EU AI Act Dates: What Applies Now and What Was Delayed to 2027 and 2028

The EU AI Act dates now split into three groups. The bans and the AI literacy duty have applied since February 2025, the rules for general-purpose AI models since August 2025, and the transparency duties plus central enforcement since 2 August 2026. The part that moved is the high-risk regime: stand-alone high-risk systems, which include hiring tools, now apply from 2 December 2027, and high-risk AI built into regulated products from 2 August 2028. This article covers EU law as checked on 10 October 2026.

The delay is no longer a proposal. Regulation (EU) 2026/1744, called the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, a few days before the original high-risk deadline would have hit.

The short answer: what is law today

If you only need the current picture, here it is in one table. Everything marked “Applies” is binding on 10 October 2026.

Banned practices and AI literacy: in force since February 2025

The Act sorts AI into four tiers, and the top tier is simply prohibited. The European Commission’s overview of the framework lists examples such as social scoring and untargeted scraping of face images to build recognition databases. Those bans have applied for almost two years.

The same date brought the AI literacy duty. The Omnibus softened it: according to law-firm summaries, it now reads more like a commitment by the Commission and member states to support literacy than a hard obligation on every company. Check the final text before you rely on either reading.

Fines are steep. Under Article 99, a violation of a banned practice can cost up to EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher. Most other breaches, including transparency duties, top out at EUR 15 million or 3 percent. For small and medium businesses the lower of the two figures applies.

General-purpose AI models: since August 2025

Providers of general-purpose models, the large foundation models behind chatbots and coding assistants, have had their own duties since 2 August 2025. Those dates were not touched by the Omnibus. What did change is who watches: according to Cooley, the EU AI Office’s enforcement powers apply from 2 August 2026, and the Omnibus gives that office oversight of AI systems built on a general-purpose model from the same provider.

For a business that only uses such a model through an API, the practical effect is indirect. You will mostly see it in vendor paperwork rather than in a duty of your own.

Transparency rules: 2 August 2026

Article 50 is the part ordinary users will notice. People must be told when they are talking to an AI system, AI-generated or manipulated content such as deepfakes must be identifiable, and certain AI-written text published on matters of public interest has to be labelled. The Commission page puts these rules in force from August 2026.

One carve-out matters. The Omnibus gave providers whose systems were already on the market before 2 August 2026 until 2 December 2026 to add the machine-readable marking required by Article 50(2). New systems have no such grace period. A chatbot launched in September 2026 had to be compliant from day one.

What moved: the high-risk rules

High-risk is where the money and the paperwork sit: risk management, data quality checks, logging, human oversight, technical documentation. Annex III covers uses such as employment, education, credit scoring and law enforcement. Morgan Lewis, in a note for employers and HR vendors, points out that recruitment, CV screening, candidate assessment, promotion and dismissal tools fall in that list.

The reason for the delay was practical. The harmonised technical standards that would tell companies how to comply were late, with many expected around the end of 2026. Regulators asked for time, and the EU gave it.

1. Stand-alone high-risk systems (Annex III): from 2 December 2027 instead of 2 August 2026.
2. High-risk AI inside regulated products (Annex I), such as medical devices: from 2 August 2028 instead of 2 August 2027.
3. National AI sandboxes: member states now have until 2 August 2027.

Cooley’s summary of the final text also lists a 2 August 2030 date for high-risk systems used by public authorities. I could not confirm that line against the official text, so treat it with caution until you have read the regulation itself.

New in the Omnibus: a ban on nudification tools

During negotiations, the European Parliament pushed through a new prohibition on AI systems that generate non-consensual intimate imagery or child sexual abuse material. The Commission lists it as a ninth banned practice, applying from December 2026. Cooley reports no exemption for systems already on the market.

The law firms also note smaller changes. The simpler documentation regime for small firms now reaches small mid-cap companies, and a narrower definition of “safety component” means an AI feature that merely assists a user is not automatically high-risk. Providers who claim the Article 6(3) exemption from high-risk status still have to register, though through a simplified route.

A practical order of operations

Most organizations should stop treating the EU rules as one deadline and start treating them as four workstreams. Each has a different clock.

1. Now: screen for banned uses. The prohibitions carry the heaviest fines and have applied since February 2025. Look at anything that scores or ranks people, infers emotions, or builds face databases.
2. Now: disclose and label. A support chatbot that does not say it is a machine, or a marketing image that is an unmarked synthetic depiction of real people, falls under the transparency rules that began in August 2026.
3. By 2 December 2026: marking. If your product was already on the market before 2 August 2026, the machine-readable marking of generated content needs to be in place by this date. If you run a nudification feature in any form, it has to go by the same date.
4. Through 2027: build the high-risk file. Risk management, data governance, logs and human oversight take a long time to set up. Waiting for standards that arrive late in 2026 leaves about a year.

Vendors will send questionnaires well before the legal deadlines. A buyer that wants to be compliant in December 2027 will ask its suppliers for evidence in 2026.

Why the dates slipped

The Commission did not abandon the idea. It faced a practical problem: the high-risk duties assume that companies can follow published technical standards, and the standards bodies were behind schedule. Morgan Lewis calls the extra time “additional preparation time, not a reprieve,” which is a fair reading. The substance of the high-risk rules is intact, and a company that treats the delay as permission to stop preparing will end up crowded into 2027.

Does any of this reach people outside the EU?

In some cases, yes. The Act applies to providers who place AI systems on the EU market and to deployers whose system output is used in the EU, wherever the company is based. A US startup selling a CV-screening tool to a German employer is covered. A US-only product with no EU customers is not.

Related questions

Was the EU AI Act repealed or paused?

No. Parts of it were postponed, and a new prohibition was added. The ban list, the literacy duty, the general-purpose model rules and the transparency rules are all running.

When do hiring tools have to comply?

Under the amended Act, from 2 December 2027 for Annex III uses, which include recruitment and worker management. The banned practices already apply, so check the Article 5 list against any tool that infers emotions or ranks people on social behavior.

Could the dates change again?

Possibly. The Cloud Security Alliance titled its analysis “deferred, not cancelled,” and the standards process remains the pressure point. I found nothing further formally pending on 10 October 2026.

Where this leaves you

For a European deployment, the useful sequence is: inventory what you run, check it against the banned list now, label chatbots and generated media, and treat December 2027 as a planning date rather than a finish line. This is general information, not legal advice.

Sources

• European Commission, Regulatory framework for AI
• EUR-Lex, Regulation (EU) 2026/1744 (Digital Omnibus on AI), record page
• AI Act Service Desk, Article 99 penalties
• Cooley, Digital AI Omnibus delays key deadlines and introduces new rules
• Lewis Silkin, The Digital Omnibus on AI enters into force today
• Gibson Dunn, EU AI Act Omnibus agreement
• Sidley, Provisional agreement to delay key EU AI Act obligations
• Morgan Lewis, Changes to EU AI Act deadlines for employers and HR technology providers
• Cloud Security Alliance, EU AI Act high-risk deadline: deferred, not cancelled