EU AI Act: what applies now and what was pushed back

Short answer

Bans, AI literacy and general-purpose AI rules have applied since 2025, and the rest of the EU AI Act became applicable and enforceable on 2 August 2026. The Digital Omnibus moved high-risk obligations to 2 December 2027, or 2 August 2028 for AI in regulated products.

What happened The omnibus moved high-risk deadlines. The rest stayed on time.
Why it matters Bans and general-purpose AI duties are already enforced.
Who is affected Firms whose AI is sold or used in the EU, wherever based.
What to watch A new ban on 2 December 2026, high-risk rules from 2 December 2027.

Last checked 2026-10-24

Key facts

AI Act entered into force	1 August 2024
Generally applicable, with exceptions	2 August 2026
AI omnibus in force	27 July 2026 (Regulation (EU) 2026/1744)
High-risk obligations start	2 December 2027 (was 2 August 2026)
High-risk AI in regulated products	2 August 2028
Top fine for prohibited practices	Up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher

What happened, and when?

The EU AI Act, Regulation (EU) 2024/1689, was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. Its obligations were phased in. According to the European Commission, the Act became applicable on 2 August 2026, with some exceptions.

The largest exception came from a separate law. On 19 November 2025 the Commission proposed a Digital Omnibus on AI, which it described as "targeted simplification measures". A separate Digital Omnibus proposal amending GDPR and other data laws was published the same day, 19 November 2025, and follows its own legislative track.

Council and Parliament negotiators reached a provisional deal on the AI omnibus on 7 May 2026. The European Parliament approved it on 16 June 2026 by 423 votes to 57, with 174 abstentions.

Regulation (EU) 2026/1744 is the final text. It is dated 8 July 2026 and was published in the Official Journal on 24 July 2026, according to Law & Technology. The Commission says it has been in force since 27 July 2026. That was only days before the high-risk rules would otherwise have applied on 2 August 2026.

Date	Milestone
1 August 2024	AI Act enters into force
2 February 2025	Prohibited practices and AI literacy obligations apply
2 August 2025	Governance rules and general-purpose AI model obligations apply
19 November 2025	Commission proposes the Digital Omnibus on AI
7 May 2026	Provisional Council-Parliament agreement
16 June 2026	Parliament approves the deal, 423 to 57, 174 abstentions
27 July 2026	Regulation (EU) 2026/1744 in force
2 August 2026	AI Act generally applicable; AI Office and national authorities enforce

Sources: European Commission, Council of the EU, European Parliament plenary record, Law & Technology.

Which AI Act rules apply right now?

Only part of the Act moved. The omnibus deferral covers the Chapter III high-risk obligations, plus a few specific items. According to the Commission and law firm White & Case, the prohibitions, the duties for general-purpose AI models and general application of the Act stand.

The Act sorts AI systems into four risk levels: unacceptable (banned), high, transparency, and minimal risk. Two tiers already carry binding rules: the banned practices and the Article 50 transparency duties. Minimal-risk AI has no mandatory obligations. The high-risk tier is the one still waiting.

Prohibited practices: applying since 2 February 2025. Nine banned practices are now on the Commission's list. The ninth, covering non-consensual sexual deepfakes, applies from December 2026.
AI literacy obligations: applying since 2 February 2025.
General-purpose AI model obligations and governance rules: applying since 2 August 2025.
Article 50 transparency duties for chatbots and deepfakes: kept the 2 August 2026 date. One exception is the machine-readable marking rule for older generative systems.
Enforcement: since 2 August 2026, the AI Office and national authorities implement, supervise and enforce the Act.

What else did the omnibus change?

Orrick's summary of the final text lists the changes below. The two headline changes are the high-risk dates. Strict obligations for high-risk AI systems now start on 2 December 2027 instead of 2 August 2026, a delay of well over a year. High-risk AI in products covered by EU product legislation (Annex I, Article 6(1)) follows on 2 August 2028.

The omnibus also added obligations. It bans AI systems that generate non-consensual intimate imagery, including so-called nudifier apps, and child sexual abuse material. These prohibitions apply from 2 December 2026.

Machine-readable marking: providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet Article 50(2).
Regulatory sandboxes: the deadline for national AI regulatory sandboxes moved to 2 August 2027.
Small mid-caps: simplification measures for small and medium enterprises now also cover companies with fewer than 750 employees and turnover up to EUR 150 million or a balance sheet up to EUR 129 million.

Who does the AI Act cover, and how large can fines be?

Under Article 2, the Act covers providers that place AI on the EU market wherever they are based, deployers in the EU, and providers or deployers outside the EU whose AI output is used in the EU. A company does not need an EU office to fall within scope.

The Act excludes AI used only for military, defence or national security purposes, AI developed solely for scientific research, and individuals using AI for purely personal, non-professional activity.

Fines under the Act are ceilings, not typical penalties. For most firms the higher of the fixed amount or the percentage applies. SMEs, including start-ups, face the lower of the two. The Commission fines general-purpose AI model providers directly. All of these figures come from the penalty provisions of Regulation (EU) 2024/1689.

Breach	Maximum fine
Prohibited practices	EUR 35 million or 7% of worldwide annual turnover
Most other operator obligations	EUR 15 million or 3%
Incorrect or misleading information	EUR 7.5 million or 1%
General-purpose AI model providers (fined by the Commission)	EUR 15 million or 3% of worldwide turnover

Higher of the two applies for most firms; SMEs and start-ups face the lower for operator fines. GPAI provider fines: up to EUR 15 million or 3%, whichever is higher. Source: AI Act penalty provisions.

What dates should businesses watch next?

The next deadline is only a few weeks away. On 2 December 2026 the new ban on systems that generate non-consensual intimate imagery and child sexual abuse material applies. The marking grace period for legacy generative AI systems ends the same day.

Later dates are spread over almost two years. That gives the high-risk obligations a longer run-in, and splits them into two groups depending on whether the AI sits inside a product already covered by EU product law.

To see which date applies, run three checks. First, is your system a banned practice? Those rules apply now, and the new ban starts on 2 December 2026. Second, is it a chatbot or does it generate synthetic content? Article 50 has applied since 2 August 2026. Third, is it high-risk standalone (2 December 2027) or part of a product under EU product law, Annex I (2 August 2028)?

New prohibitions apply on 2 December 2026. The Article 50(2) marking deadline for generative systems placed on the market before 2 August 2026 falls on the same day.
National AI regulatory sandboxes are due by 2 August 2027.
Strict obligations for high-risk AI systems begin on 2 December 2027.
From 2 August 2028, high-risk rules for AI in products covered by EU product legislation (Annex I) apply.

What is still not confirmed?

Some details could not be verified from the sources in this explainer. The regulation's number and dates come from the Commission's AI Act page and law-firm summaries. EUR-Lex was unreachable during research, so the official text listed in our sources was not accessed. Readers should check it there.

The exact wording of Regulation (EU) 2026/1744 on EUR-Lex.
The Council's final adoption date, which we could not confirm from a primary source.
Whether the AI literacy duty in Article 4 changed from a direct obligation to an encouragement. Sources mention a clarification without detail.
Whether any high-risk dates can change before 2 December 2027. Check the final text on EUR-Lex.
Any enforcement actions or fines issued under the AI Act as of October 2026.

Is this explainer legal advice?

Disclaimer: This explainer is general information only. It is not legal, financial or investment advice. Companies should check the official text and get qualified legal advice for their own situation.

FAQ

Was the EU AI Act delayed?

Not as a whole. The Digital Omnibus moved the high-risk obligations to 2 December 2027 and 2 August 2028, plus a few items such as sandboxes and marking for older generative systems. Prohibitions, general-purpose AI duties and general application stayed on schedule.

When do the EU AI Act high-risk rules apply?

Strict high-risk obligations start on 2 December 2027, according to the European Commission. High-risk AI in products covered by EU product legislation follows on 2 August 2028, according to Orrick.

Does the EU AI Act apply to companies outside the EU?

Yes. It covers providers placing AI on the EU market wherever they are based, and non-EU providers or deployers whose AI output is used in the EU.

What new ban did the AI omnibus add?

It bans AI systems that generate non-consensual intimate imagery, including nudifier apps, and child sexual abuse material. Orrick says the ban applies from 2 December 2026, bringing the Commission's count of prohibited practices to nine.

What are the maximum fines under the AI Act?

Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and up to EUR 15 million or 3% for most other breaches. These are ceilings. SMEs, including start-ups, face the lower of the two amounts.

Sources

Figures change. Check the primary sources below.