AI Act Timeline: What Applies When

The legal framework

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. Article 113 makes it apply in stages. The situation below is as of October 2026.

Date	What applies
2 February 2025	General provisions, the definition of an AI system, AI literacy (Article 4) and the prohibited practices (Article 5).
2 August 2025	Obligations for providers of general-purpose AI models, governance rules, notified bodies and most of the penalty provisions.
2 August 2026	General application of the Act, including the transparency duties of Article 50 and the Commission's enforcement powers over general-purpose AI model providers.
2 December 2026	The new prohibitions on AI systems generating non-consensual intimate imagery and child sexual abuse material. Also the end of the grace period for Article 50(2) marking for generative systems already on the market before 2 August 2026.
2 August 2027	General-purpose AI models placed on the market before 2 August 2025 must comply.
2 December 2027	High-risk obligations for stand-alone systems listed in Annex III.
2 August 2028	High-risk obligations for AI that is a safety component of products under Annex I.
2 August 2030	Deadline for high-risk systems intended for use by public authorities placed on the market before the Chapter III dates.

The Digital Omnibus

On 19 November 2025 the Commission proposed a "Digital Omnibus on AI", including a postponement of the high-risk obligations because harmonised standards and guidance were not ready. This is no longer a proposal. Parliament and Council agreed in the course of 2026, and the text was adopted as Regulation (EU) 2026/1744. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.

Besides moving the high-risk dates, it reworded Article 4 so that providers and deployers must take measures to promote AI literacy rather than ensure a particular level, added the two prohibitions mentioned above, introduced simplifications for small and mid-cap companies, and strengthened the role of the AI Office. It did not postpone Article 50 as a whole.

Sources differ on some details of this regulation, so the consolidated text on EUR-Lex should be checked for any decision that depends on an exact date.

Systems already on the market

Under Article 111, high-risk systems placed on the market before the application date fall under the Act only if their design is significantly changed afterwards. Providers and deployers of such systems used by public authorities must comply by 2 August 2030 in any case.

In practice

A Hasselt company offers a recruitment-screening tool that it placed on the market in 2025. Before the Omnibus, its high-risk obligations would have started on 2 August 2026. They now start on 2 December 2027, so there is time to build a quality management system and technical documentation. The company should still use that time: a significant redesign after that date brings the system fully within the rules.

The same company also runs a customer chatbot. The transparency duty applied from 2 August 2026 and was not postponed. If the chatbot was already live before that date, it must still inform users now.

A Ghent marketing agency generates images with a generative tool placed on the market in 2025 by its supplier. The agency, as deployer, should check that the supplier will mark synthetic output in a machine-readable way by 2 December 2026, and must itself disclose deepfakes.

Even where an obligation is postponed, preparation is not. Documentation, data governance and a conformity assessment take months. Our register shows which date applies to which of your systems, and the records of processing cover the data side.

What matters for planning is the order of events. Prohibitions and AI literacy come first, because they are already in force. Transparency duties follow, since they now apply. High-risk obligations come last, and they are also the heaviest, so a company with a high-risk system should treat the extra months as preparation time and not as a pause.

Frequently asked questions

Were the high-risk rules cancelled?

No. They were postponed: to 2 December 2027 for Annex III and 2 August 2028 for Annex I.

Is AI literacy still required?

Yes, since 2 February 2025, though the obligation was softened to a duty to take measures. See the AI literacy obligation.

Can penalties be imposed now?

For prohibited practices and, from 2 August 2026, for transparency breaches and general-purpose AI models, yes. Fines for high-risk breaches follow the new dates.

Could the dates move again?

Dates in a regulation can only be changed by another legislative act. Check for new proposals before relying on a date for a major decision.

How this connects

The AI Act compliance service maps these dates against your systems. For the underlying classification, see risk classification, and for the overall framework the practical overview.