Regulationsby GlyphEU AI Act
Amended European Union · In force Aug 1, 2024 · next deadline Dec 2, 2026 (in 36 days)
Deadlines
Coming up
New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period endsNew Art 5(1)(ba)/(bb) prohibitions on AI systems that generate non-consensual intimate imagery of identifiable persons or child sexual abuse material apply. Generative AI systems placed on the market before 2 Aug 2026 must comply with the Art 50(2) marking duty by this date (new Art 111(4)).
Legacy GPAI models must comply; national AI sandboxes operationalProviders of GPAI models placed on the market before 2 Aug 2025 must comply (Art 111(3)). Each Member State must have at least one national AI regulatory sandbox operational (Art 57(1) as amended by the Omnibus).
High-risk obligations apply to Annex III systemsChapter III Sections 1-3 (high-risk requirements and provider/deployer obligations) apply to AI systems classified high-risk under Art 6(2) and Annex III (employment, credit scoring, education, biometrics, essential services and similar). Deferred from 2 Aug 2026 by Regulation (EU) 2026/1744.
High-risk obligations apply to Annex I product-embedded systemsChapter III Sections 1-3 apply to AI systems classified high-risk under Art 6(1) and Annex I (safety components of products covered by EU harmonisation legislation). Deferred from 2 Aug 2027 by Regulation (EU) 2026/1744.
Public-authority high-risk systems must complyProviders and deployers of high-risk AI systems intended for use by public authorities that were placed on the market before the Chapter III application date must comply (Art 111(2), as replaced by the Omnibus).
Large-scale EU IT systems must complyAI systems that are components of the large-scale IT systems in Annex X (e.g. SIS, VIS, Eurodac, EES, ETIAS) placed on the market before 2 Aug 2027 must be brought into compliance (Art 111(1)).
Already passed
General application: transparency obligations, GPAI fines, most other rulesThe AI Act's general date of application. Article 50 transparency obligations (chatbot disclosure, deepfake labelling, machine-readable marking of synthetic content) and Commission fines on GPAI providers (Art 101) apply. Not deferred by the Omnibus.
Digital Omnibus on AI enters into forceRegulation (EU) 2026/1744 (adopted 8 July 2026, OJ 24 July 2026) enters into force on the third day after publication. Amended Articles 102 to 110 apply from this date (new Art 113(d)).
GPAI, governance, notified bodies and penalties applyChapter III Section 4 (notifying authorities), Chapter V (general-purpose AI model obligations), Chapter VII (governance), Chapter XII (penalties, except Art 101) and Art 78 apply (Art 113(b)).
Prohibited practices and AI literacy applyChapters I and II apply, including the Article 5 bans on prohibited AI practices and the Article 4 AI literacy duty (Art 113(a)).
AI Act enters into forceRegulation (EU) 2024/1689 enters into force twenty days after publication on 12 July 2024 (Art 113).
Summaries for reference, not legal advice. Check the official text.
What it does
A risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.
- Who it applies to
- Providers placing AI systems or general-purpose AI models on the EU market (wherever established), deployers of AI systems in the EU, importers, distributors, and non-EU providers/deployers whose AI output is used in the EU. GPAI models trained with more than 10^25 FLOPs are presumed to have systemic risk.
- Penalties
- Prohibited practices: up to EUR 35M or 7% of worldwide annual turnover, whichever is higher. Most other operator obligations: up to EUR 15M or 3%. Incorrect or misleading information to authorities: up to EUR 7.5M or 1%. For SMEs, and since the 2026 Omnibus also small mid-caps (SMCs), the lower of the two amounts applies. GPAI providers: Commission fines up to EUR 15M or 3% (Art 101).
- Enforced by
- National market surveillance authorities and notifying authorities; European Commission AI Office (GPAI models and AI systems built on them); European AI Board
- Official name
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- Citation
- OJ L, 2024/1689, 12.7.2024; amended by OJ L, 2026/1744, 24.7.2026
- Topics
- AI, Biometrics, Children
Verified 2026-09-22 eur-lex.europa.eu ai-act-service-desk.ec.europa.eu ai-act-service-desk.ec.europa.eu freshfields.com
Research notes
The Digital Omnibus on AI (Commission proposal 19 Nov 2025; EP position 16 June 2026; Council decision 29 June 2026; signed 8 July 2026) was published in the OJ on 24 July 2026 as Regulation (EU) 2026/1744 and has been in force since 27 July 2026. The high-risk delays are therefore legally binding, not tentative. Other Omnibus changes: Art 4 AI literacy recast as 'take measures to support' AI literacy (no guaranteed level); SME relief extended to small mid-caps; registration for Art 6(3) non-high-risk systems simplified; machinery moved from Annex I Section A to Section B; Commission guidance on post-market monitoring due 2 Sep 2027. Existing high-risk systems placed on the market before the relevant Chapter III date are covered only if significantly changed afterwards (Art 111(2)). The AI Act Service Desk article pages had not yet been updated to show the Omnibus text when checked.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setDigital Services ActLayered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.Next: Feb 18, 2027 DSA SME impact report · in 4 monthsEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 monthsEU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 days
Questions about EU AI Act
- What are the EU AI Act compliance deadlines?
- Aug 1, 2024: AI Act enters into force. Feb 2, 2025: Prohibited practices and AI literacy apply. Aug 2, 2025: GPAI, governance, notified bodies and penalties apply. Jul 27, 2026: Digital Omnibus on AI enters into force. Aug 2, 2026: General application: transparency obligations, GPAI fines, most other rules. Dec 2, 2026: New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends. Aug 2, 2027: Legacy GPAI models must comply; national AI sandboxes operational. Dec 2, 2027: High-risk obligations apply to Annex III systems. Aug 2, 2028: High-risk obligations apply to Annex I product-embedded systems. Aug 2, 2030: Public-authority high-risk systems must comply. Dec 31, 2030: Large-scale EU IT systems must comply.
- When does EU AI Act take effect?
- EU AI Act took effect on Aug 1, 2024. The next milestone is Dec 2, 2026: New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends.
- Who does EU AI Act apply to?
- Providers placing AI systems or general-purpose AI models on the EU market (wherever established), deployers of AI systems in the EU, importers, distributors, and non-EU providers/deployers whose AI output is used in the EU. GPAI models trained with more than 10^25 FLOPs are presumed to have systemic risk.
- What are the penalties under EU AI Act?
- Prohibited practices: up to EUR 35M or 7% of worldwide annual turnover, whichever is higher. Most other operator obligations: up to EUR 15M or 3%. Incorrect or misleading information to authorities: up to EUR 7.5M or 1%. For SMEs, and since the 2026 Omnibus also small mid-caps (SMCs), the lower of the two amounts applies. GPAI providers: Commission fines up to EUR 15M or 3% (Art 101).