Caleb Whitaker
The biggest question in EU AI Act news this year is whether the deadlines actually moved. Some did, and some did not, and that gap is where many businesses get caught. The Digital Omnibus on AI, formally Regulation (EU) 2026/1744, entered into force on July 27, 2026, six days before the original August 2 high-risk deadline. Meanwhile, other parts of the law switched on exactly as planned.
This article lays out what changed, what applies today, and what is still ahead, with every date in one place. It reflects the position as of late September 2026. Rules and guidance are still being refined, so check official EU sources before making compliance decisions.
What Is the EU AI Act and Who Does It Cover?
The EU AI Act is Regulation (EU) 2024/1689, the European Union’s main law for artificial intelligence. It takes a risk-based approach: the higher the potential harm of an AI system, the heavier the obligations. Some practices are banned outright, high-risk systems face strict requirements, certain systems such as chatbots must be transparent, and low-risk tools are largely left alone.
The law does not stop at Europe’s borders. It reaches providers and deployers whose systems are placed on the EU market or whose outputs are used in the EU. A software company in Karachi or Austin can therefore fall within scope. General-purpose AI (GPAI) models, the large foundation models behind many chatbots and AI agents, sit on their own track with separate duties.
EU AI Act News 2026: What the Digital Omnibus Changed
The Act was always meant to phase in over several years. It entered into force on August 1, 2024, with banned practices and AI literacy duties enforceable from February 2, 2025, and GPAI provider obligations following on August 2, 2025. The next big milestone was supposed to be August 2, 2026, when high-risk rules would begin to apply.
Then the timeline shifted. The European Commission published the Digital Omnibus on AI on November 19, 2025, proposing to push the high-risk deadline to December 2, 2027. Parliament, the Council, and the Commission reached a provisional agreement in May 2026. Parliament adopted the text on June 16, the Council followed on June 29, it was signed on July 8, and it took effect on July 27, 2026.
Why the delay? Regulators said national authorities and harmonized technical standards were not ready, and the deferral was not an abandonment of the requirements. It is best read as a reprieve, not a repeal.
What the Omnibus Changed
- High-risk deadlines moved. Stand-alone Annex III systems now face a December 2, 2027 deadline, and product-embedded Annex I systems face August 2, 2028.
- A watermarking grace period was added. Generative AI systems already on the EU market before August 2, 2026 have until December 2, 2026 to implement machine-readable marking of their outputs.
- Regulatory sandboxes got more time. National authorities now have until August 2, 2027 to establish them.
- A new prohibition was added. More on that below.
- Small company relief expanded. Simplified requirements previously reserved for SMEs, including lighter technical documentation, now extend to small mid-cap companies.
- The AI Office gained oversight. The Commission’s AI Office now has stronger, more centralized powers over AI systems built on GPAI models.
What the Omnibus Did Not Change
The core design of the Act stayed intact. The agreement preserves the risk-based approach and the general obligations of providers and deployers. That is the detail many summaries skip, and it explains why treating the Omnibus as a pause button is a mistake. lw
EU AI Act Timeline: Key Dates From 2024 to 2028
Here is the schedule in plain form:
- August 1, 2024: The Act enters into force.
- February 2, 2025: Prohibited practices and AI literacy duties apply.
- August 2, 2025: Obligations for GPAI model providers apply.
- August 2, 2026: Article 50 transparency duties apply, and the Commission gains enforcement powers over GPAI providers.
- December 2, 2026: The watermarking grace period for existing generative systems ends, and the new prohibition on non-consensual intimate content generation applies.
- August 2, 2027: GPAI models placed on the market before August 2, 2025 must be fully compliant, and national sandboxes are due.
- December 2, 2027: Stand-alone high-risk (Annex III) obligations apply.
- August 2, 2028: High-risk obligations for AI embedded in regulated products (Annex I) apply.
What Applies Right Now in the EU AI Act
If you scan older articles, you may think nothing serious applies until 2027. That is wrong. As of August 2, 2026, prohibited practices, AI literacy duties, general-purpose AI model obligations, and Article 50 transparency duties all apply.
Article 50 Transparency Rules
Article 50 is the part of the Act most ordinary businesses will meet first. Chatbots must tell people they are dealing with AI rather than a human, deepfakes must be labeled, and synthetic content must carry machine-readable marks. If your company runs a customer support bot, publishes AI-generated images, or produces synthetic video, this applies to you today.
To help, the Commission backed a voluntary Code of Practice on marking and labeling AI-generated content. When enforcement began, the Commission released a first list of more than 180 organizations that had signed it. Signing is a practical way to show good faith, but it is not a legal shield. Compliance still depends on what your systems actually do.
Enforcement Over General-Purpose AI Models
GPAI providers have had duties since 2025, but regulators could not act on them until this August. On August 2, 2026, the AI Office gained the power to request documentation, access models for evaluation, require corrective measures, and impose fines. Models placed on the market before August 2, 2025 have until August 2, 2027 to comply.
Enforcement is split by role. The AI Office handles GPAI models directly, while other enforcement sits with national authorities. Expect different regulators to show up depending on what you build.
Bans and AI Literacy Still Stand
The prohibitions from February 2025 remain in force, covering practices the EU considers unacceptable. The AI literacy duty also continues: organizations using AI should make sure the people operating it understand what it can and cannot do.
The High-Risk Delay: What Got Pushed Back
High-risk systems are the heart of the Act’s compliance burden. The Annex III category covers areas such as employment, creditworthiness assessment, education, and access to essential services. Providers of these tools must build risk management, technical documentation, human oversight, and post-market monitoring into their products.
Those requirements now arrive on the later dates listed above. That is a real gain for HR tech vendors, lenders, and edtech companies. Still, the sensible read is “more time to prepare,” not “safe to ignore.” Classification questions (is my system high-risk or not?) do not go away, and customers may start asking for evidence long before the legal deadline.
The New Ban on Nudifier Apps
One of the more notable additions is a new prohibition. Lawmakers added a ban on AI practices that generate non-consensual sexual and intimate content or child sexual abuse material. Providers and deployers cannot place on the market systems designed to create such content, or systems lacking reasonable safeguards against it.
This prohibition carries its own compliance date of December 2, 2026, and applies regardless of whether an organization’s systems are high-risk. Any company building image or video generators should review its safeguards before that date.
EU AI Act Fines: What Non-Compliance Could Cost
Penalties depend on the type of violation. The Act sets three main tiers:
- Up to €35 million or 7% of worldwide annual turnover for prohibited practices.
- Up to €15 million or 3% for most other obligations, including GPAI and transparency duties.
- Up to €7.5 million or 1% for supplying incorrect or misleading information to authorities.
In each case the higher figure applies to large companies, while the Act includes lower caps for smaller businesses. Reports on the August enforcement start highlighted the 3% and €15 million level for transparency and GPAI failures.
What Businesses Should Do Now
You do not need a giant compliance program to make progress. A few concrete steps go a long way:
- Build an AI inventory. List every AI system you build, buy, or embed, and note who supplies it.
- Check Article 50 exposure. Look at chatbots, generated media, and synthetic text you publish.
- Mark up generative outputs. If your product predates August 2, 2026, plan to meet the December 2, 2026 marking deadline.
- Classify your systems. Decide which fall under the high-risk categories, and document your reasoning.
- Review vendor contracts. Ask suppliers how they handle the Act, especially model providers.
- Train your people. AI literacy is already a live obligation.
What to Watch Next
The next stretch is about implementation rather than new legislation. The EU AI Board’s ninth meeting on September 17, 2026 focused on enforcement coordination but added no new obligation or compliance deadline. Watch for guidance on high-risk classification, progress on harmonized standards, and how regulators approach their first investigations.
There is also a broader story. A separate part of the wider Digital Omnibus process, touching data protection rules, has drawn concern from civil society groups. It is still moving through the EU system, so expect further debate.
One practical warning: plenty of pages online still list August 2, 2026 as the high-risk date. Those are out of date. Always check the publication date and confirm against the official text.
Conclusion
The EU AI Act news for 2026 comes down to a split calendar. High-risk obligations moved to December 2027 and August 2028, but transparency duties, GPAI enforcement, and the existing bans are live now, and a new prohibition and a watermarking deadline both arrive on December 2, 2026.
The clearest takeaway is to use the extra time on high-risk rules to get organized, while meeting the obligations that already apply. Companies that inventory their AI, label generated content properly, and keep records will be ready whichever way the guidance evolves.
Frequently Asked Questions
What is the latest EU AI Act news?
The Digital Omnibus on AI took effect on July 27, 2026, delaying high-risk rules. Transparency duties and GPAI enforcement began on August 2, 2026.
When does the EU AI Act fully apply?
Full application is staggered. Stand-alone high-risk systems follow on December 2, 2027, and product-embedded high-risk systems on August 2, 2028.
Was the EU AI Act delayed?
Only partly. The high-risk deadlines were postponed, but the bans, GPAI obligations, and Article 50 transparency rules were not.
What are the fines under the EU AI Act?
The highest tier reaches €35 million or 7% of global turnover for prohibited practices. Most other violations top out at €15 million or 3%.
Does the EU AI Act apply to companies outside the EU?
Yes, if their AI systems are placed on the EU market or their outputs are used in the EU.
What is Article 50 of the EU AI Act?
It is the transparency provision. It requires chatbot disclosure, deepfake labeling, and machine-readable marking of AI-generated content.
Who enforces the EU AI Act?
The Commission’s AI Office enforces rules for general-purpose AI models. National authorities handle most other enforcement.
