The EU AI Act obligations for high-risk AI systems apply from 2 December 2027 for the stand-alone systems listed in Annex III, such as recruitment or credit scoring, and from 2 August 2028 for AI systems in products covered by Annex I. These dates were set by the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026.
The AI Act is an EU regulation, Regulation (EU) 2024/1689 of 13 June 2024, that lays down horizontal rules on artificial intelligence. It sorts AI uses by risk: prohibited practices, high-risk systems, transparency duties for certain systems, and specific rules for general-purpose AI (GPAI) models. It entered into force on 1 August 2024 and applies in stages. This page gives each date as it stands on 4 November 2026, after the July 2026 amendments.
What is law, and what was only a proposal?
The Commission proposed the Digital Omnibus on AI on 19 November 2025. That proposal would have linked the start of the high-risk rules to the availability of standards and support tools, with fallback dates. The co-legislators replaced this mechanism with fixed dates. The steps were:
- political agreement between Parliament and Council in May 2026;
- European Parliament position on 16 June 2026, Council adoption on 29 June 2026;
- signature on 8 July 2026, publication in the Official Journal on 24 July 2026;
- entry into force on 27 July 2026, the third day after publication (Article 4 of Regulation (EU) 2026/1744).
The dates below are therefore law, not a forecast. Older articles announcing "2 August 2026" for Annex III systems, or a conditional delay, are out of date.
What are the key dates of the AI Act?
| Date | What applies | Article | Who is concerned |
|---|---|---|---|
| 12 July 2024 | Publication in the Official Journal (OJ L, 2024/1689) | Art. 113 | All operators |
| 1 August 2024 | Entry into force; no obligation applies yet | Art. 113 | All operators |
| 2 February 2025 | General provisions, including AI literacy (Art. 4), and the prohibited practices of Art. 5 | Art. 113(a) | Providers and deployers; anyone placing on the market, putting into service or using AI systems |
| 2 August 2025 | Notifying authorities and notified bodies, GPAI model obligations, governance (AI Office, AI Board, national authorities), penalties except fines on GPAI providers, confidentiality | Art. 113(b) | GPAI model providers, Member States, notified bodies |
| 27 July 2026 | Digital Omnibus on AI in force: new AI literacy wording, bias-detection data rule (Art. 4a), measures for small mid-caps; Articles 102 to 110 apply | Reg. 2026/1744; Art. 113(d) | All operators |
| 2 August 2026 | General date of application: transparency obligations (Art. 50), Commission fines on GPAI providers (Art. 101) and other provisions without a specific date | Art. 113 | Providers and deployers of chatbots, generative AI, emotion recognition or biometric categorisation systems and deepfakes; GPAI providers |
| 2 December 2026 | Two new prohibitions: non-consensual intimate imagery of identifiable persons and child sexual abuse material; marking of synthetic content for generative systems already on the market before 2 August 2026 | Art. 5(1)(ba) and (bb), Art. 113(a); Art. 111(4) | Providers and deployers; providers of generative AI systems |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply; at least one national AI regulatory sandbox operational | Art. 111(3); Art. 57(1) | GPAI providers; Member States |
| 2 December 2027 | High-risk rules (Chapter III, Sections 1 to 3) for Annex III systems | Art. 113(c)(i) | Providers, deployers, importers, distributors, authorised representatives |
| 2 August 2028 | High-risk rules for AI systems covered by Annex I product legislation | Art. 113(c)(ii) | Product manufacturers and providers |
| 2 August 2030 | High-risk systems intended for public authorities, already on the market, must comply | Art. 111(2) | Providers and deployers serving public authorities |
| 31 December 2030 | AI components of large-scale EU IT systems (Annex X) placed on the market before 2 August 2027 | Art. 111(1) | Operators of those systems |
High-risk systems placed on the market before the relevant Chapter III date are covered only if their design changes significantly after that date (Article 111(2) as amended), except systems for public authorities, which must comply by 2 August 2030.
What changed with the Digital Omnibus on AI?
- High-risk dates: 2 December 2027 for Annex III, 2 August 2028 for Annex I (previously 2 August 2026 and 2 August 2027).
- Prohibitions: AI systems that generate or manipulate realistic intimate images of an identifiable person without explicit consent, or child sexual abuse material, are banned from 2 December 2026.
- AI literacy (Art. 4): providers and deployers must take measures to support the AI literacy of their staff; the text now states that they do not have to guarantee a specific level for any individual. The Commission will publish practical examples.
- Sandboxes: national AI regulatory sandboxes must be operational by 2 August 2027 instead of 2 August 2026.
- Small mid-caps: support measures are extended to small mid-cap enterprises, and their fines are capped at the lower of the percentage or the amount (Art. 99(6a)).
- Supervision: the AI Office gains competence over AI systems built on a GPAI model by the same provider, with exceptions where national authorities stay competent, such as law enforcement, border management, judicial authorities and financial institutions.
- Unchanged: the prohibitions in force since 2 February 2025, GPAI obligations since 2 August 2025, Article 50 from 2 August 2026, and the fine ceilings (up to EUR 35 million or 7 % of worldwide turnover for prohibited practices).
Which guidelines, codes and standards are available?
| Date | Document | Status |
|---|---|---|
| 4 February 2025 | Commission guidelines on prohibited AI practices | Published, non-binding |
| 6 February 2025 | Commission guidelines on the AI system definition | Published, non-binding |
| 10 July 2025 | General-Purpose AI Code of Practice (transparency, copyright, safety and security) | Voluntary; confirmed by the Commission and the AI Board as an adequate tool |
| 18 July 2025 | Guidelines on the scope of GPAI provider obligations | Published, non-binding |
| July 2025 | Template for the public summary of GPAI training content | Published |
| 19 May 2026 | Draft guidelines on high-risk classification (Art. 6(5)) | Draft; the legal deadline was 2 February 2026 |
| 10 June 2026 | Code of Practice on transparency of AI-generated content | Final, voluntary |
| July 2026 | Guidelines on transparency obligations (Art. 50) | Published, non-binding |
| 14 October 2026 | EN 18286:2026 on quality management systems, the first harmonised standard cited for the AI Act (Implementing Decision (EU) 2026/2274) | Presumption of conformity for the requirements it covers |
The standardisation request C(2025) 3871 of 23 June 2025 asks CEN and CENELEC for standards in ten areas, including risk management, data governance, logging, transparency, human oversight, accuracy, robustness, cybersecurity, quality management and conformity assessment. EN 18286 is the first of these to be cited; check the Commission's standardisation page for any later citation.
What should organisations do now?
- List the AI systems and models you build, buy or use, and classify each one: prohibited, high-risk (Annex III or Annex I), Article 50 transparency, or other.
- Remove or block any use covered by the prohibitions, including the two that apply from 2 December 2026.
- Document your AI literacy measures for staff who operate or use AI systems.
- Check that chatbots disclose they are AI and that synthetic content is marked: Article 50 already applies.
- For Annex III use cases, plan risk management, data governance, logging, human oversight and a quality management system before 2 December 2027.
- Add AI Act clauses to supplier contracts, so that providers deliver the documentation deployers need.
The AI Act sits next to cybersecurity and resilience rules such as NIS2, DORA and the Cyber Resilience Act; the frameworks covered by ResiPlan are listed at https://www.resiplan.eu/en/compliance-frameworks.
Frequently asked questions
Is the Digital Omnibus on AI in force?
Yes. It was adopted as Regulation (EU) 2026/1744 of 8 July 2026, published on 24 July 2026 and in force since 27 July 2026.
Did the Article 50 transparency obligations move?
No. They apply from 2 August 2026. Only generative systems already on the market before that date have until 2 December 2026 to mark their output under Article 50(2).
Does the AI literacy obligation still apply?
Yes, since 2 February 2025. The Omnibus reworded it: providers and deployers must take measures to support staff AI literacy, without having to guarantee a given level.
Did the dates for general-purpose AI models change?
No. GPAI obligations have applied since 2 August 2025, the Commission can fine GPAI providers from 2 August 2026, and models already on the market before 2 August 2025 must comply by 2 August 2027.
Sources
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
- Implementing Decision (EU) 2026/2274 (EN 18286:2026), EUR-Lex
- Council of the EU, final adoption of the Omnibus on AI, 29 June 2026
- European Commission, AI Act regulatory framework
- Guidelines on prohibited AI practices
- Guidelines on the AI system definition
- General-Purpose AI Code of Practice
- Guidelines on GPAI provider obligations
- Draft guidelines on high-risk classification
- Code of Practice on AI-generated content
- Guidelines on transparency obligations
- AI Act standardisation