The EU AI Act Timeline

The Digital Omnibus, adopted in June 2026, reshaped the AI Act’s compliance calendar. Some obligations moved. Others apply right now. Here is the timeline as it actually stands.

UPDATED AUGUST 2026 · REFLECTS THE DIGITAL OMNIBUS
The headline most organisations heard was “the EU delayed the AI Act.” That is only half true. The heaviest high-risk obligations moved to late 2027 and 2028 — but prohibitions, AI literacy duties, general-purpose AI rules, and transparency obligations are already in force. The delay changes the sequence, not the destination.

The compliance calendar

1 AUG 2024IN FORCE

The AI Act enters into force

Regulation (EU) 2024/1689 becomes law — the world’s first comprehensive horizontal framework for artificial intelligence, with obligations phased in over the following years.

2 FEB 2025APPLIES

Prohibitions and AI literacy

Unacceptable-risk AI practices are banned, and organisations must ensure adequate AI literacy among staff dealing with AI systems. Both obligations remain fully in effect — the Digital Omnibus did not touch them.

2 AUG 2025APPLIES

General-purpose AI and governance

Obligations for general-purpose AI model providers take effect, alongside governance structures and penalty provisions. Member State enforcement infrastructure begins standing up.

2 AUG 2026LIVE NOW

Transparency obligations apply

Article 50 transparency rules are now live: people must be informed when interacting with AI systems such as chatbots, and AI-generated or manipulated content must be disclosed. These obligations were deliberately excluded from the Omnibus deferral — with one narrow exception for marking systems already on the market, which have until 2 December 2026.

2 DEC 2026UPCOMING

Legacy-system transparency and new prohibitions

Machine-readable marking requirements extend to generative systems placed on the market before August 2026, and newly added Article 5 prohibitions — including AI-generated non-consensual intimate imagery — take effect.

2 AUG 2027UPCOMING

Regulatory sandboxes

Every Member State must have at least one national AI regulatory sandbox operational, and the Commission faces deadlines for delegated acts covering sector-specific rules.

2 DEC 2027HIGH-RISK · ANNEX III

High-risk obligations: standalone systems

The full high-risk regime applies to standalone Annex III systems — AI used in areas like employment, credit, education, essential services, and law enforcement. Risk management, data governance, technical documentation, logging, human oversight, and conformity assessment all become mandatory. This was the date moved from 2 August 2026 by the Digital Omnibus.

2 AUG 2028HIGH-RISK · ANNEX I

High-risk obligations: embedded systems

High-risk requirements extend to AI embedded in products already covered by EU sectoral legislation — medical devices, machinery, vehicles, and other regulated products under Annex I.

What the delay does — and doesn’t — mean

What moved

  • High-risk obligations for standalone (Annex III) systems: from 2 August 2026 to 2 December 2027.
  • High-risk obligations for AI embedded in regulated products (Annex I): from 2 August 2027 to 2 August 2028.
  • Marking duties for generative systems already on the market: to 2 December 2026.

What did not move

  • Prohibited AI practices — banned since February 2025.
  • AI literacy obligations for organisations using AI.
  • General-purpose AI model obligations, in force since August 2025.
  • Article 50 transparency obligations — live as of August 2026.

Using the time well

Why waiting is the wrong lesson

The deferral exists because harmonised standards, notified bodies, and national authorities were not ready — not because the obligations shrank. High-risk conformity work is substantial: risk management systems, data governance, logging, human oversight, and technical documentation cannot be reconstructed retrospectively in the final months. Legislators were explicit that implementation efforts are expected to be already underway.

A readiness sequence for the next 16 months

  • Inventory every AI system in use or development, including vendor-supplied AI.
  • Classify each system against the Act’s risk categories and your role (provider or deployer).
  • Meet the obligations that are already live: literacy, transparency, GPAI.
  • Assign named accountability for each high-risk system.
  • Begin capturing evidence continuously — decisions, oversight, controls — so December 2027 is a checkpoint, not a cliff.

Evidion exists for exactly this window: building the evidence base, controls mapping, and audit-ready documentation now, so high-risk conformity in 2027 becomes a demonstration rather than a scramble.

Request an Executive Briefing

This page summarises the EU AI Act (Regulation (EU) 2024/1689) as amended by the Digital Omnibus on AI, for general information. It is not legal advice. Obligations depend on your systems, sector, and role under the Act — seek qualified counsel for your specific situation.