Last updated: 5 November 2026. Based on the AI Act, Regulation (EU) 2024/1689, as amended by the AI Omnibus, Regulation (EU) 2026/1744 (in force since 27 July 2026).
The short version
- High-risk AI is delayed: stand-alone high-risk systems (Annex III) now apply from 2 December 2027; AI embedded in regulated products (Annex I) from 2 August 2028.
- Transparency is not delayed: Article 50 obligations — telling people they are talking to an AI, labelling deepfakes — apply since 2 August 2026, with a grace period until 2 December 2026 for machine-readable marking of systems already on the market.
- New prohibitions: from 2 December 2026, AI systems designed to generate non-consensual intimate imagery or child sexual abuse material are banned.
- Prohibitions and general-purpose AI rules already in force since 2025 are unchanged.
NEW TIMELINE
2 FEB 2025
Prohibitions & AI literacy
Banned practices apply. AI literacy duty (now narrowed by the Omnibus).
2 AUG 2025
General-purpose AI
Obligations for GPAI model providers. Not delayed.
2 AUG 2026
Transparency
Article 50 disclosure and deepfake labelling. Grace period for marking until 2 Dec 2026.
2 DEC 2026
New prohibitions
Non-consensual intimate imagery and CSAM generation banned.
2 DEC 2027
High-risk (Annex III)
Recruitment, credit scoring, education, critical infrastructure and other stand-alone uses.
2 AUG 2028
High-risk (Annex I)
AI embedded in products such as medical devices, machinery and toys.
What the AI Omnibus changed
| Topic | Before | After the AI Omnibus |
|---|---|---|
| High-risk, stand-alone (Annex III) | 2 August 2026 | 2 December 2027 |
| High-risk, embedded in products (Annex I) | 2 August 2027 | 2 August 2028 |
| AI literacy (Art. 4) | Ensure a sufficient level of AI literacy of staff | Take measures to support AI literacy; no guaranteed level per person. Commission and Member States must support compliance |
| Registration of high-risk systems | Required | Still required, with streamlined content |
| SMEs and small mid-caps | Some simplifications for SMEs | Simplified documentation and quality management extended to small mid-caps; priority access to sandboxes |
| Bias detection data | Only providers of high-risk systems | Extended, exceptionally and with safeguards, to deployers and other AI systems |
| Prohibited practices | Since 2 February 2025 | Unchanged, plus new bans from 2 December 2026 |
| General-purpose AI | Since 2 August 2025 | Unchanged |
Why the delay is not a reason to wait
The extra time for high-risk systems is real, but the work required is substantial: a risk management system, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, and — for many systems — a conformity assessment. Companies that start in 2027 will be doing it under pressure.
- Your clients and procurement teams already ask how you govern AI.
- Transparency obligations are already in force and easy to overlook in chatbots and marketing content.
- AI systems are a growing attack surface: prompt injection and data leakage are security incidents today, regardless of the AI Act timeline.
- Fines remain significant: up to €35 million or 7% of worldwide turnover for prohibited practices, and up to €15 million or 3% for most other breaches.
A practical roadmap for 2026–2027
NOW
Inventory and classify
List every AI system you build or use, your role (provider or deployer) and its risk level.
NOW
Fix transparency
Disclose AI interactions, label synthetic content and review chatbots and generated media.
2027
Build governance
AI policy, roles, approval workflow and risk assessment — ideally aligned with ISO/IEC 42001.
ONGOING
Test AI security
Pentest chatbots and agents for prompt injection, data leakage and insecure tool use.
Frequently asked questions
When do the AI Act high-risk obligations apply now?
After the AI Omnibus, high-risk systems listed in Annex III apply from 2 December 2027, and high-risk AI embedded in products covered by Annex I from 2 August 2028.
Did the AI Omnibus remove the AI literacy obligation?
No, it narrowed it. Providers and deployers must take measures to support AI literacy among the people who operate or use AI on their behalf, without having to guarantee a specific level for each person.
Are transparency obligations delayed?
No. Article 50 obligations apply from 2 August 2026. Only providers of systems already on the market before that date have until 2 December 2026 to implement machine-readable marking of synthetic content.
What are the new prohibited AI practices?
From 2 December 2026, AI systems intended to generate non-consensual intimate imagery or child sexual abuse material, or lacking reasonable safeguards against it, are prohibited — and so is using AI systems to create such content.
Do small companies get relief?
SMEs and small mid-caps benefit from simplified technical documentation, proportionate quality management requirements and priority access to regulatory sandboxes. The deadlines are the same for everyone.
Need a clear view of your AI Act obligations? See our AI Act compliance service or talk to an AI governance specialist.
Sources: Regulation (EU) 2024/1689 (AI Act); Regulation (EU) 2026/1744 (AI Omnibus), published July 2026; law firm analyses of the final AI Omnibus text.