The EU’s Digital Omnibus on AI, Regulation (EU) 2026/1744, has been in force since 27 July 2026. It changed several deadlines in the EU AI Act timeline and added new bans. If you lost track of what applies when, here is where the implementation timeline stands in November 2026.
EU AI Act timeline: rules already in force
- 1 August 2024: entry into force of the EU Artificial Intelligence Act.
- 2 February 2025: prohibited AI practices apply, including social scoring, manipulative AI that exploits vulnerabilities, and untargeted scraping of facial images. AI literacy duties for staff also apply.
- 2 August 2025: providers of general-purpose AI models face their obligations, along with the rules on penalties and national authorities. Models already on the EU market before then have until 2 August 2027 to comply.
- 2 August 2026: transparency duties apply. People must be told when they are talking to an AI system, deepfakes must be labelled, and AI-generated content must be marked in a machine-readable way. Generative AI tools placed on the market before then must add the marking by 2 December 2026.
Upcoming deadlines, including high-risk AI systems
- 2 December 2026: a new ban on AI “nudifier” tools and on AI-generated child sexual abuse material takes effect, and the grace period for machine-readable marking by older generative AI tools ends.
- 2 December 2027: the rules start for stand-alone high-risk AI systems in the Annex III list, such as AI used in hiring, credit scoring, education and access to public services. The original deadline was August 2026.
- 2 August 2028: rules for high-risk AI systems built into regulated products, such as medical devices and machinery, apply. These were originally due in August 2027.
What the Digital Omnibus changed, and why
The delays to the high-risk rules were the headline change. Standards and guidance that companies need for compliance were not ready, and businesses argued they could not prepare without them. The Omnibus mainly gave them more time rather than changing the requirements for AI systems classed as high-risk, though it also made targeted changes, such as softening the literacy duty and extending some SME relief to small mid-cap companies.
At the same time, EU lawmakers added new prohibitions on AI-generated intimate imagery and child sexual abuse material, responding to the spread of nudification apps.
What it means for your AI Act compliance
- If you run a chatbot or publish AI-generated media for EU audiences: the transparency duties already apply. Disclose AI chatbots and label realistic synthetic content.
- If you use AI in hiring, credit or education: you have until December 2027, but preparing an AI risk management system and human oversight takes time. Start your AI compliance work now.
- If you build general-purpose models: the model rules already apply, with a deadline of August 2027 for models released before August 2025.
Who enforces the AI Act: AI governance in the EU
Enforcement of the EU AI Act is split. The European Commission’s AI Office supervises general-purpose AI models directly. Since the Omnibus, it also oversees AI systems built on a provider’s own general-purpose model and AI systems that are part of very large online platforms and search engines. Most other AI systems are supervised by national market surveillance authorities in each member state, coordinated through the European AI Board. That means a company may deal with different regulators depending on what it builds and where it operates.
EU AI Act timeline: common questions
Does the EU AI Act apply to my small business?
Probably in part. Most small businesses are “deployers” of AI systems: they use AI tools rather than build them. Deployers mainly need to take steps to support AI literacy among staff using AI (the Omnibus softened this from a duty to ensure a sufficient level), be transparent with people when the rules require it, and follow the stricter rules only if they use AI for high-risk purposes such as hiring. Fines for small and medium-sized businesses are capped at the lower of the fixed amount or the percentage of turnover, and the Omnibus extends this lower-fine treatment to small mid-cap companies.
Do I need to label AI-generated images?
If you publish realistic AI-generated or manipulated images, audio or video for EU audiences, yes: since 2 August 2026, deepfakes must be disclosed. Providers of the AI tools must also mark output in a machine-readable way (tools on the market before 2 August 2026 have until 2 December 2026).
Under this EU regulation, fines for the most serious breaches reach €35 million or 7% of global turnover. Our EU AI Act tracker entry keeps the current status of every part.
Last checked: 5 November 2026. This explains the law in plain English; it is not legal advice. Spotted an error? Tell us, and see how we check facts.
