The EU AI Act After the AI Omnibus: The Timeline That Now Applies

For most of 2026, a single date dominated EU AI Act planning: 2 August 2026, the day the high-risk obligations were due to apply. Compliance programmes, vendor roadmaps and a great deal of published commentary were built around it.

The obligations did not arrive on that date. The AI Omnibus, formally Regulation (EU) 2026/1744 (the “Digital Omnibus on AI”), entered into force on 27 July 2026, six days before the date everyone was planning for. It moved the high-risk obligations to 2 December 2027 for the use cases listed in Annex III and to 2 August 2028 for AI covered by the product legislation in Annex I.

The rest of the Act did not move. General application, the enforcement powers of the AI Office and national authorities, and the Article 50 transparency obligations all started on 2 August 2026 as planned. Two further changes land on 2 December 2026.

This article is a reference timeline for the Act as it now stands. Every date in it is taken from the European Commission, the EU institutions or the consolidated text of the Act, and the sources are listed at the end. It is written for CTOs, compliance leads and AI programme owners who need to replan around the EU AI Act high-risk delay without overcorrecting.

A Correction, Including to Our Own Commentary

Much of the published commentary on the EU AI Act, including several earlier articles on this site, treated 2 August 2026 as the date the high-risk obligations would apply. Some advised readers not to expect the Digital Omnibus to change that. That was wrong. The Omnibus was a live legislative file with a published timetable, and it completed before the date arrived.

We corrected our affected articles in place on 3 October 2026. Each carries a dated correction note and a list of sources. If you have read them before, the corrected versions are:

• EU AI Act Compliance Checklist: What Applies When and How to Prepare for High-Risk Rules
• EU AI Act High-Risk Compliance: A Technical Readiness Guide
• The EU AI Act Now Applies: What Operational Compliance Actually Looks Like
• GPAI Obligations, Codes of Practice, and the EU AI Act Roadmap After the AI Omnibus

The lesson we have taken is a simple one. A pending amendment is a fact to be tracked against the legislative record, not a rumour to be discounted.

How the AI Omnibus Became Law

The legislative steps, from the EU institutions’ own records:

The Commission’s announcement is unambiguous: “On 27 July 2026, the AI Omnibus enters into force across the EU.” Because it entered into force before 2 August 2026, the high-risk provisions of the original Act never applied in their original form.

What else the Omnibus changed

The high-risk dates attracted the attention, but the Commission lists other changes as well, including:

• “Some measures previously reserved for SMEs are extended to small mid-cap companies (SMCs)”
• expanded access to regulatory sandboxes, including “an EU-level regulatory sandbox”
• a simplified AI literacy requirement, “with the Commission and the Member States taking a stronger role in promoting AI literacy”
• a simplified obligation “to register exempted AI systems in the EU central database”
• permission for “the processing of special categories of personal data to detect and correct bias”
• “extended oversight” by the AI Office of “certain AI systems, including those built on general-purpose models and embedded in large online platforms and search engines”
• a new prohibition on AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material

The EU AI Act Timeline at a Glance

The sections below take each band in turn.

What Already Applies

Prohibitions and AI literacy, since 2 February 2025

The Commission’s regulatory framework page states that “prohibited AI practices and AI literacy obligations entered into application from 2 February 2025.” The Omnibus kept both, although it added to the prohibitions and simplified the literacy duty.

AI literacy under Article 4 remains a duty on both providers and deployers. As amended, it reads: “Providers and deployers of AI systems shall take measures to support the development of AI literacy … This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.” In our view, that wording rewards a proportionate, documented programme: training matched to the systems people actually use and the decisions they actually make, with a record that it happened. It does not reward certificates for their own sake.

GPAI obligations, since 2 August 2025

“The governance rules and the obligations for GPAI models became applicable on 2 August 2025.” These obligations fall on the providers of general-purpose AI models: the model developers, not most businesses that build on their models. There is a transitional period for older models. Under Article 111, “Providers of general-purpose AI models that have been placed on the market before 2 August 2025 shall take the necessary steps … by 2 August 2027.”

General application and enforcement, since 2 August 2026

The Act “became applicable on 2 August 2026, with some exceptions”. From the same date, “The enforcement powers of the AI Office and the national competent authorities of the Member States apply.”

This is the part of the original timetable that most needs emphasising, because the high-risk delay makes it easy to miss. The EU AI Act is enforceable now for the provisions that already apply: the prohibitions, AI literacy, the GPAI obligations and Article 50.

Article 50 transparency, since 2 August 2026

The EU AI Act Article 50 transparency obligations cover four situations:

• telling people they are interacting with an AI system, unless that is obvious
• machine-readable marking of AI-generated or manipulated audio, image, video and text
• informing people exposed to emotion recognition or biometric categorisation
• disclosing deepfakes, and AI-generated text published to inform the public on matters of public interest

The Commission’s FAQ is explicit that “Article 50 of the AI Act applies as from 2 August 2026.” There is one limited grace period, which we cover under 2 December below. We will cover the engineering of Article 50 compliance in a separate guide.

What Moved: The High-Risk Obligations

The amended Article 113 now sets two dates for the high-risk regime:

“(i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I”

The two categories are worth keeping distinct, because they move on different dates and usually involve different teams.

Annex III systems (from 2 December 2027). Article 6(2) states that “AI systems referred to in Annex III shall be considered to be high-risk.” Annex III lists use cases under eight headings: biometrics; critical infrastructure; education and vocational training; employment, workers’ management and access to self-employment; access to essential private and public services and benefits; law enforcement; migration, asylum and border control management; and administration of justice and democratic processes. For most software businesses, the headings that matter are employment and essential services. Recruitment screening, performance monitoring and creditworthiness assessment all appear in Annex III, although creditworthiness carries an exception for “AI systems used for the purpose of detecting financial fraud”. Article 6(3) also provides a derogation for an Annex III system that “does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons”. Relying on that derogation is a documented decision in its own right.

Annex I systems (from 2 August 2028). The Commission describes these as “High-risk AI embedded in physical products (machinery, toys, lifts, etc.)”. Under Article 6(1), these are AI systems that are a safety component of a product, or are themselves a product, “covered by the Union harmonisation legislation listed in Annex I”, where that product “is required to undergo a third-party conformity assessment”. In practice this is regulated-product territory, where the AI Act obligations sit alongside an existing conformity-assessment regime.

Guidance that is still to come

The Commission consulted on draft guidelines for classifying high-risk systems. Its consultation page states that “The final guidelines will be adopted by the end of 2026.” Until those guidelines are adopted, treat that as the Commission’s plan, not a date. Classification work does not need to wait for them, but borderline decisions should be revisited once they are published.

What Lands on 2 December 2026

Two changes take effect on the same day.

1. The marking grace period ends for legacy generative systems. The Commission’s Article 50 FAQ sets out the only transitional relief in the transparency chapter:

“A limited grace period is envisaged only for AI systems placed on the market before 2 August 2026 and only as regards the marking and detection obligation … Providers of such systems must comply with those obligations only as from 2 December 2026.”

The amended Act puts the same rule in Article 111(4): providers of generative systems “placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.”

Read that carefully. It covers only the machine-readable marking and detection obligation in Article 50(2), and only systems already on the market before 2 August 2026. A generative feature launched after 2 August 2026 has had to mark its outputs from launch. The chatbot disclosure and deepfake labelling duties have no grace period at all.

2. A new prohibition applies. The amended Article 113 applies the new Article 5 prohibitions from 2 December 2026, and the Commission’s enforcement page states: “The prohibitions related to the generation or manipulation of non-consensual intimate material and child sexual abuse material (CSAM) apply from 2 December 2026.” Any product with an image, video or audio generation capability should have its guardrails reviewed against this prohibition before that date. Prohibited practices carry the highest penalty tier in the Act.

The Commission’s Code of Practice on Transparency of AI-generated Content is the practical reference for marking and labelling. Its final version was published on 10 June 2026, and the Commission reports that about 190 organisations had signed it by the end of July 2026. The Commission has assessed the code as adequate, but it is explicit that “Adherence to the code does not constitute conclusive evidence of compliance with these obligations.”

Still Ahead in 2027

• 2 August 2027: legacy GPAI models. Providers of models placed on the market before 2 August 2025 must comply by this date (Article 111). If you build on such a model, our advice is to ask your provider now how and when they will meet it, and to record the answer in your supplier assessment.
• 2 August 2027: national sandboxes. Article 57 requires each Member State to have “at least one AI regulatory sandbox at national level, which shall be operational by 2 August 2027.” For organisations developing novel high-risk systems, a sandbox may become a useful route to regulatory dialogue before the Annex III date.
• 2 December 2027: Annex III high-risk obligations apply.

Penalties

The Omnibus did not change the headline fine ceilings, and they already apply to the provisions now in force. From the Commission’s enforcement page:

For fines under Article 99, SMEs, including start-ups, face the lower of the two figures rather than the higher (Article 99(6)). The Omnibus extended that treatment to small mid-cap companies (SMCs) for the two lower tiers (Article 99(6a)).

The Commission’s Article 50 FAQ confirms that transparency breaches sit in the middle tier: “Fines can reach up to 15 million euros or 3% of total worldwide turnover”.

Our View: Runway, Not a Reprieve

This section is our analysis, not the Commission’s.

The high-risk delay gives a provider of an Annex III system roughly fourteen months from the date of this article, rather than none. That is enough time to build the capability properly, but not enough to start late. The core high-risk work is a risk management system, data governance, technical documentation, logging, human oversight design and a quality management system. It is organisational and engineering work, and it does not compress well. Teams that paused their programmes in August are now carrying the same scope into a shorter remaining window.

We would make three recommendations.

Do not pause; re-sequence. Use the next six months on the things that take longest and change least: the AI system inventory, classification decisions with written rationale, and the management system that will own them. Leave the system-specific technical documentation until designs stabilise.

Fix what already applies first. Article 50 and AI literacy are enforceable today and affect far more organisations than the high-risk regime. A product with a chatbot, a generative feature or AI-written customer communications has live obligations now. It may also have a 2 December deadline if the feature predates August.

Build one governance system, not one per regulation. The dates have moved once. Our view is that a compliance programme wired to a single date is fragile, while an operating model is not. We have written about using ISO/IEC 42001, the AI management system standard published in December 2023, as that spine in From Compliance Project to Operating Model: Building an AI Governance System with ISO/IEC 42001. The same system can carry UK obligations as well, including the reformed automated decision-making rules.

Finally, plan against the dates in Article 113 as they now stand. They are fixed in the amended text. Building a plan around the hope of a further delay is the mistake much of the market made with the original date.

How McKenna Consultants Can Help

McKenna Consultants is a UK software consultancy that has been building production software since 2004, and AI governance is part of our AI First practice. We work where regulation meets engineering. That means turning Article 50 into pipeline requirements, building the logging and human-oversight controls the high-risk regime calls for, and designing an AI management system that your engineering teams will actually run.

If your programme was planned around 2 August 2026 and needs replanning, or you want an independent check of which obligations already apply to your products, get in touch.

This article is a summary of the regulation’s timeline for planning purposes. It is not legal advice. Confirm classification decisions and obligations for your specific systems with qualified legal counsel.

Sources

All sources checked on 9 October 2026.

• Official Journal of the European Union — Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), published 24 July 2026; entry into force on the third day following publication.
• European Commission — AI Omnibus enters into force: “On 27 July 2026, the AI Omnibus enters into force across the EU”; list of main changes.
• European Parliament Research Service — Briefing EPRS_BRI(2026)782651: trilogue agreement on 7 May 2026; Parliament approval on 16 June 2026.
• Council of the European Union — Adoption of the legislative act, 29 June 2026.
• European Commission — AI Act regulatory framework: proposal adopted 19 November 2025; general application on 2 August 2026; prohibitions and AI literacy from 2 February 2025; governance and GPAI obligations from 2 August 2025.
• European Commission — Enforcement of the AI Act: enforcement powers from 2 August 2026; NCII/CSAM prohibitions from 2 December 2026; maximum fines.
• European Commission — Transparency obligations under Article 50: FAQ: application from 2 August 2026 and the marking grace period to 2 December 2026.
• European Commission — Code of Practice on Transparency of AI-generated Content: final code published 10 June 2026; about 190 signatories by the end of July 2026.
• European Commission — Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated Content: adherence “does not constitute conclusive evidence of compliance”.
• European Commission — Targeted consultation on draft high-risk classification guidelines: “The final guidelines will be adopted by the end of 2026.”
• AI Act Service Desk — Article 113: Entry into force and application: high-risk dates of 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
• AI Act Service Desk — Article 6: Classification rules for high-risk AI systems, Annex I and Annex III.
• AI Act Service Desk — Article 4: AI literacy, Article 57: AI regulatory sandboxes and Article 111: AI systems already placed on the market, including the new paragraph 4.
• AI Act Service Desk — Article 99: Penalties: fine ceilings; the lower figure for SMEs (paragraph 6) and, under the new paragraph 6a, for SMCs.
• IEC Webstore — ISO/IEC 42001:2023: publication date 2023-12-18.