Last reviewed: September 24, 2026. Explainer, not legal advice.
The short version: the EU AI Act is already partly in force. Bans on certain AI practices and the rules for general-purpose AI models apply now, and the Article 50 transparency rules have applied since August 2, 2026. The heavy high-risk obligations were pushed back by the “Digital Omnibus on AI” to December 2027 (stand-alone systems) and August 2028 (AI built into regulated products).
What happened
Who: the European Commission proposed the change; the European Parliament and the Council of the EU adopted it. What: Regulation (EU) 2026/1744, the “Digital Omnibus on AI,” amends the AI Act (Regulation (EU) 2024/1689). When: political agreement on May 6, 2026; Parliament approval on June 16; Council adoption on June 29; publication in the Official Journal on July 24; in force since July 27, 2026. Where: it applies EU-wide, and to non-EU companies whose AI systems are placed on the EU market or whose outputs are used in the EU.
The timeline as it stands now
- Aug 1, 2024: AI Act enters into force (done)
- Feb 2, 2025: Prohibited practices (Article 5) and AI literacy (Article 4) (applies)
- Aug 2, 2025: General-purpose AI (GPAI) model obligations, governance structure, penalties framework (applies)
- Aug 2, 2026: Article 50 transparency duties (e.g. telling people they are interacting with AI, labelling deepfakes) (applies, unchanged by the Omnibus)
- Dec 2, 2026: Watermarking/marking of synthetic content for systems already on the market before August 2, 2026; new bans on AI-generated child sexual abuse material and non-consensual intimate imagery (upcoming)
- Aug 2, 2027: GPAI models placed on the market before August 2, 2025 must comply (upcoming)
- Dec 2, 2027: High-risk obligations for stand-alone (Annex III) systems, such as AI in hiring, credit, education and essential services (moved from August 2, 2026)
- Aug 2, 2028: High-risk obligations for AI that is a safety component of regulated products (Annex I), such as machinery and medical devices (moved from August 2, 2027)
What else the Omnibus changed
- AI literacy softened. Article 4 now asks organizations to “support the development” of AI literacy among staff, rather than to ensure a sufficient level of it.
- Narrower “safety component.” The definition now focuses on systems whose failure creates health or safety risks, which may take some products out of the high-risk category.
- Lighter paperwork for smaller firms. SMEs and small mid-caps get more proportionate documentation and simplified conformity assessment.
- More central enforcement. The EU AI Office gains supervisory powers over certain general-purpose AI providers and very large online platforms.
- New prohibitions. Generating child sexual abuse material and non-consensual intimate imagery with AI is added to the banned-practices list, with a transition period to December 2, 2026.
Why it matters
A delay is not a repeal. The high-risk requirements still arrive: risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, and conformity assessment. The extra 16 months is best used to inventory your AI systems, work out which ones are Annex III high-risk, and build the documentation now, while standards from CEN-CENELEC are finalized. The transparency and GPAI rules are live today, so anything customer-facing that uses chatbots or generates synthetic content needs attention already.
How it works in practice
Obligations fall on providers (who build or brand an AI system) and deployers (who use it under their authority). National market-surveillance authorities enforce most of the Act; the AI Office supervises general-purpose AI models. The penalty ceilings are up to €35 million or 7% of worldwide annual turnover for prohibited practices, and lower tiers for other breaches.
What to watch next
- Harmonised standards from CEN-CENELEC JTC 21, which will give presumption of conformity for high-risk systems.
- Commission guidance on high-risk classification and on Article 50 transparency.
- Any further “simplification” proposals, and how national authorities staff up before December 2027.