Updated 2 October 2026 to reflect the Digital Omnibus on AI.
On 27 July 2026, the Digital Omnibus on AI entered into force and moved the EU AI Act's high-risk deadline from 2 August 2026 to 2 December 2027. Many teams read that as a pause. It is not one, because prohibited practices, general-purpose AI rules and the Article 50 transparency duties already apply, and the European Commission's AI Office has held enforcement powers over general-purpose AI models since 2 August 2026.
This guide sets out what EU AI Act compliance requires today. It covers the current timeline, the risk tiers, obligations by role, penalties and a dated plan for the next 26 months. Where a topic needs more depth, we link to a dedicated guide, starting with how to classify your AI systems under the EU AI Act.
What the EU AI Act Covers and Who It Applies To
Regulation (EU) 2024/1689, the EU AI Act, regulates AI systems by the risk they pose rather than by the technology behind them. It reaches beyond EU borders. A provider based in London or New York is in scope if it places an AI system on the EU market, or if the system's output is used in the EU.
Your obligations depend on your role, and one organisation can hold several roles at once.
EU AI Act Roles and Core Duties
| Role | Who it is | Core duties |
|---|
| Provider | Develops an AI system or GPAI model and places it on the market under its own name | Carries most obligations: risk management, documentation, conformity assessment, registration and post-market monitoring |
| Deployer | Uses an AI system in a professional capacity | Use the system as instructed, assign human oversight, keep logs and inform affected people (Article 26) |
| Importer | Places a non-EU provider's system on the EU market | Verify conformity assessment, documentation and CE marking before placing on the market |
| Distributor | Makes a system available further down the supply chain | Check CE marking and documentation, and act on any non-conformity |
| Authorised representative | EU-based party appointed by a non-EU provider | Hold documentation for authorities and cooperate with them on the provider's behalf |
⚠️ When a Deployer Becomes a Provider
Article 25 treats a deployer as a provider if it puts its own name on a high-risk system, makes a substantial modification, or changes the intended purpose so that the system becomes high-risk. Fine-tuning a vendor model for a hiring or credit use case is the most common route into provider obligations.
EU AI Act Timeline: What Applies Now
The dates below follow the implementation timeline published by the European Commission's AI Act Service Desk, which already includes the Digital Omnibus amendments. Five milestones are live and four are still ahead.
EU AI Act Implementation Timeline (as of October 2026)
| Date | What applies | Status |
|---|
| 1 August 2024 | AI Act enters into force | In force |
| 2 February 2025 | Definitions, AI literacy and the Article 5 prohibitions | In force |
| 2 August 2025 | General-purpose AI model obligations; national authorities designated; AI Board set up | In force |
| 2 August 2026 | Article 50 transparency rules; enforcement starts for prohibitions, GPAI, transparency and AI literacy | In force |
| 27 July 2026 | Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force | In force |
| 2 December 2026 | New prohibition on AI generating non-consensual sexual deepfakes and child sexual abuse material; Article 50(2) marking deadline for generative systems already on the market before 2 August 2026 | Upcoming |
| 2 August 2027 | At least one AI regulatory sandbox operational in each Member State; GPAI models placed on the market before 2 August 2025 must comply | Upcoming |
| 2 December 2027 | High-risk rules for Annex III systems (employment, credit, education, biometrics and others) | Upcoming |
| 2 August 2028 | High-risk rules for AI embedded in regulated products under Annex I (machinery, toys, lifts, medical devices) | Upcoming |
📅 Key Insight: The Omnibus Moved Dates, Not Duties
The European Commission gave its reason plainly: harmonised standards for high-risk systems would not be ready in time for 2 August 2026, so the Omnibus extended the deadlines to let those standards catch up. The requirements in Chapter III are unchanged. Use the extra 16 months to build evidence, because a conformity assessment in late 2027 will need documentation that takes a year to produce.
For the full story of why guidance and standards slipped, read our analysis of the delayed EU AI Act guidance.
The Four EU AI Act Risk Tiers
Every compliance decision starts with classification. The Act sorts AI systems into four tiers, and the obligations scale with the tier.
EU AI Act Risk Tiers at a Glance
| Tier | Examples | Obligations | Maximum fine |
|---|
| Unacceptable risk | Social scoring, untargeted facial image scraping, workplace emotion recognition | Banned under Article 5 | €35m or 7% of global turnover |
| High risk | CV screening, credit scoring, exam proctoring, safety components in regulated products | Full Chapter III regime: risk management, documentation, oversight, conformity assessment | €15m or 3% |
| Transparency risk | Chatbots, deepfakes, AI-generated text published on matters of public interest | Article 50 disclosure and labelling | €15m or 3% |
| Minimal risk | Spam filters, recommendation features, AI in video games | No specific obligations; voluntary codes of conduct | None under the Act |
A system becomes high-risk by one of two routes. Article 6(1) covers AI used as a safety component of a product that already needs third-party conformity assessment under Annex I legislation. Article 6(2) covers the eight use-case areas listed in Annex III, subject to a narrow exception in Article 6(3) that never applies where the system profiles people.
The detail of each Annex III area, the Article 6(3) test and worked examples sit in our dedicated EU AI Act risk classification guide.
Prohibited AI Practices Under Article 5
| Prohibited practice | Applies from |
|---|
| Subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm | 2 February 2025 |
| Exploiting vulnerabilities linked to age, disability or social or economic situation | 2 February 2025 |
| Social scoring that leads to unjustified or disproportionate detrimental treatment | 2 February 2025 |
| Predicting criminal offences based solely on profiling or personality traits | 2 February 2025 |
| Untargeted scraping of facial images to build facial recognition databases | 2 February 2025 |
| Emotion recognition in workplaces and education, except for medical or safety reasons | 2 February 2025 |
| Biometric categorisation that infers race, political opinions, religion or sexual orientation | 2 February 2025 |
| Real-time remote biometric identification in public spaces for law enforcement, outside narrow exceptions | 2 February 2025 |
| AI systems generating non-consensual sexual deepfakes or child sexual abuse material (added by the Digital Omnibus) | 2 December 2026 |
High-Risk AI: Obligations for Providers
High-risk obligations now apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. The work behind them is substantial. Most providers need 9 to 12 months to produce the technical documentation and quality management evidence that a conformity assessment will test.
High-Risk Provider Obligations by Article
| Article | Requirement | What it means in practice |
|---|
| Article 9 | Risk management system | Identify, evaluate and mitigate risks to health, safety and fundamental rights across the whole lifecycle, and test against them |
| Article 10 | Data and data governance | Training, validation and testing data must be relevant, representative and examined for bias |
| Article 11 and Annex IV | Technical documentation | A complete file describing design, development, performance and risk controls, kept current |
| Article 12 | Record-keeping | Automatic event logging that makes the system's operation traceable |
| Article 13 | Transparency to deployers | Instructions for use covering purpose, accuracy, limitations and oversight measures |
| Article 14 | Human oversight | Design that lets people understand outputs, override decisions and stop the system |
| Article 15 | Accuracy, robustness and cybersecurity | Declared accuracy levels and resilience to errors, attacks and data poisoning |
| Article 17 | Quality management system | Documented policies for design, testing, change control, monitoring and incident handling |
| Articles 43, 47 to 49 | Conformity assessment, declaration, CE marking and registration | Assess conformity, sign the EU declaration, affix CE marking and register in the EU database before market placement |
| Articles 72 and 73 | Post-market monitoring and serious incidents | Monitor performance in use and report serious incidents to market surveillance authorities |
⚖️ Conformity Assessment and Incident Deadlines
Most Annex III systems follow internal control under Annex VI, so the provider assesses itself. Biometric systems in Annex III point 1 need a notified body under Annex VII where the provider has not fully applied harmonised standards. Annex I products follow the conformity route of their own sector legislation.
Article 73 sets the reporting clock for serious incidents: no later than 15 days after the provider becomes aware, 10 days where a death is involved, and 2 days for a widespread infringement or serious disruption of critical infrastructure.
High-Risk AI: Obligations for Deployers
Buying a high-risk system from a vendor does not move all the risk to the vendor. Deployers carry their own duties under Article 26, and some must also complete a fundamental rights impact assessment.
Deployer Obligations for High-Risk Systems
| Obligation | Source | What to do |
|---|
| Use as instructed | Article 26(1) | Operate the system within the provider's instructions for use |
| Human oversight | Article 26(2) | Assign oversight to people with the competence, training and authority to intervene |
| Input data | Article 26(4) | Make sure input data under your control is relevant and representative |
| Monitoring and logs | Article 26(5) and (6) | Monitor operation, report risks to the provider and keep logs for at least six months |
| Workplace use | Article 26(7) | Inform workers' representatives and affected workers before putting the system into service |
| Informing individuals | Article 26(11) | Tell people when a high-risk system makes or assists decisions about them |
| Fundamental rights impact assessment | Article 27 | Required for public bodies, private bodies providing public services, and deployers using AI for credit scoring or life and health insurance pricing |
| Right to explanation | Article 86 | Give affected people a clear explanation of the system's role in decisions that significantly affect them |
Transparency Obligations Under Article 50
Article 50 has applied since 2 August 2026. It covers systems that interact with people or generate content, whatever their risk tier.
Article 50 Transparency Duties
| Who | Duty | Deadline |
|---|
| Providers of systems that interact with people | Design the system so people know they are interacting with AI, unless that is obvious | 2 August 2026 |
| Providers of generative AI | Mark synthetic audio, image, video and text in a machine-readable, detectable format | 2 August 2026; 2 December 2026 for systems already on the market before 2 August 2026 |
| Deployers of emotion recognition or biometric categorisation | Inform the people exposed to the system | 2 August 2026 |
| Deployers of deepfakes | Disclose that the content has been artificially generated or manipulated | 2 August 2026 |
| Deployers publishing AI-generated text on matters of public interest | Disclose AI generation unless the text has had human editorial review | 2 August 2026 |
General-Purpose AI Models
Obligations for general-purpose AI (GPAI) model providers have applied since 2 August 2025, and the AI Office has been able to enforce them since 2 August 2026. Models placed on the market before 2 August 2025 have until 2 August 2027 to comply.
All GPAI providers. Under Article 53, providers must keep technical documentation, give downstream providers the information they need to comply, maintain a copyright policy and publish a summary of training content using the AI Office template.
GPAI models with systemic risk. A model trained with more than 1025 floating-point operations is presumed to carry systemic risk under Article 51. Article 55 adds model evaluation including adversarial testing, systemic risk mitigation, serious incident reporting and cybersecurity protection.
For organisations that only use GPAI models. Most enterprises use GPAI models as deployers. Your exposure comes from what you build on top of the model, so check whether that system lands in a high-risk or Article 50 category.
⚖️ The General-Purpose AI Code of Practice
The European Commission published the General-Purpose AI Code of Practice in July 2025. Signing it is voluntary, but providers that follow it can use it to demonstrate compliance with Articles 53 and 55 while harmonised standards are developed.
EU AI Act Penalties
Fines under Article 99 are set by national authorities for AI systems. For SMEs and start-ups the lower of the two figures applies, while for larger organisations it is the higher.
💰 EU AI Act Penalty Structure
€35 million or 7% of global annual turnover: prohibited practices under Article 5
€15 million or 3% of global annual turnover: most other obligations, including high-risk and Article 50 transparency duties
€7.5 million or 1% of global annual turnover: incorrect, incomplete or misleading information to authorities
€15 million or 3% of global annual turnover: GPAI model providers, imposed by the European Commission under Article 101
Who Enforces the EU AI Act
Enforcement is split between Brussels and the Member States. National market surveillance authorities supervise AI systems on their territory, while the AI Office inside the European Commission supervises GPAI models. The European AI Board coordinates the two.
The Digital Omnibus widened the AI Office's reach. According to the European Commission's announcement of 27 July 2026, the AI Office now oversees certain AI systems built on general-purpose models and AI embedded in very large online platforms and search engines. The Commission also runs the AI Act Service Desk, which offers a compliance checker and its guidelines on classifying high-risk systems.
Your EU AI Act Compliance Plan for 2026 to 2028
Work backwards from the deadlines that apply to you. The plan below assumes you deploy or provide at least one Annex III system.
EU AI Act Compliance Plan by Deadline
| When | Action | Why |
|---|
| Now (Q4 2026) | Build an inventory of every AI system, including vendor tools and models embedded in SaaS | You cannot classify what you have not found |
| Now (Q4 2026) | Classify each system, record the reasoning and confirm nothing falls under Article 5 | Prohibitions are already enforceable at €35m or 7% |
| Now (Q4 2026) | Check chatbots, generated content and deepfakes against Article 50 | Transparency duties have applied since 2 August 2026 |
| By 2 December 2026 | Mark synthetic content from legacy generative systems; confirm no system can produce content covered by the new prohibition | Both deadlines fall on 2 December 2026 |
| H1 2027 | Stand up a quality management system, risk management process and technical documentation for each high-risk system | Documentation takes the longest to produce |
| H1 2027 | Assign human oversight, set log retention and draft fundamental rights impact assessments where required | Deployer duties start alongside provider duties |
| H2 2027 | Complete conformity assessment, sign the EU declaration, affix CE marking and register in the EU database | Annex III rules apply from 2 December 2027 |
| By 2 August 2028 | Repeat the process for AI embedded in Annex I regulated products | Annex I rules apply from 2 August 2028 |
How AI Governor Supports EU AI Act Compliance
Regulativ's AI Governor was built for this workload. It maps every AI system to its EU AI Act obligations and keeps the evidence current as deadlines move.
AI inventory and classification. Catalogue every model, agent and vendor tool, and classify each against Article 5, Article 6 and Annex III with a recorded justification.
Documentation generation. Produce Annex IV technical documentation, risk management records and quality management workflows from the system data you already hold.
Logging and oversight. Keep timestamped records of AI decisions and human oversight events to meet Articles 12, 14 and 26.
Incident management. Detect, investigate and report serious incidents inside the Article 73 deadlines.
Multi-framework mapping. Reuse the same evidence for ISO/IEC 42001, the NIST AI RMF and the other frameworks on our AI regulations page.
✅ Bottom Line
The Digital Omnibus gave high-risk providers and deployers 16 more months, and it gave everyone else nothing. Prohibitions, GPAI rules and Article 50 are enforceable today, with a new prohibition and a marking deadline arriving on 2 December 2026. Organisations that finish their inventory and classification this quarter will spend 2027 producing evidence rather than searching for systems.
Where do you stand today? If a market surveillance authority asked for your AI inventory and classification record tomorrow, could you send it?
Get your free EU AI Act compliance assessment →
Related EU AI Act Guides
EU AI Act Compliance FAQs
When does the EU AI Act apply?
The EU AI Act entered into force on 1 August 2024 and applies in stages. Prohibitions and AI literacy applied from 2 February 2025, GPAI obligations from 2 August 2025, and Article 50 transparency rules from 2 August 2026. High-risk rules apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products.
Has the EU AI Act been delayed?
Only the high-risk deadlines moved. The Digital Omnibus on AI, in force since 27 July 2026, pushed Annex III high-risk obligations from 2 August 2026 to 2 December 2027 and Annex I obligations to 2 August 2028. Prohibitions, GPAI rules and Article 50 transparency duties were not delayed.
Does the EU AI Act apply to UK and US companies?
Yes, if they place AI systems on the EU market or the output of their AI systems is used in the EU. Location of the provider does not matter.
What are the fines under the EU AI Act?
Up to €35 million or 7% of global annual turnover for prohibited practices, €15 million or 3% for most other obligations including high-risk and transparency duties, and €7.5 million or 1% for supplying incorrect information to authorities. SMEs pay the lower of the two figures.
What makes an AI system high-risk under the EU AI Act?
An AI system is high-risk if it is a safety component of a product covered by Annex I legislation that requires third-party conformity assessment, or if it is used in one of the eight Annex III areas, such as employment, credit scoring, education or biometrics.
Who enforces the EU AI Act?
National market surveillance authorities supervise AI systems in each Member State. The European Commission's AI Office supervises general-purpose AI models and, since the Digital Omnibus, certain AI systems built on those models or embedded in very large online platforms.
What should organisations do now to comply with the EU AI Act?
Build an inventory of AI systems, classify each one, confirm none falls under Article 5, and check chatbots and generated content against Article 50. Then use 2027 to build the documentation, oversight and conformity evidence that high-risk systems need by 2 December 2027.
