EU AI Act key dates: the updated timeline after the Digital Omnibus
The AI Act key dates do not all arrive at once, because the EU Artificial Intelligence Act applies in phases. In July 2026, the Digital Omnibus (Regulation (EU) 2026/1744) also moved several of them. This is the updated timeline, with what each milestone requires.
In 30 seconds: prohibitions and AI literacy have applied since February 2025, and general-purpose AI models since August 2025. Article 50 transparency has applied since 2 August 2026. A new ban follows on 2 December 2026. Finally, high-risk obligations move to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
AI Act key dates at a glance
The table brings together the AI Act key dates after the reform. The original text is Regulation (EU) 2024/1689, and the reform is Regulation (EU) 2026/1744.
| Date | What applies | Who it affects |
|---|---|---|
| 1 August 2024 | Regulation (EU) 2024/1689 enters into force. | — |
| 2 February 2025 | Prohibited AI practices (Art. 5) and AI literacy (Art. 4). | All providers and deployers. |
| 2 August 2025 | General-purpose AI (GPAI) models, governance and penalties. | GPAI model providers and Member States. |
| 2 August 2026 | General application and Article 50 transparency. | Anyone offering chatbots, generating synthetic content or publishing deepfakes. |
| 2 December 2026 | New ban (non-consensual intimate images and child sexual abuse material) and end of the Article 50(2) marking transition for generative systems placed on the market before 2 August 2026. | Generative AI providers. |
| 2 August 2027 | At least one AI regulatory sandbox up and running in each Member State. | National authorities. |
| 2 December 2027 | Annex III high-risk systems (employment, credit, education, essential services…). | Providers and deployers. |
| 2 August 2028 | High-risk AI in regulated products (Annex I: medical devices, machinery, vehicles…). | Manufacturers and providers of those products. |
What each of the AI Act key dates means
2 February 2025: the first of the AI Act key dates
From this date, Article 5 bans unacceptable-risk practices. For example, manipulation that exploits vulnerabilities, social scoring or emotion recognition at work and in education. It also bans building facial recognition databases through untargeted scraping of images. In addition, Article 4 asked organisations to ensure a sufficient level of AI literacy among staff. However, the Omnibus later softened that duty, which now focuses on measures to foster it.
2 August 2025: general-purpose AI models
Providers of general-purpose models, such as large language models, must keep technical documentation and inform those who integrate them. They also have to respect copyright and publish a summary of the training content. Models with systemic risk carry additional obligations too. European governance and the penalty regime also started on that day.
2 August 2026: transparency (Article 50)
Of all the AI Act key dates, this one affects the most companies, because it does not require a system to be high-risk. Since then, depending on your role, you must tell people when they talk to an AI and mark synthetic content in a machine-readable way. You also have to label deepfakes and tell people when you use emotion recognition. The Digital Omnibus did not postpone these obligations. On that day, the Commission’s AI Office also gained the power to fine GPAI model providers.
2 December 2026: new ban and end of the transition
The Omnibus bans systems that generate intimate images without consent or child sexual abuse material. At the same time, the transition ends for generative systems that reached the market before 2 August 2026. Until then, they have extra time for the machine-readable marking in Article 50(2). New systems, by contrast, get no such extra time.
2 December 2027: Annex III high-risk systems
This covers systems that count as high-risk because of their use: recruitment, worker management or credit scoring, among others. Pricing in life and health insurance and access to education or essential services also fall here. So if you work in banking and fintech or in insurance, this is the most relevant of the AI Act key dates.
Providers need risk management, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity, plus a conformity assessment. Deployers, for their part, must follow the instructions, assign human oversight and keep the logs. In certain cases, they also assess the impact on fundamental rights.
2 August 2028: Annex I, the last of the AI Act key dates
This date affects AI systems that are safety components of products under EU harmonisation legislation. For example, medical devices, toys, lifts or radio equipment. Their high-risk obligations sit within the product’s own conformity assessment. That is why connected product manufacturers should align this with their other product obligations.
How the Digital Omnibus changed the AI Act key dates
- It appeared in the Official Journal of the EU on 24 July 2026 and has been in force since 27 July.
- It moves Annex III from 2 August 2026 to 2 December 2027, and Annex I from 2 August 2027 to 2 August 2028.
- Prohibitions, general-purpose models and transparency keep their dates, except for the marking transition.
- A new ban on non-consensual intimate images and child sexual abuse material applies from 2 December 2026.
- AI literacy under Article 4 now focuses on measures to foster it.
- National sandboxes have until 2 August 2027.
According to the European Commission’s AI Act page, the reform also extends some SME simplifications to small mid-cap companies. So review any internal plan built on the AI Act key dates from before July 2026.
What to have ready before the next AI Act key dates
Before the next AI Act key dates, you should have:
- An inventory of AI systems, including the tools teams use without central control (“shadow AI”).
- A risk classification for each system: prohibited, high, transparency or minimal.
- Transparency notices on chatbots and generated content, because they already apply.
- An AI training plan for the staff who use these tools, even though Article 4 is now more flexible.
- A high-risk roadmap, because technical documentation and risk management take months.
- Organised evidence for each decision, as we explain in how to automate compliance evidence.
Frequently asked questions
What are the AI Act key dates?
The Regulation entered into force on 1 August 2024. Since then, the AI Act key dates have been February 2025, August 2025, August 2026 and December 2026. December 2027 (Annex III high-risk) and August 2028 (high-risk in regulated products) come next.
Has the EU delayed the AI Act?
Only partly. The Digital Omnibus delayed the high-risk obligations, but prohibitions, general-purpose models and transparency keep their dates.
Does it affect me if I only use AI and do not develop it?
Yes. As a deployer, you have transparency obligations where relevant, for example when you publish deepfakes. In addition, if you use high-risk systems, you must assign human oversight and keep the logs. That is why the AI Act key dates matter to you too.
What are the penalties?
Using prohibited practices can cost up to €35 million or 7% of worldwide turnover. If you breach other obligations, the cap is €15 million or 3%. For supplying incorrect information to the authorities, fines reach €7.5 million or 1%. For SMEs and start-ups, the lower amount of each pair applies.
Do the AI Act key dates differ in Spain?
No. The AI Act key dates are the same across the EU, because a regulation applies without transposition. Spain also has AESIA, its AI supervision agency, set up by Royal Decree 729/2023. However, with Parliament dissolved (Royal Decree 806/2026), no complementary national law will pass before the 29 November elections.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps
Atalaya GRC keeps your AI system inventory, classifies each system under the Regulation and its regulatory clock warns you before every deadline. With a “one control, many regulations” approach, it also reuses the controls you already have for GDPR, NIS2 or ISO 27001, service by service. It centralises evidence, handles incidents and notifications and keeps the third-party register too. See the EU AI Act guide or request a demo.
