One dated view of every AI Act milestone as the Digital Omnibus left it, with the obligations that sit alongside them. Each entry records the obligation, who it binds, the governing article, and whether it is in force or still to come. Sourced from primary texts.
The legislative path of the deferral, from proposal to entry into force.
| Date | Event |
|---|---|
| 19 November 2025 | The Commission published the Digital Omnibus on AI as COM(2025) 836, proposing to postpone the high-risk compliance deadlines. |
| 7 May 2026 | The Council and Parliament reached political agreement, with fixed dates in place of the Commission's earlier conditional stop-the-clock trigger. |
| 29 June 2026 | The Council gave final approval. |
| 24 July 2026 | Published in the Official Journal as Regulation (EU) 2026/1744. |
| 27 July 2026 | Entered into force, six days before the original high-risk date of 2 August 2026. |
Filter by status, or jump to a date.
In force
Regulation (EU) 2024/1689 entered into force and started the staged application calendar. Nothing became binding on operators that day; the obligations switch on at the milestones below.
In force
The first hard obligations took effect. The Article 5 ban on prohibited AI practices applies, among them untargeted facial image scraping, certain social scoring, manipulative or exploitative systems, and most real-time remote biometric identification in public spaces. Separately, the Article 4 AI literacy duty requires providers and deployers to build AI literacy among staff and others operating AI on their behalf.
Both remain in force. The Omnibus amended Article 4: AI literacy remains an obligation on providers and deployers, but no specific or sufficient level is mandated. For a deployer of a high-risk system, the duty to train staff so that human oversight is real remains in place.
In force
Three things switched on. The general purpose AI (GPAI) model obligations under Chapter V apply: technical documentation, training data summaries, a copyright policy and, for models with systemic risk, model evaluation and serious incident reporting. The governance architecture became operational, with the European AI Office coordinating GPAI and systemic risk supervision alongside the AI Board, the scientific panel and the advisory forum, and Member States were due to designate their national competent authorities. The Article 99 penalties framework applies, requiring Member States to lay down penalty rules.
Penalty exposure. Article 99 caps: up to EUR 35 million or 7% of worldwide annual turnover for Article 5 breaches; up to EUR 15 million or 3% for most other breaches; up to EUR 7.5 million or 1% for incorrect or misleading information. Enforcement against GPAI providers has applied since 2 August 2026.
In force, as guidance
EIOPA published its Opinion on artificial intelligence governance and risk management, addressed to national insurance supervisors. It creates no new rules. It reads AI into existing sector law, chiefly Solvency II and the Insurance Distribution Directive, on a risk based and proportionate basis, covering data governance, fairness, explainability and human oversight across pricing, underwriting, claims and fraud detection. It is relevant context for any insurer deploying AI agents.
In force
The Commission proposed the Digital Omnibus on AI on 19 November 2025 as COM(2025) 836. The Council and Parliament reached political agreement on 7 May 2026, the Council gave final approval on 29 June 2026, and the act was published as Regulation (EU) 2026/1744 and entered into force on 27 July 2026. The adopted text replaced the Commission's earlier conditional stop-the-clock trigger, which would have tied the deadline to harmonised standards, with fixed dates.
High-risk Annex III standalone systems moved from 2 August 2026 to 2 December 2027. High-risk Annex I product-embedded systems moved from 2 August 2027 to 2 August 2028. The Omnibus also added a prohibition on AI systems that generate child sexual abuse material or depict an identifiable person's intimate parts without consent, shortened the Article 50(2) marking transition so that it ends on 2 December 2026, moved the deadline for national AI regulatory sandboxes to 2 August 2027, simplified registration of exempted systems, extended AI Office oversight to certain systems built on general purpose models within very large online platforms and search engines, and amended Article 4.
In force
Article 50 transparency, not deferred. Disclosure that a person is interacting with an AI system, labelling of AI generated or manipulated content including deepfakes, and notice for emotion recognition and biometric categorisation systems. Enforcement also began for the GPAI obligations, the prohibitions, transparency and AI literacy, through national market surveillance authorities.
High-risk standalone systems, moved. This was the original date for the Annex III high-risk regime. Under the Omnibus it now applies from 2 December 2027.
Applies next
For AI systems placed on the market before 2 August 2026, the Article 50(2) duty to mark AI generated content in a machine-readable way applies from this date. Content generated before 2 August 2026 needs no retroactive labelling. The prohibitions added by the Omnibus, on systems that generate child sexual abuse material or non-consensual intimate depictions, take effect for systems already on the market.
Applies next
Directive (EU) 2024/2853, the revised Product Liability Directive, applies to products placed on the market or put into service after 9 December 2026, and Member States must have transposed it by the same date. It expressly treats software and AI systems as products, introduces rebuttable presumptions of defectiveness that ease a claimant's burden of proof where a system is complex or opaque, and expands compensable damage to include data loss and medically recognised psychological harm. The old Directive 85/374/EEC continues to apply to products placed on the market before this date. Free and open source software supplied outside a commercial activity is excluded.
Applies later
Each Member State must have at least one AI regulatory sandbox in operation, the deadline the Omnibus set. This was also the original date for high-risk AI in Annex I products, which the Omnibus moved to 2 August 2028.
Applies later
The full obligations for Annex III high-risk systems apply: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, conformity assessment and registration, with the deployer duties in Article 26 and the fundamental rights impact assessment in Article 27. The original date was 2 August 2026.
Applies later
The high-risk obligations apply to AI systems that are safety components of, or are themselves, products already regulated under the Union harmonisation legislation in Annex I, for example medical devices, machinery, lifts, radio equipment and motor vehicles. These systems have longer because their conformity assessment runs through existing sector product law. The original date was 2 August 2027.
Applies later
High-risk AI components of the large-scale EU information systems listed in Annex X, for example systems in the area of freedom, security and justice, that were placed on the market or put into service before 2 August 2027 must be brought into compliance by 31 December 2030. This long-stop date in the Regulation is unaffected by the Omnibus.
Every date is checked against primary texts, among them the Official Journal, the consolidated Regulation and supervisory publications, before it is stated. Where a date was contested, the binding date and the proposed change were both shown with their status, and a proposal was never presented as settled.
The timeline is revised on legislative events and confirmed corrections; the revision date at the top reflects the latest. No government, regulator, law firm or operator pays for placement. Corrections can be sent through the contact page and are checked against primary sources before they are adopted.
The global regulatory tracker across 17 jurisdictions The US, EU and UK compared