EU AI Act: deadlines and the Digital Omnibus (status October 2026)

Update of 15 October 2026. When I wrote this text in May, the Digital Omnibus had not yet been adopted. It is now binding law: Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026, in force since 27 July 2026. Several passages below are corrected. The Council adopted the Omnibus on 29 June 2026, not on 13 May. Embedded high-risk AI under Annex I applies from 2 August 2028, not 2 August 2027. And the AI literacy duty in Article 4 has read differently since 27 July 2026. Text, timeline and questions now give the state of 15 October 2026.

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. This article lays out the timeline that matters for companies operating in the EU, and what the Digital Omnibus changes.

The staged timeline

• 2 February 2025: Prohibited AI practices are banned, and the AI literacy obligation (Art. 4) applies. Since 27 July 2026 it reads: providers and deployers take measures to support the development of AI literacy among their staff; they do not have to guarantee a specific level.
• 2 August 2025: Rules for general-purpose AI models (GPAI) and the governance framework start to apply.
• 2 August 2026: Most of the Regulation applies, including the transparency obligations under Art. 50 (for example, labelling of AI-generated content). The high-risk obligations under Annex III do not yet apply; the Digital Omnibus has deferred them.
• 2 December 2026: New prohibitions under Art. 5 for AI that generates intimate images of an identifiable person without their consent, or child sexual abuse material. By then, systems placed on the market before 2 August 2026 must also mark their output in a machine-readable way (Art. 50(2)).
• 2 December 2027: The bulk of the obligations for high-risk AI systems (Annex III) become applicable, after the deferral through the Digital Omnibus (originally 2 August 2026).
• 2 August 2028: Obligations for high-risk AI that is a safety component of regulated products (Annex I) apply (originally 2 August 2027).

What the Digital Omnibus changes

After the political agreement in May 2026, the Council adopted the so-called Digital Omnibus on 29 June 2026. It was published as Regulation (EU) 2026/1744 of 8 July 2026 in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. The key points for businesses: the application of the high-risk obligations has been postponed, for Annex III systems to 2 December 2027, and for Annex I systems to 2 August 2028, and Article 4 on AI literacy has been rewritten as a duty to take supporting measures.

Important note: the deferral of the high-risk dates is binding law, not a plan. The relief is real, but it is no reason to wait: building a robust management system takes months, and 2 December 2027 arrives faster than it looks.

The honest summary in 2026: the prohibitions, GPAI rules and AI literacy already apply. The high-risk obligations have been deferred to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) through the Digital Omnibus, in force since 27 July 2026.

What you should do now

• Build an inventory of your AI systems and classify them by risk (prohibited / high-risk / limited / minimal).
• Cover the AI literacy duty: proportionate, documented training for the people who work with AI.
• Check transparency obligations (Art. 50): label AI interactions and AI-generated content where required.
• If you operate high-risk AI, start the governance work now, the build-up takes longer than the remaining time often suggests.

How ISO 42001 helps

A management system built to ISO/IEC 42001 gives you exactly the structures the AI Act asks for: an AI inventory, risk and impact assessments, human oversight, transparency and life-cycle control. It is the most efficient way to turn a legal obligation into a repeatable, auditable process.