EU AI Act timeline 2026-2028: key dates after the Omnibus
Hephaestus Technology7 min read
The EU AI Act timeline changed on 27 July 2026, when the Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force. High-risk obligations for Annex III systems now apply from 2 December 2027 and for AI in regulated products (Annex I) from 2 August 2028, while prohibitions, AI literacy, general-purpose AI and transparency rules kept their dates. The next deadline for most businesses is 2 December 2026.
Key takeaways
- The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk deadlines: Annex III systems to 2 December 2027 and Annex I product systems to 2 August 2028.
- Prohibitions, AI literacy and general-purpose AI rules kept their 2025 dates, and the Article 50 transparency rules have applied since 2 August 2026.
- The next hard date is 2 December 2026: new bans on AI-generated intimate imagery and child abuse material apply, and the four-month grace period for marking existing generative AI output ends.
- The first harmonised AI Act standard, EN 18286 on quality management, was cited in the Official Journal on 14 October 2026, giving high-risk providers a concrete reference to build to.
- The delay is time to prepare, not an exemption: classify your systems now, while the Commission's high-risk guidelines are still being finalised.
What changed in the last few weeks?
The newest development is technical rather than legislative. On 14 October 2026 the Commission published Implementing Decision (EU) 2026/2274 in the Official Journal, citing EN 18286:2026, "Artificial intelligence: Quality management system for EU AI Act regulatory purposes" as a harmonised standard. It entered into force on the day of publication.
Why it matters: under Article 40 of the AI Act, following a cited harmonised standard gives a presumption of conformity with the requirements it covers. For a startup building a high-risk system, EN 18286 is the first concrete, officially recognised template for the quality management system that Article 17 requires. It arrives alongside the Omnibus change to Article 63, which lets SMEs without partner or linked enterprises comply with certain quality management elements in a simplified way.
The second reason to look at the calendar now is that 2 December 2026 is less than four weeks away.
What does the full EU AI Act timeline look like now?
The consolidated text of Article 113, as amended, sets these dates. The Act itself entered into force on 1 August 2024.
| Date | What applies | Who it mainly affects |
|---|---|---|
| 2 February 2025 | Chapters I and II: definitions, AI literacy (Article 4) and the original eight prohibited practices (Article 5) | Every provider and deployer |
| 2 August 2025 | General-purpose AI model rules, governance, penalties chapter (except GPAI fines) | GPAI model providers, Member States |
| 27 July 2026 | Omnibus in force; Articles 102 to 110 (amendments to sectoral law) apply | Product manufacturers |
| 2 August 2026 | General application, including Article 50 transparency; national enforcement and GPAI fines begin | Chatbot and generative AI providers, deployers |
| 2 December 2026 | New prohibitions on non-consensual intimate content and child sexual abuse material; end of the Article 50(2) grace period for systems already on the market | Generative AI providers |
| 2 August 2027 | Deadline for each Member State to have a national AI regulatory sandbox operational | Startups seeking supervised testing |
| 2 December 2027 | High-risk rules for Annex III systems (employment, credit, education, biometrics and others) | Providers and deployers of stand-alone high-risk AI |
| 2 August 2028 | High-risk rules for AI in products under Annex I legislation | Manufacturers of regulated products |
What exactly happens on 2 December 2026?
Two things. First, the Omnibus added a ninth prohibition to Article 5, banning AI systems that generate non-consensual intimate material or child sexual abuse material. The Commission's AI Act page confirms this new prohibition applies from December 2026, and the consolidated Article 113 sets the date at 2 December 2026. Providers can be liable where such generation is a reasonably foreseeable outcome without adequate safeguards, so any image or video generation feature needs content safeguards in place.
Second, providers of generative AI systems placed on the market before 2 August 2026 were given a transition until 2 December 2026 to comply with Article 50(2), the duty to mark synthetic audio, image, video and text in a machine-readable, detectable format. New systems launched after 2 August 2026 had no grace period.
The Commission's voluntary Code of Practice on transparency of AI-generated content, published on 10 June 2026, sets out practical marking and labelling measures. About 190 organisations had signed it by the end of July 2026. Our guide to AI Act transparency rules for chatbots and AI content covers what this means in product terms.
What did the Omnibus not change?
The Omnibus did not delay the prohibitions, the general-purpose AI obligations or Article 50 transparency. It did rewrite one early obligation: Article 4 on AI literacy now requires providers and deployers to take measures to support AI literacy of their staff, without mandating a "sufficient" level. It remains an obligation, and national authorities have been able to supervise it since 2 August 2026.
The Omnibus also kept the fine levels in Article 99, while extending the "whichever is lower" cap that already protected SMEs to small mid-cap companies for most infringements.
Who is affected by the high-risk delay?
The delay matters most to companies whose AI falls into an Annex III area, such as recruitment screening, creditworthiness assessment, life and health insurance pricing or exam proctoring, and to manufacturers of regulated products such as machinery or medical devices. If that is you, the extra 16 months (Annex III) or two years (Annex I) are time to build documentation, risk management and human oversight into the product, not time to stop.
There is also a gap in guidance. Article 6 required Commission guidelines on high-risk classification by 2 February 2026. The Commission only published draft guidelines on 19 May 2026 for consultation, and at the time of writing the final version is still pending. Our high-risk AI classification checklist walks through the tests in the Act itself.
What does this mean in Ireland?
Ireland now has its national framework in place. The Regulation of Artificial Intelligence Act 2026 was signed on 21 July 2026, establishing the AI Office of Ireland as an independent statutory body and the single point of contact for the EU AI Act. It coordinates the 15 national competent authorities designated in September 2025, which include the Data Protection Commission, the Central Bank of Ireland, the Competition and Consumer Protection Commission and the Workplace Relations Commission. Which authority you deal with depends on your sector.
What should an SME do now?
Work through the timeline in order of the nearest deadline:
- Before 2 December 2026: if you provide a generative AI feature, confirm its output is machine-readably marked and that image or video generation has safeguards against prohibited content.
- Now, if you run any chatbot or publish AI content: check the Article 50 disclosures that already apply.
- This quarter: record the AI literacy measures you have taken for staff and contractors.
- During 2027: classify every AI system against Annex III and, if high-risk, start the quality management system using EN 18286 as a reference.
- Throughout: keep an inventory of AI systems with your role for each, provider or deployer.
If you are unsure whether any of this reaches your business, start with does the EU AI Act apply to my small business.
Frequently asked questions
Is the Digital Omnibus on AI final or still provisional?
It is final. Regulation (EU) 2026/1744 was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Older commentary describing a provisional deal predates that publication.
Did the Omnibus delay the AI Act transparency rules for chatbots?
No. Article 50 obligations, such as telling people they are talking to an AI system, have applied since 2 August 2026. The only relief is a transition until 2 December 2026 for marking the output of generative systems already on the market before 2 August 2026.
When do high-risk AI rules apply to recruitment or credit-scoring tools?
These are Annex III use cases, so the provider and deployer obligations apply from 2 December 2027. AI that is a safety component of a product covered by EU product legislation listed in Annex I follows the later date of 2 August 2028.
Has AI Act enforcement started?
Yes, in part. National market surveillance authorities began supervising and enforcing rules such as AI literacy from 2 August 2026, and the Commission's powers to fine general-purpose AI model providers also apply from that date. High-risk obligations cannot be enforced before they apply.
Could the dates move again?
Any further change would need new legislation, and none is in force at the time of writing. Plan against the dates in the consolidated text and watch the Commission's AI Act pages and the AI Office of Ireland for guidance updates.
If you are planning an AI product around these dates and want a second view on scope and sequencing, book a free 30-minute call with our team.
Cover photo by RDNE Stock project on Pexels.