When does the EU AI Act apply?

The Act entered into force on 1 August 2024 and applies in stages. Prohibitions and AI literacy: 2 February 2025. General-purpose AI models: 2 August 2025. General application, including Article 50 transparency: 2 August 2026. High-risk duties: 2 December 2027 for stand-alone systems, 2 August 2028 for AI in regulated products.

Has the EU AI Act been delayed?

Partly. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, delayed high-risk duties by 16 months for Annex III and 12 months for regulated products. Prohibitions, general-purpose AI rules and Article 50 transparency were not delayed; Article 50 applied on 2 August 2026. Only content marking by generative systems already on the market got a grace period, to 2 December 2026.

When do the Article 50 transparency obligations apply?

From 2 August 2026. Providers of generative systems already on the market before then have until 2 December 2026 to add machine-readable marking to AI-generated content, under Article 50(2).

When do the high-risk obligations apply?

On 2 December 2027 for Annex III systems, such as AI in recruitment, credit scoring, education or critical infrastructure. On 2 August 2028 for AI that is, or is a safety component of, a product under the EU harmonisation legislation in Annex I.

Did the Digital Omnibus remove the AI literacy obligation?

No. Article 4 still binds providers and deployers, in new wording. They must take measures to support the AI literacy of staff and others who operate AI for them. They need not guarantee any individual's level of literacy.

What is the difference between a provider and a deployer?

A provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority. Most organisations running a model for internal use are deployers. They become providers if they put their name on a high-risk system or substantially modify it.

EU AI Act Timeline: All Dates After the Omnibus

The EU AI Act applies in stages. Prohibitions and AI literacy apply from 2 February 2025, general-purpose AI rules from 2 August 2025 and transparency duties from 2 August 2026. The Digital Omnibus on AI, in force since 27 July 2026, moved high-risk duties to 2 December 2027 for stand-alone systems and 2 August 2028 for AI in regulated products.1,2

Summary

Most of the Act already applies. Prohibitions, AI literacy, general-purpose AI rules and Article 50 transparency are enforceable today.
High-risk rules were delayed, not cancelled. Annex III gets 16 more months, regulated products 12. Content marking gets a short grace period.
Two duties start on 2 December 2026: a ban on AI that generates non-consensual intimate imagery or child sexual abuse material, and content marking for generative systems already on the market.

Changelog

Last checked 28 September 2026 against EUR-Lex and the European Commission. Newest first.

28 Sep 2026. Page published. All dates checked against the Official Journal texts on EUR-Lex. EUR-Lex
2 Aug 2026. General application. Article 50 transparency duties apply. National authorities and the AI Office enforce. European Commission
27 Jul 2026. Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force after publication on 24 July. EUR-Lex
20 Jul 2026. Commission publishes guidelines on the Article 50 transparency duties. European Commission
29 Jun 2026. Council gives final approval to the Digital Omnibus on AI. Council of the EU
10 Jun 2026. Final Code of Practice on transparency of AI-generated content published. European Commission
19 May 2026. Commission publishes draft guidelines on high-risk classification for consultation. European Commission

What are the EU AI Act dates after the Digital Omnibus?

The table shows every date an AI Act obligation starts or changes, as amended by Regulation (EU) 2026/1744. Guideline and report dates are left out.

EU AI Act application dates, as amended

Date	What applies	Provision	Who it binds
1 Aug 2024	AI Act enters into force	Art. 113	No duties yet
2 Feb 2025	Prohibited practices; AI literacy	Art. 4, 5	Providers, deployers
2 Aug 2025	General-purpose AI models; governance; penalties	Ch. V, VII, XII	GPAI providers, Member States
27 Jul 2026	Digital Omnibus on AI in force	Reg. 2026/1744	All operators
2 Aug 2026	General application; transparency duties	Art. 50, 113	Providers, deployers
2 Aug 2026	Fines on general-purpose AI providers	Art. 101	GPAI providers
2 Dec 2026	New bans: intimate deepfakes, abuse material	Art. 5(1)(ba), (bb)	Providers, deployers
2 Dec 2026	Content marking for systems sold before 2 Aug 2026	Art. 50(2), 111(4)	Generative AI providers
2 Aug 2027	GPAI models placed before 2 Aug 2025 comply	Art. 111(3)	GPAI providers
2 Aug 2027	National AI regulatory sandbox operational	Art. 57(1)	Member States
2 Dec 2027	High-risk rules, Annex III use cases	Art. 113(c)(i)	Providers, deployers
2 Aug 2028	High-risk rules, AI in regulated products	Art. 113(c)(ii)	Providers, deployers
2 Aug 2030	Existing high-risk systems of public authorities	Art. 111(2)	Providers, public deployers
31 Dec 2030	AI in large-scale EU IT systems	Art. 111(1)	Operators of Annex X systems

Applies now Upcoming

Sources: Regulation (EU) 2024/1689, Articles 111 and 113; Regulation (EU) 2026/1744, Article 1; EUR-Lex, accessed 28 September 2026. GPAI: general-purpose AI. Status as of the last-checked date.

The Omnibus delayed the high-risk rules, not the Act

Annex III duties now start 40 months after entry into force, not 24.

The Omnibus added 16 months for Annex III systems and 12 months for regulated products.

Time from entry into force to application, months

AI Act as adopted (2024) After the Digital Omnibus (2026)

¹ Article 50(2), generative AI systems placed on the market before 2 August 2026: 2 August 2026 became 2 December 2026. ² Stand-alone use cases in Annex III, such as credit scoring, recruitment and critical infrastructure: 2 August 2026 became 2 December 2027. ³ AI in products under Annex I, such as medical devices: 2 August 2027 became 2 August 2028.

Source: Regulation (EU) 2024/1689, Art. 113; Regulation (EU) 2026/1744, Art. 1(39) and (40); EUR-Lex, accessed 28 September 2026. Months rounded from 1 August 2024

View data table

The Omnibus added 16 months for Annex III systems and 12 months for regulated products.. Time from entry into force to application, months
Category	Series 1	Series 2
Marking of AI content¹	24	28
High-risk, Annex III²	24	40
High-risk, products³	36	48

Series 1: AI Act as adopted (2024). Series 2: After the Digital Omnibus (2026). Unit: months

What did the Digital Omnibus change?

The Commission proposed the Digital Omnibus on AI on 19 November 2025.9 The Council approved it on 29 June 2026.4 It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.2 The main changes:

High-risk dates. Chapter III, Sections 1 to 3 apply from 2 December 2027 for Article 6(2) and Annex III systems, and from 2 August 2028 for Article 6(1) and Annex I systems.
New prohibitions. From 2 December 2026, AI systems that generate non-consensual intimate imagery of an identifiable person, or child sexual abuse material, may not be placed on the market or used.
Content marking grace period. Generative systems on the market before 2 August 2026 have until 2 December 2026 to meet Article 50(2).
AI literacy rewritten. Article 4 requires measures to support AI literacy, not a guaranteed level for each person. The Commission and Member States must help.
Relief for small mid-caps. SME simplifications, such as lighter technical documentation and lower fine caps, now cover small mid-cap enterprises.
Sandboxes and machinery. The national AI regulatory sandbox deadline moved to 2 August 2027. The Machinery Regulation moved to Section B of Annex I. Its AI requirements will come through machinery delegated acts that apply by 2 August 2028.

Providers and deployers may now process special categories of personal data to detect and correct bias, where strictly necessary and under strict safeguards. The AI Office's supervision now extends to AI systems built on general-purpose models and embedded in very large online platforms.2,3

What applies now, in September 2026?

Four sets of duties already apply:

Prohibited practices (Article 5). Bans include manipulative techniques, social scoring, untargeted scraping for facial recognition databases and emotion recognition at work or in education. Fines reach €35 million or 7 percent of worldwide turnover, whichever is higher.1
AI literacy (Article 4). Measures to support the AI literacy of staff who operate or use AI, in amended wording since 27 July 2026.
General-purpose AI models (Chapter V). Model providers owe documentation, a copyright policy and a training-data summary. Since 2 August 2026 the Commission can fine them under Article 101.
Transparency (Article 50). People must be told when they deal with an AI system. AI-generated or manipulated content must be marked, and deepfakes disclosed. The Commission published guidelines on 20 July 2026 and a code of practice on 10 June 2026.6,7 Fines reach €15 million or 3 percent of turnover.5

The Commission's draft guidelines on high-risk classification, published for consultation on 19 May 2026, are not yet final.8 Until they are, organisations must classify systems on the text of Article 6 and Annex III.

Provider or deployer: which duties apply?

The Act assigns duties by role, not by where the system runs. A provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority.1

An organisation running an open-weight model on its own servers for internal work is usually a deployer. It becomes a provider of a high-risk system if it puts its name on one, modifies it substantially, or changes a system's intended purpose so that it becomes high-risk. A model on-premise, in a European cloud or behind an API carries the same AI Act duties. The guide to on-premise and private cloud AI covers the rules that do depend on location. The self-hosted LLM guide covers running models in-house.

From 2 December 2027, the main deployer duties for Annex III systems are:

follow the provider's instructions and assign competent human oversight (Article 26);
monitor operation, keep the logs it controls and report serious incidents;
tell workers before using high-risk AI at work, and tell people subject to decisions it helps make;
carry out a fundamental rights impact assessment if the deployer is a public body, a private entity providing public services, or uses AI for credit scoring or life and health insurance pricing (Article 27).

Sectors differ. Credit scoring and insurance pricing put financial services in Annex III. Public bodies face the fundamental rights assessment described on the public sector page. AI in medical devices falls under the 2 August 2028 date, as set out for healthcare and life sciences. Safety components of critical infrastructure follow the Annex III date.

What does the AI Act mean for each sector?

The same dates hit each sector through different systems. Lindstead tracks them in five briefings:

Banks, insurers and asset managers: credit scoring and life and health insurance pricing.
Hospitals and health insurers: medical devices, triage and AI scribes.
Governments and public bodies: benefits, migration and the 2030 deadline for legacy systems.
Energy, water and transport: safety components and NIS2.
Law firms: client confidentiality, professional rules and where the model runs.

What should deployers do before December 2027?

The delay buys time, not an exemption. High-risk systems placed on the market or put into service before the new dates fall under the Act only if their design later changes significantly. Systems used by public authorities must comply by 2 August 2030 regardless.2 Lindstead recommends this order:

Register every AI system in use, with its provider, purpose and the data it processes.
Classify each against Article 5, Annex III, Annex I and Article 50, and record the organisation's role.
Meet the duties that already apply: AI literacy, transparency notices and content marking.
For likely high-risk systems, request the provider's documentation and plan oversight and logging now.
Revise contracts so providers commit to the information deployers need under Articles 13 and 26.

Lindstead maps AI Act, GDPR, DORA and NIS2 obligations to the AI systems an organisation runs. It also deploys a first use case on infrastructure the organisation controls, with the logging and oversight the Act expects. The 2026 European briefing covers regulation, cost and control.

Frequently asked questions

The Act entered into force on 1 August 2024 and applies in stages. Prohibitions and AI literacy: 2 February 2025. General-purpose AI models: 2 August 2025. General application, including Article 50 transparency: 2 August 2026. High-risk duties: 2 December 2027 for stand-alone systems, 2 August 2028 for AI in regulated products.
Partly. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, delayed high-risk duties by 16 months for Annex III and 12 months for regulated products. Prohibitions, general-purpose AI rules and Article 50 transparency were not delayed; Article 50 applied on 2 August 2026. Only content marking by generative systems already on the market got a grace period, to 2 December 2026.
From 2 August 2026. Providers of generative systems already on the market before then have until 2 December 2026 to add machine-readable marking to AI-generated content, under Article 50(2).
On 2 December 2027 for Annex III systems, such as AI in recruitment, credit scoring, education or critical infrastructure. On 2 August 2028 for AI that is, or is a safety component of, a product under the EU harmonisation legislation in Annex I.
No. Article 4 still binds providers and deployers, in new wording. They must take measures to support the AI literacy of staff and others who operate AI for them. They need not guarantee any individual's level of literacy.
A provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name. A deployer uses an AI system under its own authority. Most organisations running a model for internal use are deployers. They become providers if they put their name on a high-risk system or substantially modify it.

Sources

Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal, 12 July 2024. Articles 3, 4, 5, 27, 50, 99, 111 and 113. eur-lex.europa.eu/eli/reg/2024/1689/oj
Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), Official Journal, 24 July 2026. eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744
European Commission, AI Omnibus enters into force, 27 July 2026. digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
Council of the EU, Artificial intelligence: Council gives final green light to simplify and streamline rules, 29 June 2026. www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/
European Commission, Safer and more transparent AI, 2 August 2026. commission.europa.eu/news-and-media/news/safer-and-more-transparent-ai-2026-08-02_en
European Commission, Guidelines on transparency obligations for providers and deployers of certain AI systems, 20 July 2026. digital-strategy.ec.europa.eu/en/news/commission-publishes-guidelines-transparency-obligations-providers-and-deployers-certain-ai-systems
European Commission, Code of Practice on transparency of AI-generated content, page updated 31 July 2026. digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
European Commission, Draft guidelines on the classification of high-risk AI systems, 19 May 2026. digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems
European Commission, Proposal for a Digital Omnibus on AI, COM(2025) 836, 19 November 2025. eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0836
Lewis Silkin, The Digital Omnibus on AI enters into force, 27 July 2026. www.lewissilkin.com/insights/2026/07/27/the-digital-omnibus-on-ai-enters-into-force-today-102nedo

Method: dates read from the Official Journal texts on EUR-Lex; Commission and Council pages for procedural dates. All sources accessed 28 September 2026. This page is general information, not legal advice. Corrections: contact@lindstead.com.