EU AI Act timeline: which rules apply now and what was delayed to 2027
The EU AI Act's bans and general-purpose AI rules already apply, and transparency duties started in August 2026. A 2026 amendment pushed the main high-risk obligations back to December 2027 and August 2028.
The EU AI Act is already in force, but its obligations arrive in stages. As of November 2026, the bans on certain AI uses, the rules for general-purpose AI models and the transparency duties for chatbots and deepfakes all apply. The heaviest obligations, for high-risk systems, were postponed by an amendment in July 2026 and now start on 2 December 2027 and 2 August 2028.
What is the EU AI Act?
The AI Act is the EU's law regulating artificial intelligence according to the risk it poses. It entered into force on 1 August 2024. The European Commission describes four tiers: unacceptable risk, which is banned; high risk, which faces strict obligations; transparency risk, which carries disclosure duties; and minimal risk, which has no specific rules.
- Unacceptable risk (banned): for example social scoring, emotion recognition in workplaces and schools, and nudification apps.
- High risk: for example CV-sorting software for recruitment, credit scoring, exam scoring and AI safety components in transport.
- Transparency risk: chatbots must tell people they are talking to a machine, and deepfakes must be labelled.
- Minimal risk: for example spam filters and AI in video games.
Which AI Act rules already apply?
Three sets of rules already apply: the bans, the obligations for general-purpose AI models and the transparency duties. According to the Commission's AI Act FAQ, the prohibitions, definitions and AI literacy provisions have applied since 2 February 2025, and the governance rules and general-purpose AI obligations since 2 August 2025. The Article 50 transparency obligations became applicable on 2 August 2026.
There is one short grace period. Providers of generative AI systems already on the market before 2 August 2026 have until 2 December 2026 to meet the duty to mark AI-generated content in a machine-readable way, as summarised by the law firm Cuatrecasas. Systems launched after that date get no transition.
What did the Digital Omnibus on AI change?
The Digital Omnibus on AI mainly delayed the high-risk obligations and added a new ban. The Commission proposed it on 19 November 2025, lawmakers reached a political agreement on 7 May 2026, and it entered into force on 27 July 2026, according to the Commission. It was published as Regulation (EU) 2026/1744 in the Official Journal on 24 July 2026.
The amendment also added a new prohibition. From December 2026, the Act bans AI systems used to create non-consensual sexually explicit images of real people, including so-called nudification apps, and systems that generate child sexual abuse material. The text also extends some simplifications designed for small firms to "small mid-cap" companies.
When do the high-risk AI rules start?
The high-risk rules now start on 2 December 2027 for standalone systems and 2 August 2028 for AI built into regulated products. The Commission's FAQ states that rules for high-risk AI systems will apply starting 2 December 2027, and that rules on AI embedded in physical products such as medical devices, toys and lifts will apply from 2 August 2028.
| Date | What applies |
|---|---|
| 1 August 2024 | AI Act enters into force |
| 2 February 2025 | Bans on prohibited practices; AI literacy duty |
| 2 August 2025 | Governance rules; obligations for general-purpose AI models |
| 27 July 2026 | Digital Omnibus on AI enters into force |
| 2 August 2026 | Transparency rules (Article 50) and general application date |
| 2 December 2026 | New ban on non-consensual intimate deepfakes and AI-generated child abuse material; marking deadline for generative systems already on the market |
| 2 December 2027 | High-risk systems listed in Annex III, such as recruitment and credit scoring (originally 2 August 2026) |
| 2 August 2028 | High-risk AI in regulated products listed in Annex I (originally 2 August 2027) |
According to the Commission, high-risk systems will need risk assessment and mitigation, high-quality training data, activity logging, detailed documentation, clear information for deployers, human oversight, and a high level of robustness, cybersecurity and accuracy. For employers using AI to screen job applicants, or lenders using it to assess credit, December 2027 is now the date that matters.
What are the penalties for breaking the AI Act?
The largest fines are reserved for banned practices: up to €35 million or 7% of worldwide annual turnover, whichever is higher, under Article 99. Breaches of most other obligations can cost up to €15 million or 3% of turnover, and supplying incorrect or misleading information to authorities up to €7.5 million or 1%. Smaller companies face lower caps.
Enforcement is shared. National authorities carry out market surveillance of AI systems, while the Commission's AI Office supervises general-purpose AI models and can fine their providers, according to the Commission.
What does the AI Act mean for ordinary users?
For most people, the visible change is disclosure: chatbots must say they are machines and deepfakes must be labelled. The bans also remove some uses entirely, such as emotion recognition at work or in schools. The Act's rules on transparency matter increasingly as assistants start to take actions, a trend we explain in how AI agents are entering everyday software. Security questions such as how those tools sign in are covered in our guide to passkeys.
Frequently asked questions
Is the EU AI Act in force?
Yes. The AI Act entered into force on 1 August 2024 and has applied in stages since. Bans on prohibited practices have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and transparency rules since 2 August 2026. The main high-risk obligations follow on 2 December 2027 and 2 August 2028.
Was the AI Act delayed?
Partly. The Digital Omnibus on AI, in force since 27 July 2026, postponed the high-risk obligations: standalone systems listed in Annex III moved from 2 August 2026 to 2 December 2027, and AI in regulated products moved from 2 August 2027 to 2 August 2028. Bans and general-purpose AI rules were not delayed.
Does the AI Act apply to companies outside the EU?
Yes. Article 2 applies the Act to providers placing AI systems on the EU market whether or not they are established in the EU, and to non-EU providers and deployers whose AI output is used in the EU. A US or Asian provider selling an AI recruitment tool to European employers, for example, must meet the high-risk obligations from December 2027 in the same way as an EU-based provider.
What AI practices are banned in the EU?
According to the European Commission, banned practices include social scoring, emotion recognition in workplaces and education, and, following the 2026 amendment, AI systems that generate non-consensual sexually explicit content or child sexual abuse material, including nudification apps. Breaches can be fined up to €35 million or 7% of global annual turnover.
Do chatbots have to say they are AI?
Yes. Under Article 50, which has applied since 2 August 2026, people must be told when they are interacting with an AI system such as a chatbot, unless that is obvious to a reasonably observant person. Deepfakes must be labelled, and providers of generative systems must mark AI-generated content in a machine-readable way.
Sources
- European Commission — AI Act: regulatory framework for AI (updated 19 October 2026)
- European Commission — Navigating the AI Act (FAQ) (updated 20 October 2026)
- Cuatrecasas — Digital Omnibus on AI has been published (24 July 2026)
- AI Act Explorer — Article 99: Penalties (accessed November 2026)
More to read
AI agents in everyday software: what they do and where they fall short
AI agents are assistants that carry out multi-step tasks, such as filling forms or booking travel, instead of only answering questions. They are now built into browsers and office tools, but security agencies warn their weaknesses cannot be fully fixed.
Passkeys explained: how they replace passwords and how widely they are used
A passkey is a sign-in credential made of two cryptographic keys, one kept on your device and one held by the website, so there is no password to steal or type. As of October 2026, the FIDO Alliance estimates 7 billion passkeys are in use.
First year above 1.5C: 2024 crossed the line, and 2026 is set to follow
2024 was the first calendar year more than 1.5C warmer than pre-industrial times. Copernicus says 2026 is virtually certain to be the second, but the Paris Agreement limit refers to a 20-year average, not single years.