EU AI Act: deadlines and the Digital Omnibus (status May 2026)

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. This article lays out the timeline that matters for companies operating in the EU, and what the May 2026 Digital Omnibus proposes to change.

The staged timeline

• 2 February 2025: Prohibited AI practices are banned, and the AI literacy obligation (Art. 4) applies. Providers and deployers must take measures, to their best extent, to ensure a sufficient level of AI literacy among their staff (a proportionate best-efforts duty).
• 2 August 2025: Rules for general-purpose AI models (GPAI) and the governance framework start to apply.
• 2 December 2027: The bulk of the obligations for high-risk AI systems (Annex III) become applicable, after the deferral through the Digital Omnibus (originally 2 August 2026).
• 2 August 2027: Obligations for high-risk AI that is a safety component of regulated products (Annex I) apply.

What the Digital Omnibus changes

On 7 May 2026 the EU institutions agreed on a so-called Digital Omnibus, confirmed by the Council on 13 May 2026, that adjusts parts of the AI Act. The key points for businesses: the application of the high-risk obligations has been postponed, for Annex III systems to 2 December 2027, and for Annex I systems to 2 August 2028, and the requirements around AI literacy (Art. 4) have been eased and simplified.

Important note: the agreement of 7 May 2026 was confirmed by the Council on 13 May 2026, and the deferral of the high-risk dates is settled. The relief is real, but it is no reason to wait: building a robust management system takes months, and 2 December 2027 arrives faster than it looks.

The honest summary in 2026: the prohibitions, GPAI rules and AI literacy already apply. The high-risk obligations have been deferred to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) through the confirmed Digital Omnibus.

What you should do now

• Build an inventory of your AI systems and classify them by risk (prohibited / high-risk / limited / minimal).
• Cover the AI literacy duty: proportionate, documented training for the people who work with AI.
• Check transparency obligations (Art. 50): label AI interactions and AI-generated content where required.
• If you operate high-risk AI, start the governance work now, the build-up takes longer than the remaining time often suggests.

How ISO 42001 helps

A management system built to ISO/IEC 42001 gives you exactly the structures the AI Act asks for: an AI inventory, risk and impact assessments, human oversight, transparency and life-cycle control. It is the most efficient way to turn a legal obligation into a repeatable, auditable process.