The European Union has moved the start dates for the AI Act’s most demanding rules, but it has not moved all of them. As of October 22, 2026, obligations for high-risk AI systems begin in December 2027 and August 2028, while enforcement powers and transparency duties for chatbots and AI-generated content have applied since August 2.
What did the EU change in the AI Act, and when?
The AI Act entered into force on August 1, 2024, and was designed to phase in over several years. According to the European Commission’s AI Act page, the ban on prohibited practices and the AI literacy duties applied from February 2, 2025, and the governance rules and obligations for general-purpose AI models from August 2, 2025. The Act became generally applicable on August 2, 2026, with some exceptions, and the Commission says enforcement by the AI Office and national authorities starts the same month.
The changes came through a package the Commission calls the AI Omnibus. The Commission’s own timeline shows it was adopted by the Commission on November 19, 2025, reached political agreement on May 7, 2026, and entered into force on July 27, 2026. Its best-known effect is more time for high-risk systems. The Commission also says it added a new prohibition, extended simplified rules that already existed for small firms to small mid-cap companies, gave the AI Office more powers and widened access to regulatory sandboxes.
The timetable at a glance
The table below uses dates as the Commission publishes them. The Commission’s page gives only the month for the new prohibition.
| Rule | Applies from | Status on October 22, 2026 |
|---|---|---|
| Prohibited practices and AI literacy | February 2, 2025 | In force |
| Governance and general-purpose AI model duties | August 2, 2025 | In force |
| General application, enforcement and transparency duties | August 2, 2026 | In force |
| New ban on AI that generates non-consensual sexual imagery or child sexual abuse material | December 2026 | Upcoming |
| High-risk systems in Annex III use cases, such as employment and education | December 2, 2027 | Moved |
| High-risk AI built into regulated products, such as lifts or toys (Annex I) | August 2, 2028 | Moved |
Why did the high-risk rules slip?
The Commission’s FAQ on the omnibus ties the high-risk timeline to the availability of standards and other support tools, in its words “aligned to the availability of standards and other support tools.” High-risk providers have to show their systems meet a list of requirements, and they need workable standards and guidance to do so. If those are late, a legal deadline can arrive before companies have a clear way to comply.
The numbers line up neatly. The FAQ says the affected parts of the Act were originally set to apply on August 2, 2026 and August 2, 2027, and describes delays of at most 16 months for Annex III and at most 12 months for Annex I. Add 16 months to August 2, 2026 and the result is December 2, 2027. Add 12 months to August 2, 2027 and the result is August 2, 2028. Those are exactly the dates now on the Commission’s AI Act page, so the final deadlines sit at the outer limit of what the Commission had proposed.
One caution applies. The FAQ describes the Commission’s proposal, and in that version the delays depended on the Commission confirming that support tools were ready. The Commission pages reviewed for this article list calendar dates and do not say whether that condition survived in the adopted text, so anyone planning around the dates should check the regulation itself. Deadlines that hinge on standards are not unique to AI: the timeline for moving to post-quantum encryption depends on technical standards and vendor readiness in a similar way.
What already applies, and who enforces it?
Three layers are already live: the prohibitions, the general-purpose model duties and, since August 2, 2026, the Act’s general application. Enforcement is shared. The Commission’s page on the transparency guidelines names national market surveillance authorities, the AI Office for systems it supervises, and the European Data Protection Supervisor where EU institutions act as providers or deployers.
The Commission says the omnibus gave the AI Office more powers. Its FAQ on the proposal describes centralizing oversight of AI systems built on general-purpose models in the AI Office and giving the Commission oversight of AI embedded in very large online platforms and search engines.
What do the transparency rules require?
Article 50 sets the transparency duties, and according to the Commission they apply from August 2, 2026. The Commission’s guidelines page, last updated on August 6, 2026, summarizes them as follows:
- Providers must design AI systems so people are explicitly informed when they interact with an AI system directly.
- Providers of generative systems must add machine-readable marks so that AI-generated or manipulated content can be detected.
- Deployers must inform people who are exposed to emotion recognition or biometric categorization.
- Deployers must inform people when they are exposed to deepfakes.
- Deployers must inform people about AI-generated text published on matters of public interest that has no human review or editorial control.
Alongside the guidelines sits a Code of Practice on transparency of AI-generated content. The Commission’s page lists the final code as published with the closing plenary on June 10, 2026, and says about 190 companies and organizations had signed it by the end of July. The code is voluntary and has two sections: marking and detection for providers, and labeling of deepfakes and certain AI-generated text for deployers. It also offers an optional set of EU icons for labeling.
Signing is not required, and the Commission says the code is an adequate voluntary tool. Companies that do not sign must show that their own measures are adequate, which market surveillance authorities assess case by case. The Commission’s guidelines page does not say whether the guidelines are final, so that status is worth checking before relying on them.
Which systems count as high-risk, and what must their providers do?
The Commission’s AI Act FAQ defines high-risk systems as safety components of covered products or systems that fall under a listed use case. Annex III “comprises 8 areas in which the use of AI can be particularly sensitive,” with examples including critical infrastructure, education, employment, access to essential services such as credit assessment and life and health insurance pricing, law enforcement, migration and border control, justice, and biometric identification where it is not prohibited.
Before a high-risk system reaches the market, its provider has to put it through a conformity assessment, which in some cases requires an independent body. The FAQ lists the requirements as risk management, data quality, documentation and traceability, transparency, human oversight, accuracy, and cybersecurity and robustness. Providers also need a quality management system, must register the system in a public EU database, and must report serious incidents and cooperate with market surveillance authorities after launch. Those duties now start in December 2027 or August 2028, depending on the category.
What penalties can apply?
The FAQ sets maximum fines in three tiers, each either a fixed sum or a share of worldwide annual turnover:
| Violation | Maximum fine |
|---|---|
| Prohibited practices | Up to €35 million or 7% of turnover |
| Other obligations under the Act | Up to €15 million or 3% of turnover |
| Incorrect, incomplete or misleading information to authorities or notified bodies | Up to €7.5 million or 1% of turnover |
For most companies the higher of the two figures applies; for small and medium-sized enterprises the lower one does. The Commission can also fine general-purpose model providers up to €15 million or 3%.
A worked example shows how this plays out. Take a hypothetical company with €2 billion in worldwide turnover: 3% is €60 million, which exceeds €15 million, so the ceiling for an ordinary breach is €60 million. For a hypothetical small enterprise with €20 million in turnover, 3% is €0.6 million, which is below €15 million, so the lower figure applies and the ceiling is €0.6 million. These are ceilings, not predictions of what any regulator will impose.
What is still unclear?
Every date in this article comes from the Commission’s own published pages. The Commission wrote the proposal and enforces the rules, and no independent source was available to check the dates against, so the regulation as published in the EU’s Official Journal is the authority for legal questions. The Commission’s omnibus FAQ describes the proposal rather than the final law, so conditions it mentions may differ from the adopted text.
Two practical gaps remain. The pages reviewed do not say how far the supporting standards have progressed, which was the stated reason for the delay. And the status of the Article 50 guidelines is not stated on the Commission’s page, even though the duties themselves already apply.
What to watch before December 2027
Three dates matter most in the near term. The new ban on AI that generates non-consensual sexual imagery or child sexual abuse material arrives in December 2026. The transparency duties are already in force, so early enforcement decisions by national authorities will show how strictly they read them. And the standards and guidance behind the high-risk rules will determine whether December 2027 is workable or whether the pressure for another extension returns.
This is general information about EU rules, not legal advice; compliance decisions should rest on the published regulation and professional advice.
Sources: European Commission AI Act policy page; European Commission Digital Package FAQ; European Commission AI Act FAQ; European Commission transparency guidelines page; European Commission Code of Practice page
