REGULATORY STATUS · 27 JUL 2026 Reg. (EU) 2024/1689 · amended Jul 2026
The AI Act changed three weeks ago.
Most compliance calendars are now wrong.
The Digital Omnibus moved high-risk deadlines to 2027–28 — but transparency duties still land in 6 days, and new prohibitions arrive in December. Here is exactly where the law stands, verified against the Official Journal.
IN FORCE TODAY
Prohibited practices · AI literacy · all GPAI model rules
Art. 4, 5, 50–56 · since Feb & Aug 2025
See what already binds you → IN 6 DAYS — AUG 2
Transparency duties + GPAI enforcement — not deferred
Art. 50 incl. marking for new gen-AI · AI Office enforcement powers · penalties framework
Read Article 50 → CHANGED JUL 2026
High-risk obligations moved to Dec 2027 / Aug 2028
Digital Omnibus adopted · OJ publication pending · NCII/CSAM ban Dec 2
Both calendars, side by side → The calendar, as amended
Struck dates superseded by the Digital Omnibus · Full timeline →FEB 2, 2025
Prohibitions
Art. 5 banned practices; AI literacy (Art. 4).
IN FORCE
AUG 2, 2025
GPAI rules
Model obligations, systemic-risk tier, governance.
IN FORCE
AUG 2, 2026
Transparency
Art. 50 applies (marking incl. for new gen-AI). GPAI enforcement, penalties regime.
6 DAYS
DEC 2, 2026
Marking + new ban
Art. 50(2) for legacy systems; NCII/CSAM prohibition.
NEW — OMNIBUS
DEC 2, 2027
was AUG 2, 2026
High-risk (Annex III)
Full Chapter III obligations for stand-alone systems.
MOVED +16 MO
AUG 2, 2028
was AUG 2, 2027
High-risk (Annex I)
AI embedded in regulated products (devices, vehicles).
MOVED +12 MO
Where do you stand?
Your obligations depend on your role in the AI value chain and your system's risk class. Pick your role — we map every duty you owe, with its post-Omnibus date.
Provider You develop an AI system or model and place it on the EU market. 76 obligations AUG 2 Deployer You use an AI system under your authority in the EU. 37 obligations AUG 2 Importer You place a non-EU provider's system on the EU market. 9 obligations DEC 2027 Distributor You make a system available without modifying it. 6 obligations DEC 2027 GPAI provider You provide a general-purpose model, incl. open-weight. 16 obligations IN FORCE
Multiple roles are common — a deployer who substantially modifies a system becomes its provider (Art. 25). See how roles shift →
The knowledge base
Everything the Act touches, structured the same way — consolidated law, live trackers, plain-language explanations. Every page shows its source and when it was last verified.
LAW The Act, consolidated 113 articles, 180 recitals, 13 annexes — as amended, with pre-Omnibus diffs. DUTIES Obligations database Every discrete duty, mapped to role, risk class, date, and penalty band. RISK Risk classification Art. 5 and 6 logic, Annex III use cases, exemptions — as decision paths. MODELS GPAI hub Model rules, the 10²⁵ FLOP systemic tier, Code of Practice signatories. STANDARDS Standards tracker JTC 21 work items with stage, fast-track flags, and OJEU citation status. ENFORCEMENT Enforcement map 27 national authorities, notified bodies, sandboxes, fine bands. GUIDANCE Guidance registry Commission guidelines, codes of practice, delegated acts, consultations. TERMS Glossary All 68 legal definitions from Art. 3, translated into plain language.
Regulatory radar
What's moving right now — standards, delegated acts, deadlines AMENDMENT Digital Omnibus on AI Adopted (EP Jun 16, Council Jun 29). OJ number + entry-into-force date pending publication. OJ ≤ JUL 30 DEADLINE Art. 50 transparency + GPAI enforcement Apply as originally scheduled — disclosure, labelling, marking for new gen-AI. AUG 2, 2026 STANDARD prEN 18286 — Quality management (Art. 17) Public enquiry closed Jan 22 — furthest along. Fast-tracked: direct publication on positive vote. ≤ Q4 2026 STANDARD Harmonised standards, first wave (JTC 21) Six fast-tracked drafts. OJEU citation — which grants presumption of conformity — follows later. Q4 2026 GUIDANCE Code of Practice on AI-content transparency Final version published Jun 10, 2026. Signable — supports Art. 50 compliance. FINAL PROHIBITION New Art. 5 ban — NCII / CSAM generation Added by Omnibus. Safeguard duties for providers and deployers. DEC 2, 2026 DELEGATED Annex I sectoral delegated acts Commission to specify limited regimes where sector law is equivalent. AUG 2, 2027
The two-calendar brief
One email when a deadline moves, a standard changes stage, or the Omnibus lands in the Official Journal — with the source linked. Nothing else, ever.
Briefing answers
The questions boards and leadership teams are asking this month — answered against the amended text.
Did the EU just delay the AI Act?
Partially. The Digital Omnibus (adopted Jun 2026, signed 8 Jul, awaiting Official Journal publication) moves high-risk obligations to Dec 2, 2027 (Annex III) and Aug 2, 2028 (Annex I products). Everything else — prohibitions, GPAI rules, and the Art. 50 transparency duties landing Aug 2, 2026 — proceeds on schedule.
Read the source → What exactly applies on August 2, 2026?
Art. 50 transparency: telling people they’re interacting with AI, labelling AI-generated content, disclosing emotion recognition and biometric categorisation. Plus the governance and penalties framework. Only the machine-readable watermarking duty (Art. 50(2)) gets a grace period — to Dec 2, 2026 — and only for systems already on the market.
Read the source → Does the delay mean we can pause our high-risk program?
The obligations are unchanged — only later. Conformity assessment, QMS, data governance and documentation take most organisations 12–18 months. The first harmonised standards are expected Q4 2026, which is when gap analysis against the final text can start in earnest.
Read the source → We self-assessed our system as not high-risk. Anything to do?
Yes. The Omnibus reinstated registration: systems self-assessed out of high-risk classification under Art. 6(3) must still be registered in the EU database, in a lighter form. Document your reasoning — authorities can challenge it.
Read the source → We’re not an EU company. Are we in scope?
Often, yes. The Act covers any provider placing a system on the EU market, and providers or deployers anywhere whose system’s output is used in the EU (Art. 2). Non-EU providers of high-risk systems also need an EU authorised representative.
Read the source → What’s the realistic penalty exposure?
Up to €35M or 7% of worldwide turnover for prohibited practices; €15M / 3% for most obligations; €7.5M / 1% for misleading information (Art. 99). National authorities gain full enforcement powers Aug 2, 2026 — starting with transparency.
Read the source →