EU AI Act deadlines after the 2026 omnibus
By Philipp Kant updated 5 min read
The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s AI law, applied in stages since August 2024. Its high-risk deadlines moved in 2026: the Digital Omnibus on AI, in force since 27 July 2026, postpones the high-risk obligations to 2 December 2027 and 2 August 2028, while the Article 50 transparency duties have applied since 2 August 2026.
Most of what circulates about “the August 2026 deadline” was written before that omnibus. Here is the timeline as it stands now, and what it means if you run AI anywhere in your business.
The deadlines, before and after the 2026 omnibus
| Obligation | Enacted date | After the omnibus |
|---|---|---|
| Prohibited practices (Art. 5) | 2 Feb 2025 | In force, unchanged |
| AI literacy for staff (Art. 4) | 2 Feb 2025 | In force, unchanged |
| GPAI model rules and penalties | 2 Aug 2025 | In force, unchanged |
| Transparency duties (Art. 50) | 2 Aug 2026 | 2 Aug 2026, unchanged |
| Machine-readable content marking, systems already on the market | 2 Aug 2026 | Grace period to 2 Dec 2026 |
| New ban: AI that generates non-consensual intimate images or CSAM | not in the 2024 text | 2 Dec 2026 |
| High-risk systems, stand-alone (Annex III) | 2 Aug 2026 | 2 Dec 2027 |
| High-risk in regulated products (Annex I) | 2 Aug 2027 | 2 Aug 2028 |
The high-risk deadlines moved, but the law is not paused
The omnibus was agreed by Council and Parliament negotiators on 7 May 2026 and confirmed by the Council on 13 May. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The new dates are law. The heavy compliance package for high-risk systems (risk management, data governance, technical documentation, conformity assessment, CE marking, registration) moves from August 2026 to December 2027 for Annex III systems, and to August 2028 for AI embedded in regulated products.
Two things to keep straight:
- Everything that already applies keeps applying. The prohibitions, the AI literacy duty, the GPAI rules, and the penalty framework are in force today.
- “Delayed” applies to the high-risk track only. The omnibus changed nothing about the obligations themselves, only about when they bite.
So “is the AI Act delayed?” has a precise answer: the high-risk track is, by 16 and 12 months. The rest is not.
What applies since 2 August 2026: Article 50 transparency
The transparency duties were not postponed. Since 2 August 2026:
- Chatbots and voice systems must be designed so people know they are talking to an AI, unless that is obvious from context.
- Generated audio, images, video, and text need machine-readable marking. Deepfakes and AI text published to inform the public need a visible label on top.
- Permitted emotion recognition or biometric categorisation means the exposed people must be informed.
Systems already on the market get a grace period for the machine-readable marking until 2 December 2026. Systems placed on the market on or after 2 August 2026 do not.
What already applies today
- Prohibited practices (since 2 February 2025): manipulation that causes harm, social scoring, emotion recognition at the workplace, untargeted face scraping, and the other Article 5 practices. These are banned outright; there is no compliance path.
- AI literacy (since 2 February 2025): staff who operate or use AI need training matched to their role. This applies to every company using AI, regardless of risk class.
- GPAI rules (since 2 August 2025): obligations for providers of general-purpose models, plus the penalty framework. Fines reach €35M or 7% of global turnover for prohibited practices and €15M or 3% for most other violations; for SMEs, the lower of the two amounts.
What the new dates mean for a typical SMB use case
- A chatbot or voice agent on your website: transparency duties apply since August 2026. Disclosure and marking are design work, not lawyer work. If it is not in your current release, it is overdue.
- AI in recruiting, screening, or worker management: Annex III high-risk. The deadline moved to December 2027, but the work did not shrink: vendor selection, documentation, human-oversight design, and provider conformity all take quarters, not weeks. Treat December 2027 as a completion date, not a start date.
- AI-generated content in marketing: marking duties since August 2026, visible labels where the content informs the public.
- Internal use of general assistants (drafting, summarizing, coding): typically minimal risk. AI literacy still applies, and the classification is per use case: the moment the same model starts screening applicants, the classification changes.
The classification logic is the same one we apply when we build AI into German SMBs: the use case decides, not the tool. And as with GDPR cookie compliance, the companies that handle it calmly are the ones that classify early instead of reacting to the first warning letter.
Check your use case in two minutes
Our free EU AI Act Risk Check classifies one AI use case with six plain-language questions: risk class, the obligations for your role (provider or deployer), and the deadlines above, in English or German. It already reflects the omnibus dates.
FAQ
Is the EU AI Act delayed? Partially. The Digital Omnibus on AI, in force since 27 July 2026, moves the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The prohibitions, AI literacy, GPAI rules, and the Article 50 transparency duties are not delayed.
What has applied since 2 August 2026? If you run a chatbot, voice agent, or publish AI-generated content: the Article 50 transparency and marking duties. The AI literacy duty has applied since February 2025.
Are the new high-risk dates final? Yes. The omnibus was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. December 2027 (Annex III) and August 2028 (Annex I) are the legal dates.
We only use ChatGPT and Copilot internally. Are we affected? Mostly by the AI literacy duty. Internal drafting and summarizing is typically minimal risk. The classification flips when a use case touches an Annex III area, for example using AI to screen job applications.
What are the fines? Up to €35M or 7% of global annual turnover for prohibited practices, up to €15M or 3% for most other violations. For SMEs, the lower of the two amounts applies. The penalty framework has been in force since August 2025.
We build AI systems that clear these requirements by design: classification, disclosure, logging, and human oversight planned in from the start. See our services or run the AI Act Risk Check on your use case first.
