EU AI Act deadlines 2026–2028: what the Digital Omnibus changed

The EU AI Act (Regulation (EU) 2024/1689) has been partly delayed. Regulation (EU) 2026/1744 — the Digital Omnibus on AI, in force since 27 July 2026 — moved high-risk obligations to 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in regulated products. Nothing else moved: transparency, prohibited practices, AI literacy and general-purpose AI obligations are all enforceable now.

This article sets out the current dates, explains how to establish whether the Act applies to your organisation, and gives a step-by-step route to readiness. Two free resources sit alongside it: the EU AI Act Readiness Tool, which works out which obligations apply to you in a few minutes and needs no account, and the free compliance checks — a 40-obligation self-assessment covering 13 areas of the Act with Article references.

Key takeaways

• Regulation (EU) 2026/1744, the Digital Omnibus on AI, was signed on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 — six days before the Act's original high-risk deadline.
• High-risk obligations for stand-alone (Annex III) systems now apply from 2 December 2027; for AI embedded in regulated products (Annex I), from 2 August 2028.
• Nothing else was postponed. Article 50 transparency obligations have applied since 2 August 2026, and that is also when the AI Office and national authorities gained enforcement powers.
• The next hard date is 2 December 2026 — machine-readable content marking for generative systems already on the market, plus two new prohibited practices.
• Penalties run to €35 million or 7% of worldwide annual turnover for prohibited practices, and €15 million or 3% for most other breaches.
• Most organisations are deployers rather than providers, and deployer duties are narrower than the headlines suggest.

What are the current EU AI Act deadlines?

Source: European Commission, the enforcement framework of the AI Act, last updated 24 August 2026.

What did the Digital Omnibus actually change?

It deferred the high-risk regime, simplified parts of the Act and added two prohibitions. The Digital Omnibus on AI was proposed by the European Commission on 19 November 2025, reached provisional agreement on 7 May 2026, was approved by the European Parliament on 16 June and the Council on 29 June, signed on 8 July, published on 24 July and entered into force on 27 July 2026.

It deferred the high-risk regime. Chapter III obligations — risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, conformity assessment, CE marking and registration — were due to apply to Annex III systems from 2 August 2026. They now apply from 2 December 2027, with Annex I embedded systems following on 2 August 2028. The stated reason was practical: harmonised standards from CEN-CENELEC were behind schedule, Commission guidelines were still in draft, and several Member States had not designated competent authorities.

It simplified parts of the regime. Registration data points in Annex VIII were trimmed, technical documentation requirements were made proportionate for SMEs and small mid-caps, and the Article 4 AI literacy duty was reframed as an obligation to take measures supporting AI literacy rather than to ensure it.

It added new prohibitions. Two practices join Article 5 from 2 December 2026: placing on the market or using AI systems to generate child sexual abuse material, and systems producing non-consensual intimate or sexually explicit imagery of identifiable people. Both sit in the highest penalty tier.

A deferral leaves the architecture of the Act intact. Organisations gained sixteen months of preparation time on one part of the regulation while the rest became enforceable.

Does the EU AI Act apply to my business?

Yes, if you operate in the EU and use AI in any professional capacity. The Act's reach is not limited to EU-established organisations: it captures providers placing AI systems on the EU market wherever they are based, deployers established in the EU, and cases where an AI system's output is used in the EU. The Commission's Article 50 FAQ confirms this applies irrespective of whether the provider is established inside or outside the Union.

What varies is how much applies, and that comes down to two questions.

Step 1: what is your role?

You can hold more than one role, and a different role for different systems.

• Provider — you develop an AI system, or have one developed, and place it on the market under your own name or trademark.
• Deployer — you use an AI system under your authority in a professional context. This describes most organisations, including every company using a third-party AI tool for recruitment, customer service, document review or forecasting.
• Importer or distributor — you bring a third-party AI system into the EU market or make it available.
• GPAI provider — you provide a general-purpose AI model.

Buying an AI recruitment tool makes you a deployer. Fine-tuning it, rebranding it and selling it on can make you a provider, with a considerably heavier set of duties.

Step 2: what risk tier is each system?

• Prohibited — banned uses including social scoring, certain manipulative and exploitative practices, and certain biometric practices. From 2 December 2026, CSAM and non-consensual intimate imagery generation join this tier. There is no compliance route; these uses must stop.
• High-risk — Annex III use cases such as employment and worker management, credit scoring, education, essential public and private services, law enforcement and biometrics. Most obligations attach here, from 2 December 2027.
• Limited risk (transparency) — chatbots, synthetic media, emotion recognition, deepfakes. Disclosure duties apply, and they apply now.
• Minimal risk — everything else. The AI literacy duty still applies; the rest is voluntary.

Classification is driven by the use case rather than the technology. The same underlying model can be minimal risk in one deployment and high-risk in another. The Commission published draft guidelines on high-risk classification under Article 6 on 19 May 2026.

Which EU AI Act obligations apply to which role?

Read down your column. Rows marked "High-risk" apply only to systems classified in that tier.

What applies to your business right now?

Four things are enforceable today, regardless of where you land on the high-risk question.

• Article 5 prohibitions. In force since 2 February 2025. Screen your AI estate for manipulative and exploitative uses, social scoring, and prohibited biometric practices.
• Article 4 AI literacy. In force since 2 February 2025. Providers and deployers must take measures supporting AI literacy among staff who build or use AI systems. Training records are the evidence.
• GPAI obligations. In force since 2 August 2025 for providers of general-purpose models, covering documentation, downstream information and copyright policy. The Commission published guidelines on GPAI scope on 18 July 2026.
• Article 50 transparency. In force since 2 August 2026. People must be told when they are interacting with an AI system, deepfakes must be labelled, and emotion recognition and biometric categorisation must be disclosed. See the Commission's guidelines on transparency obligations, published 20 July 2026, and the voluntary Code of Practice on Transparency of AI-generated Content, which around 190 organisations had signed by the end of July 2026.

Enforcement is live. The AI Office supervises GPAI models and AI systems integrated into very large online platforms; national competent market surveillance authorities handle everything else, and the European Data Protection Supervisor covers EU institutions. The AI Office can request technical documentation, run model evaluations, require corrective measures and issue fines.

What happens on 2 December 2026?

Content marking catches legacy generative systems. Article 50(2) requires providers of systems generating synthetic audio, image, video or text to embed machine-readable marks identifying the content as AI-generated. Systems placed on the market from 2 August 2026 have had to comply since that date; systems already on the market before then were given a four-month grace period ending 2 December 2026. Content generated before 2 August 2026 does not need to be labelled retroactively, though the Commission encourages it where possible.

Two new prohibitions take effect. The CSAM and non-consensual intimate imagery prohibitions apply both to placing such systems on the market — including without adequate state-of-the-art safeguards against that output — and to deployers using them for that purpose.

What are the penalties for breaching the EU AI Act?

Source: European Commission, enforcement framework of the AI Act. National authorities set penalties for AI systems within their borders; the Commission handles GPAI model providers.

How do you prepare for the EU AI Act?

1. Build an AI system inventory. List every AI system your organisation builds, buys or embeds, including features inside SaaS products you already licence. Most organisations find more than they expected. Note for each whether it was placed on the market before 2 August 2026, because that determines the Article 50(2) position. An integration hub that pulls signals from your existing systems keeps that register current rather than stale.
2. Confirm your role for each system. Provider, deployer, importer or distributor, GPAI provider. Record the reasoning, because the role determines the obligation set.
3. Classify each system's risk tier. Prohibited, high-risk, limited or minimal. Document how you reached each classification. A classification without a rationale is difficult to defend, and the free readiness check walks through the logic in a few minutes.
4. Handle what is already enforceable. Prohibited-practice screening, AI literacy measures, Article 50 disclosures on anything user-facing, and GPAI documentation where applicable.
5. Diarise 2 December 2026. Content marking for pre-August generative systems, and a re-screen against the two new prohibitions.
6. Use the runway to 2 December 2027 deliberately. For any system likely to be high-risk, the fifteen months ahead need to cover a risk management system across the lifecycle, data governance for training and test data, technical documentation to Annex IV, event logging, human oversight design, accuracy and cybersecurity work, conformity assessment, the EU declaration of conformity, CE marking and EU database registration. Deployers of high-risk systems carry their own set, including a fundamental rights impact assessment under Article 27 where required. This is not a quarter's work — and Obligara's EU AI Act module tracks it as a live framework rather than a static list.
7. Reuse the evidence you already hold. If you run ISO 27001 or ISO 42001, a meaningful part of the AI Act governance evidence base — risk management, access control, logging, supplier management, incident response, competence records — already exists. Mapping it across is cheaper than building it twice; the same principle behind our 71-mapping ISO 27001 → SOC 2 cross-walk applies here.

What free EU AI Act tools are available?

The EU AI Act Readiness Tool — answer a short set of questions about your roles and systems and get back the specific obligations that apply to your organisation, with the dates they apply from and the relevant Article references. No account needed, and the result is downloadable. See how we handle your data.

Both sit alongside our other free compliance checks for ISO 27001, SOC 2, ISO 9001 and Cyber Essentials. None of them is legal advice. All of them are built to get you to a defensible position quickly enough that legal advice, when you take it, is about the hard questions rather than the inventory.

How does Obligara support EU AI Act compliance?

Obligara runs thirteen compliance frameworks — ISO 9001, ISO 27001, SOC 2, PCI DSS, ISO 42001, the EU AI Act and more — in one workspace, with a genuine cross-walk between them, embedded AI, and a named human signature on every record.

Its EU AI Act module models the Act as a live framework rather than a static checklist: obligations are instantiated as controls with Article references, applicability is computed from your roles and each system's risk tier, and a per-system inventory tracks classification, conformity work and fundamental rights impact assessments. Evidence gathered for ISO 27001 or ISO 42001 is reused where it applies rather than collected twice — the same cross-walk mechanism that carries 71 ISO 27001 mappings onto the SOC 2 Trust Services Criteria and removes roughly three weeks of duplicate work. The AI Consultant drafts the gap analysis and proposes mappings; a person reviews and signs off every record, and the audit log records the human signature, never the model's.

See the EU AI Act module or book a 30-minute walkthrough on your own scope.

Frequently asked questions

Has the EU AI Act been delayed?

Partly. Regulation (EU) 2026/1744 deferred the high-risk obligations: stand-alone Annex III systems now from 2 December 2027, and Annex I embedded systems from 2 August 2028. Nothing else moved. Prohibited practices, AI literacy, GPAI obligations and Article 50 transparency are all applicable and enforceable.

When did the EU AI Act become enforceable?

Enforcement powers for the AI Office and national competent authorities began on 2 August 2026. Prohibited practices and the AI literacy duty have applied since 2 February 2025, and obligations for general-purpose AI model providers since 2 August 2025.

Does the EU AI Act apply to companies outside the EU?

Yes. It applies to providers placing AI systems on the EU market regardless of where they are established, and where an AI system's output is used within the EU. Providers established outside the Union that offer high-risk systems must appoint an authorised representative in the EU.

Is my AI system high-risk?

It depends on the use case rather than the technology. Annex III lists the categories, including employment and worker management, credit and creditworthiness, education, essential services, law enforcement and certain biometric applications. Systems that are safety components of products already regulated under EU product-safety law fall under Annex I.

What is the difference between a provider and a deployer under the EU AI Act?

A provider develops an AI system, or has one developed, and places it on the market under its own name. A deployer uses an AI system under its authority in a professional context. Most organisations are deployers, and deployer obligations are narrower, though high-risk deployers still carry duties around human oversight, monitoring, log retention and fundamental rights impact assessments under Article 27.

What happens on 2 December 2026 under the EU AI Act?

Two things. Article 50(2) machine-readable content marking starts applying to generative AI systems that were already on the market before 2 August 2026, ending a four-month grace period. Two new Article 5 prohibitions also take effect, covering AI systems generating child sexual abuse material and non-consensual intimate imagery.

What are the penalties under the EU AI Act?

Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other breaches including GPAI model obligations, and up to €7.5 million or 1% for supplying incorrect or misleading information about an AI system. National authorities set penalties for AI systems within their borders; the Commission handles GPAI model providers.

What should we do before the December 2027 high-risk deadline?

Inventory, classify and connect. Build the AI system register, classify each system with a documented rationale, and map existing ISO 27001 or ISO 42001 evidence against the Act's requirements. Harmonised standards and notified body capacity are still developing, so organisations starting the conformity work late will meet the same bottleneck that caused the deferral.

Sources

• Regulation (EU) 2024/1689 (AI Act)
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal, 24 July 2026
• European Commission, the enforcement framework of the AI Act, updated 24 August 2026
• European Commission, guidelines on transparency obligations for providers and deployers of AI systems, 20 July 2026
• European Commission, Article 50 transparency FAQ
• European Commission, Code of Practice on Transparency of AI-generated Content
• European Commission, AI Office and AI Act policy page

All sources last verified 11 September 2026.