EU AI Act Deadlines: The Verified Timeline

Verified against the Official Journal on August 19, 2026: the EU AI Act’s prohibitions and AI-literacy duties have applied since February 2, 2025, general-purpose AI obligations since August 2, 2025, and the Article 50 transparency duties (chatbot disclosure, deepfake labeling, synthetic-content marking) have been in force since August 2, 2026. The "Digital Omnibus" amendment is now law — Regulation (EU) 2026/1744, adopted July 8, 2026 and published in the Official Journal on July 24, 2026 — deferring stand-alone Annex III high-risk duties to December 2, 2027 and product-embedded Annex I duties to August 2, 2028. The next deadline on the calendar is December 2, 2026: machine-readable marking for generative systems already on the market.

Reviewed by Dor Israel, Founder · Updated August 19, 2026

Free: The ISO 42001 Starter Checklist for an AIMS (9 steps) →

The timeline as it stands on August 19, 2026

Regulation (EU) 2024/1689 entered into force on August 1, 2024 with staggered application dates. The Digital Omnibus amendment that reshuffles the high-risk dates is no longer pending: it was adopted as Regulation (EU) 2026/1744 on July 8, 2026, published in the Official Journal on July 24, 2026, and entered into force three days after publication. The dates below are read from the published OJ text, not from press releases.

Penalties (Article 99) — unchanged by the Omnibus

The fine maximums scale with worldwide annual turnover, whichever amount is higher — with one deliberate break for small businesses: for SMEs and start-ups, each fine is capped at the lower of the fixed amount or the percentage.

What changed for small businesses

Three Omnibus changes matter most for smaller organizations:

• The simplified technical-documentation form previously reserved for SMEs is extended to "small mid-caps" — companies up to roughly 750 employees or €150 million annual revenue.
• National AI regulatory sandboxes, which SMEs were promised priority access to, are pushed to August 2, 2027.
• The deferral applies to the high-risk regime only. If you deploy a customer-facing chatbot, generate synthetic content or use emotion recognition, the Article 50 transparency duties still land on August 2, 2026.

What to do before December 2, 2026

The Article 50 transparency duties are no longer upcoming — they have applied since August 2, 2026: disclose AI interaction to users, label deepfakes and machine-generated content, and document how your systems do it. The next date on the calendar is December 2, 2026, when the transitional allowance ends for generative AI systems that were already on the market before August 2, 2026: from that day their outputs must carry machine-readable marking too (Article 111(4) of Regulation 2024/1689 as amended by Regulation 2026/1744). The same date adds the new prohibition on AI that generates non-consensual intimate imagery or child sexual abuse material.

For most small companies the practical work is an AI usage policy, an AI system register with risk classification, transparency notices, and a record of how each generative system marks its output — the documentation layer an AI governance pack covers. ISO/IEC 42001 remains the certifiable management-system standard for organizations that want audited proof of AI governance. No template makes an organization compliant with the AI Act; compliance comes from operating the controls, and for high-risk systems the deferred dates buy time to build them properly.

Frequently asked questions

Do high-risk AI rules still start on August 2, 2026?

No. The Digital Omnibus amendment is now law: Regulation (EU) 2026/1744, adopted July 8, 2026 and published in the Official Journal on July 24, 2026, defers stand-alone Annex III high-risk obligations to December 2, 2027 and product-embedded Annex I obligations to August 2, 2028. The deferral is on the statute book — read directly from the published OJ text.

What is the December 2, 2026 EU AI Act deadline?

Two things land on December 2, 2026. Generative AI systems that were already on the market before August 2, 2026 lose their transitional allowance and must mark their outputs in a machine-readable format (Article 111(4) of Regulation 2024/1689 as amended). And the new prohibition on AI generating non-consensual intimate imagery or child sexual abuse material takes effect. New systems have owed the Article 50 transparency duties since August 2, 2026.

What is Regulation (EU) 2026/1744?

The "Digital Omnibus on AI" — the regulation of July 8, 2026 that amends the EU AI Act (Regulation (EU) 2024/1689). Published in the Official Journal on July 24, 2026, it defers the high-risk regime (Annex III to December 2, 2027; Annex I products to August 2, 2028), adds the December 2, 2026 machine-readable-marking deadline for generative systems already on the market, adds a prohibition on AI generating non-consensual intimate imagery or CSAM, and extends simplified documentation to small mid-caps. Its ELI citation is eur-lex.europa.eu/eli/reg/2026/1744/oj.

Was the EU AI Act delayed?

Partly. Only the high-risk regime was deferred (to December 2, 2027 for Annex III and August 2, 2028 for Annex I products). The prohibitions and AI-literacy duties (in force since February 2, 2025), the general-purpose AI obligations (since August 2, 2025) and the Article 50 transparency duties (in force since August 2, 2026) were not postponed.

What EU AI Act rules apply right now?

As of August 2026: the bans on prohibited AI practices and the AI-literacy duty (since February 2, 2025), the obligations for general-purpose AI models plus the EU governance framework (since August 2, 2025), and the Article 50 transparency duties — chatbot disclosure, deepfake labeling, synthetic-content marking — in force since August 2, 2026.

What are the maximum EU AI Act fines?

Up to €35 million or 7% of total worldwide annual turnover for prohibited practices; up to €15 million or 3% for most other violations, including the high-risk and transparency duties; up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs and start-ups each fine is capped at the lower of the amount or the percentage (Art. 99).

Does the EU AI Act apply to small businesses?

Yes — there is no small-business exemption from the prohibitions, transparency duties or (when they apply) high-risk obligations. The Act does soften the impact: fines for SMEs are capped at the lower tier value, and the 2026 Omnibus extends simplified technical documentation to companies up to roughly 750 employees or €150 million revenue.

Related guides: AI Governance (EU AI Act & NIST AI RMF) · ISO 42001

Toolkits that help

Related articles

• Do You Need ISO 42001? AI Management Systems vs the EU AI Act
• The EU AI Act for Small Companies: What You Actually Need to Do
• The NIST AI Risk Management Framework (AI RMF 1.0), Explained
• ISO 27001 Certification in Numbers: The Latest ISO Survey Data
• What a Data Breach Costs: The Verified 2026 Numbers

← All articles