposition.

What are the key changes in the EU AI regulations for 2026?

Three things happened in 2026. Article 50 transparency obligations began to apply on 2 August 2026. The Digital Omnibus moved high-risk deadlines to 2 December 2027 and 2 August 2028 and rewrote Article 4 on AI literacy. And new bans on nudifier and child sexual abuse material systems were added, applying from 2 December 2026.

When do high-risk AI obligations apply?

For stand-alone high-risk systems listed in Annex III, such as recruitment screening, credit scoring or exam proctoring, the date is 2 December 2027. For AI that is a product, or a safety component of a product, under Annex I harmonisation legislation, it is 2 August 2028. Public authorities using legacy high-risk systems have until 2 August 2030.

Is the EU AI Act being enforced yet?

Yes, in part. Prohibitions have applied since February 2025 and the penalties chapter since August 2025, so national market surveillance authorities can act on banned practices. Article 50 transparency has been enforceable since August 2026, and the Commission can fine GPAI providers from the same date. Enforcement intensity varies by Member State.

Do the deadlines differ for companies outside the EU?

No. The same dates apply to any provider placing AI on the EU market and to providers or deployers outside the EU whose AI output is used in the EU. A US or UK company selling into Europe works to the same calendar, and non-EU providers of high-risk systems also need an EU authorised representative before placing them on the market.

Know which deadlines apply to you

A timeline only helps once you know which of your systems fall under which date. Assess your AI governance against the EU AI Act in about 40 minutes: answer 14 steps of questions and receive an AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template as editable Word documents, plus a maturity score across ten governance areas. It is free, with no card and no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Dates and statements reflect the position as of October 2026.