The European Union’s AI Act is being switched on in stages, and a 2026 amendment moved the dates for its most demanding rules. This article sets out what already applies, what has been pushed to 2027 and 2028, and how a business anywhere can sort its own AI uses against the schedule.
What is the EU AI Act, in one paragraph?
The AI Act is a European Union law that regulates artificial intelligence according to the level of risk a system poses. According to the European Commission, it entered into force on August 1, 2024, and most of it was designed to apply two years later, on August 2, 2026. The Commission describes four risk levels: unacceptable risk (banned practices), high risk (strict obligations before a system can be sold or used), transparency risk (duties to disclose that AI is involved) and minimal risk (no specific rules under the Act).
Because the law applies to systems placed on or used in the EU market, its reach goes beyond European companies. A software maker in Asia or North America that sells an AI feature to EU customers has reason to read it. The sections below follow the schedule published by the Commission, as of October 26, 2026.
What changed with the AI Omnibus?
The Commission’s AI Act page explains that the “AI Omnibus,” part of a wider package meant to simplify digital rules, adjusted the original timetable. The Commission says the proposal was adopted on November 19, 2025, a political agreement was reached on May 7, 2026, and the amendment entered into force on July 27, 2026.
Among its changes, the Commission lists a reinforced role for the AI Office, the Commission body that oversees the Act, including centralized oversight of AI systems built on general-purpose models. The headline change for most companies, however, is timing: rules for high-risk systems now start later than the original August 2026 date.
Which dates apply today?
The table below sums up the schedule as the Commission publishes it. Check the Commission’s pages for the latest status, since further guidance may follow.
| Date | What applies |
|---|---|
| February 2, 2025 | Banned practices, definitions and AI literacy duties |
| August 2, 2025 | Obligations and governance rules for general-purpose AI models |
| August 2026 | Transparency rules (the Commission’s page gives the month only) |
| December 2026 | An added ban on non-consensual sexual content and child abuse material, including so-called nudification apps |
| December 2, 2027 | Stand-alone high-risk systems (for example in employment, education and biometrics) |
| August 2, 2028 | High-risk AI built into regulated products, such as lifts and toys |
Enforcement sits with the AI Office and national authorities in the member states, and the Commission says this enforcement runs from August 2, 2026.
Why were the high-risk rules delayed?
The Commission’s pages describe the Omnibus as a simplification measure, and they do not set out a detailed rationale for each date. What the pages do show is the result: stand-alone high-risk rules now start on December 2, 2027, and product-embedded ones on August 2, 2028. Companies preparing for those rules therefore have more time than the original schedule allowed.
That extra time is best read as room to prepare rather than permission to wait. High-risk duties involve documentation, testing and oversight processes that take months to build, and a company that begins the inventory work early will find the later deadlines far less disruptive.
Which AI systems count as high risk?
The Commission’s guidance gives examples rather than a single formula. Systems are treated as high risk when they are used for decisions that significantly affect people. The examples it names include:
- AI that assesses whether someone can receive a certain medical treatment
- AI used to analyze and filter job applications and to evaluate candidates
- AI used for creditworthiness checks and for pricing life and health insurance
- AI used in education to evaluate learning outcomes or monitor cheating
For a business that only buys software, the practical test is simple: if an AI feature helps decide who gets hired, who gets credit or who gets a place on a course, treat it as a candidate for the high-risk category and ask the vendor how it plans to comply. Teams that already follow the NIST AI Risk Management Framework will find that its habit of mapping where AI is used and who it affects gives them a head start on that inventory.
What do the transparency rules ask of companies?
The Commission says the transparency rules take effect in August 2026. Its guidance describes three duties:
- Chatbots: people must be told they are interacting with an AI system.
- Deepfakes: content that has been artificially generated or manipulated must be visibly disclosed as such.
- Generative AI outputs: providers must mark outputs in a machine-readable format so that they can be detected as AI-generated.
Generative AI means systems that create text, images, audio or video from prompts; the primer what is generative AI covers the basics. The exact timing and technical form of the machine-readable marking is a detail worth confirming against the Commission’s current guidance, because public summaries of the Omnibus have not always agreed on it.
What about general-purpose AI models?
General-purpose AI (GPAI) models are large, flexible models that can be built into many different products. The Commission says obligations for these models became applicable on August 2, 2025. Providers must have a copyright compliance policy, including respecting opt-outs from text-and-data mining, and must publish a summary of the content used for training.
Models that may pose systemic risks face extra duties such as model evaluations, incident reporting and cybersecurity measures. The Commission’s guidance presumes a model carries systemic risk when it was trained using more than 10^25 floating-point operations (FLOP), a measure of total computing work. Written out, that is a 1 followed by 25 zeros.
Companies that build products on top of such models, including the autonomous tools described in AI agents explained, are generally users rather than model providers. Even so, they should expect upstream vendors to pass documentation and contractual requirements down to them.
How large can the fines be?
According to the Commission’s guidance, the fines scale with the seriousness of the breach and are set as either a fixed sum or a share of worldwide annual turnover, whichever is higher:
| Type of breach | Maximum fine |
|---|---|
| Prohibited practices | Up to €35 million or 7% |
| Most other obligations | Up to €15 million or 3% |
| Incorrect or misleading information to authorities | Up to €7.5 million or 1% |
For small and medium-sized enterprises (SMEs), the Commission says the lower of the two amounts applies.
A worked example
The arithmetic below is illustrative and uses invented turnover figures. A large group with €1 billion in worldwide turnover that commits a prohibited practice faces up to 7% × €1,000 million = €70 million, which is higher than €35 million, so €70 million is the ceiling. A small firm with €10 million in turnover faces 7% × €10 million = €0.7 million, which is lower than €35 million. Because the SME rule picks the lower figure, its ceiling for the same breach is €0.7 million. For a breach of other obligations, the same firm’s ceiling is 3% × €10 million = €0.3 million. These are maximums, not predictions of what any regulator would impose.
Do businesses outside Europe need to act?
Not every company does, but many will. The questions that decide it are whether a business sells AI-enabled products to EU customers, whether its AI outputs are used in the EU, and whether it embeds a third-party model in a product that reaches the EU. A company that answers no to all three has little direct exposure, though it may still adopt similar habits because customers and partners increasingly ask for them. For a plain-language starting point on governance in a smaller company, see using AI responsibly in your business.
A reasonable sequence is to list every AI system in use, mark which ones touch hiring, credit, education or health decisions, check whether any customer-facing chatbot discloses that it is a machine, and ask vendors for their compliance plans. Keep dated notes so the work can be reviewed.
Conclusion: use the extra time to build the inventory
The AI Act’s rules on banned practices, AI literacy and general-purpose models already apply, transparency duties begin in August 2026 according to the Commission, and the high-risk rules now wait until December 2027 and August 2028. The Omnibus shifted the calendar, not the direction of travel. The most useful move for any company is to know which of its AI systems fall into which category, and to do that before the later deadlines arrive.
This article is general information, not legal or professional advice. Check the current text of the law and the requirements that apply to your organization and location.
Sources: European Commission
