What Changes Under the EU AI Act in 2026 and 2027? The Dates That Matter
Disclosure: this page contains Amazon affiliate links. As an Amazon Associate we earn from qualifying purchases, at no extra cost to you.
Calendar out, deadline tracker — the EU AI Act just got its first big rewrite, some dates slid by more than a year and one brand-new ban lands in a couple of weeks, so I’ve lined up every date straight from the law’s own text and turned it into one table you can actually use! The biggest EU AI Act change of 2026 is a delay: the strict “high-risk” rules that were due on 2 August 2026 now start on 2 December 2027, while the labelling rules for chatbots and deepfakes did start in August 2026 and a new ban on “nudifier” apps arrives on 2 December 2026. If you like to read the law with a coffee and a highlighter, there are books on the EU AI Act on Amazon, but the dates below are the part most people need.
Short answer: Under the EU AI Act, most rules applied from 2 August 2026, including the Article 50 duty to label chatbots and deepfakes. On 2 December 2026 a ban on AI nudifier apps starts and older AI generators must mark their output. High-risk rules now apply from 2 December 2027 and 2 August 2028.
The six facts that sum up the EU AI Act timeline in November 2026:
- 2 August 2026: most of the AI Act applies, including the Article 50 transparency rules (Article 113, Regulation (EU) 2024/1689).
- 27 July 2026: the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force — six days before the original high-risk deadline (European Commission).
- 2 December 2026, 17 days from today: the new ban on AI that makes non-consensual intimate images or child sexual abuse material applies, and AI generators already on sale before August 2026 must mark their output as AI-made (Articles 5 and 111).
- 2 December 2027: high-risk rules for uses such as hiring, schools, credit scoring and biometrics apply — 16 months later than first planned (Article 113).
- 2 August 2028: high-risk rules for AI inside regulated products, such as toys, lifts and medical devices, apply — 12 months later than first planned (Article 113).
- Up to €35 million or 7% of worldwide annual turnover, whichever is higher, is the top fine for a banned AI practice (Article 99).
What is the EU AI Act, and when did it start?
The EU AI Act is the European Union’s law on artificial intelligence, Regulation (EU) 2024/1689, signed on 13 June 2024 and in force since 1 August 2024. The EU AI Act sorts AI by risk: a short list of banned uses, strict rules for “high-risk” uses, labelling duties for chatbots and AI-made content, and separate rules for the makers of general-purpose AI models such as the large language models behind chatbots.
The AI Act was published in the Official Journal of the European Union on 12 July 2024 (EUR-Lex record of Regulation (EU) 2024/1689). The law didn’t switch on all at once. Its Article 113 sets a ladder of dates, and the European Commission’s AI Act policy page (updated October 19, 2026) sums it up: the AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions
. Those exceptions are the dates that matter, and the Digital Omnibus on AI moved several of them in July 2026.
Who enforces the EU AI Act? The Commission’s AI Office oversees general-purpose AI models, and each EU country’s market surveillance authorities oversee AI systems on their territory. The Commission’s page says that from 2 August 2026, the AI Office and authorities of the Member States are responsible
for implementing, supervising and enforcing the Act.
Which EU AI Act dates matter in 2026, 2027 and 2028?
The EU AI Act dates that matter now are 2 December 2026 (the nudifier ban and AI-output marking for older tools), 2 August 2027 (AI sandboxes and older general-purpose AI models), 2 December 2027 (high-risk uses) and 2 August 2028 (high-risk AI in products). Everything else, from the bans of February 2025 to the labelling rules of August 2026, already applies.
| Date | What applies | Who it mostly affects | Status on Nov 15, 2026 |
|---|---|---|---|
| The AI Act enters into force | Everyone (nothing to do yet) | Done | |
| Banned AI practices (Article 5) and AI literacy (Article 4) | Every company that makes or uses AI | Applies | |
| Rules for general-purpose AI models (Chapter V), governance, national penalty rules | Makers of large AI models | Applies | |
| Digital Omnibus on AI enters into force (the delays below, the new ban, the reworded AI literacy duty) | Everyone | Done | |
| General date of application: Article 50 transparency, complaints to authorities, enforcement, fines for general-purpose AI model makers (Article 101) | Chatbot and AI-content makers, deployers who publish deepfakes | Applies | |
| New ban on AI that makes non-consensual intimate images or child sexual abuse material; Article 50(2) marking for AI generators on sale before 2 Aug 2026 | AI image, video and audio tool makers | 17 days to go | |
| At least one AI regulatory sandbox in every EU country; general-purpose AI models on sale before 2 Aug 2025 must comply | Start-ups; older large models | 260 days to go | |
| High-risk rules for Annex III uses: biometrics, critical infrastructure, education, employment, essential services and credit, law enforcement, migration and borders, justice | Companies selling or using AI in those areas | 382 days to go | |
| High-risk rules for AI that is a safety component of products under EU product law (Annex I), such as toys, lifts and medical devices | Product manufacturers | 626 days to go | |
| High-risk AI systems used by public authorities must comply, even if unchanged | Public bodies and their suppliers | 1,356 days to go | |
| AI in the EU’s large-scale IT systems (Annex X) on the market before 2 Aug 2027 must comply | EU agencies | 1,507 days to go |
The timeline as text — already applies: 1 August 2024, the AI Act enters into force; 2 February 2025, banned AI practices and AI literacy; 2 August 2025, rules for general-purpose AI models, governance and penalties; 27 July 2026, the Digital Omnibus on AI in force; 2 August 2026, most rules apply, including Article 50 labelling, enforcement and fines for general-purpose AI model makers. Coming next, with days to go from November 15, 2026: 2 December 2026, the nudifier and child-abuse-material ban and marking for older AI generators (17 days); 2 August 2027, an AI sandbox in every EU country and older general-purpose AI models must comply (260 days); 2 December 2027, high-risk uses in Annex III such as hiring, schools, credit, biometrics and borders (382 days); 2 August 2028, high-risk AI inside Annex I products such as toys, lifts, medical devices and machinery (626 days); 2 August 2030, high-risk AI used by public authorities (1,356 days).
What did the Digital Omnibus change in the EU AI Act?
The Digital Omnibus on AI pushed the EU AI Act’s high-risk rules back by 16 months (Annex III uses) and 12 months (AI in products), moved the national sandbox deadline back a year, gave AI generators already on the market until 2 December 2026 to mark their output, and added a new ban on AI nudifier apps. The Article 50 labelling rules kept their 2 August 2026 date.
| Obligation | Original date | New date | Change |
|---|---|---|---|
| High-risk uses (Annex III) | +16 months | ||
| High-risk AI in products (Annex I) | +12 months | ||
| At least one AI sandbox per EU country | +12 months | ||
| Marking AI output, for generators on sale before 2 Aug 2026 (Article 50(2)) | +4 months (the Commission had proposed 2 Feb 2027) | ||
| Ban on AI nudifier apps and AI child sexual abuse material | (not in the original Act) | New | |
| Article 50 transparency for chatbots, deepfakes and new AI generators | Unchanged |
The chart as text — high-risk uses (Annex III): 2 August 2026 to 2 December 2027, +16 months; high-risk AI in products (Annex I): 2 August 2027 to 2 August 2028, +12 months; national AI sandboxes: 2 August 2026 to 2 August 2027, +12 months; marking AI output for older tools (Article 50(2)): 2 August 2026 to 2 December 2026, +4 months, where the Commission had proposed 2 February 2027; new ban on nudifier apps and child sexual abuse material: from 2 December 2026; unchanged: Article 50 transparency rules from 2 August 2026.
Why the delay? The Commission’s May 7, 2026 news item says the phased timing is there so that technical standards and other support tools are in place before the rules start to apply
. The Omnibus also narrows what counts as a “safety component”: according to the European Parliament’s May 7, 2026 press release, AI functions that only assist users or optimise performance won’t automatically count as high-risk if their failure creates no health or safety risk, and machinery makers follow the sector’s own safety rules instead of both laws. Arba Kokalari (EPP, Sweden), one of Parliament’s two lead negotiators, said:
With this agreement, we show that politics can move just as quickly as technology.
When was the AI Act delay approved?
The EU AI Act delay was approved in about eight months: the European Commission proposed the Digital Omnibus on AI on 19 November 2025, Parliament and the Council struck a deal on 7 May 2026, and the final law, Regulation (EU) 2026/1744, entered into force on 27 July 2026.
- : the Commission proposes the Digital Omnibus on AI, COM(2025) 836.
- : provisional political agreement between the European Parliament and the Council (Parliament press release; Commission news item).
- : Parliament adopts the text in plenary.
- : the Council gives its final green light.
- : the regulation is signed; it is published in the Official Journal on 24 July 2026 (EUR-Lex record of Regulation (EU) 2026/1744).
- : the Omnibus enters into force, six days before the original 2 August 2026 high-risk date (Commission AI Act page).
By our count, that’s 250 days from proposal to law — quick for EU lawmaking, and the reason the original high-risk deadline never actually arrived. The wider Digital Omnibus on other EU digital laws is a separate proposal and isn’t covered here.
What are the EU AI Act’s labelling (transparency) rules?
The EU AI Act’s labelling rules, in Article 50, have applied since 2 August 2026: chatbots must tell people they’re talking to an AI, AI generators must mark their output in a machine-readable way, and anyone publishing a deepfake, or AI-written text meant to inform the public without human editorial review, must disclose that it’s AI-made.
- Chatbots and other AI that talks to people (Article 50(1))
- Providers must make sure
the natural persons concerned are informed that they are interacting with an AI system
, unless that’s obvious. - AI-generated images, audio, video and text (Article 50(2))
- Providers must make sure outputs are
marked in a machine-readable format and detectable as artificially generated or manipulated
. Tools on sale before 2 August 2026 have until 2 December 2026 (Article 111(4)). - Emotion recognition and biometric categorisation (Article 50(3))
- Deployers must tell the people exposed to the system that it’s operating.
- Deepfakes and AI-written public-interest text (Article 50(4))
- Deployers must disclose that the content
has been artificially generated or manipulated
; the text duty doesn’t apply where a person holds editorial responsibility and the text had human review.
Two Commission tools help companies meet Article 50. The Code of Practice on Transparency of AI-generated Content, published in final form on 10 June 2026, has a section for providers (marking and detecting AI content) and one for deployers (labelling deepfakes and AI text), plus a set of EU icons deployers may use as labels; the Commission says about 190 companies and organisations had signed it by the end of July 2026, and that it and the AI Board confirmed the code is an adequate voluntary tool
. The Commission also published guidelines on the Article 50 transparency obligations on 20 July 2026. Breaking the Article 50 rules can cost a company up to €15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)).
Do creators have to label AI images and videos under the EU AI Act?
Creators who publish AI deepfakes as part of their work must disclose them under Article 50(4), but for clearly artistic, creative, satirical or fictional work the disclosure can be light-touch, done in a way that doesn’t spoil the work. Private people using AI for purely personal, non-professional fun are outside the deployer duties altogether (Article 2(10)).
Say you run a small illustration shop, and a client’s ad uses an AI-made video of a “real” street scene: that’s a deepfake under the EU AI Act, so the ad should say it’s AI-generated. A clearly fantastical AI painting in your portfolio needs much less, because Article 50(4) limits the duty for evidently artistic work to disclosing that AI content exists, in an appropriate manner that does not hamper the display or enjoyment of the work
. The machine-readable watermark is mostly the tool maker’s job, not yours: Article 50(2) puts it on providers. If your AI tool adds a visible “AI-generated” tag or content credentials, leave them on.
What is banned under the EU AI Act?
The EU AI Act has banned eight kinds of AI practice since 2 February 2025, from manipulative techniques and social scoring to emotion recognition at work and in schools, and from 2 December 2026 it also bans AI systems that generate non-consensual intimate images of identifiable people or child sexual abuse material. Breaking a ban can cost up to €35 million or 7% of worldwide turnover.
Can I tell you my favourite detail? Lawmakers took a law famous for being slow and huge, and passed its fix in 250 days, beating their own deadline by six days. One negotiator said politics can move as quickly as technology — I’m not sure I’d go that far, but six days to spare is still a photo finish worth cheering.
The Article 5 list, in plain words:
- Subliminal, manipulative or deceptive techniques that materially distort people’s behaviour and cause significant harm.
- Exploiting people’s vulnerabilities due to age, disability or social or economic situation.
- Social scoring that leads to unfair or disproportionate treatment.
- Predicting that a person will commit a crime based only on profiling or personality traits.
- Untargeted scraping of facial images from the internet or CCTV to build face recognition databases.
- Inferring people’s emotions at work or in schools (except for medical or safety reasons).
- Biometric categorisation to infer sensitive traits such as race, political opinions or sexual orientation.
- Real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
- New from 2 December 2026: AI systems that generate or manipulate realistic images, video or audio of an identifiable person’s intimate parts or of that person in sexually explicit activity
without that person’s freely-given, specific, informed, unambiguous and explicit consent
, and AI systems that generate child sexual abuse material.
The new ban hits a tool maker when making that material is the tool’s intended purpose, or when the tool can foreseeably and reproducibly do it without reasonable and adequate technical safety measures
to prevent it (new Article 5(1a)). It hits a user who deploys a tool for that purpose. Parliament’s press release says the ban covers images, video and audio, and that companies have until 2 December 2026 to bring their systems in line.
What does the EU AI Act mean for a small business?
For most small businesses using everyday AI tools, the EU AI Act means three things today: help your staff understand the AI they use (Article 4), tell customers when they’re chatting with an AI if you built the chatbot (Article 50), and label any deepfakes you publish. The heavy high-risk paperwork only matters if you sell or use AI in an Annex III area such as hiring or credit, and not before 2 December 2027.
Small and medium-sized enterprises (SMEs) and, since the Omnibus, small mid-cap enterprises (SMCs) get lighter treatment. Under the amended Article 11, SMEs, including start-ups, and SMCs, may provide the elements of the technical documentation specified in Annex IV in a simplified manner
. Under Article 99(6) and the new 99(6a), their fines are capped at the lower of the fixed amount and the percentage, not the higher. And every EU country must have at least one AI regulatory sandbox running by 2 August 2027, where a business can test an AI system with the regulator’s guidance.
A quick self-check for a small business, in our own words: Do you use AI to screen job applicants, score credit or insurance, grade students or identify people by their face? Then you’re in high-risk territory and 2 December 2027 is your date. Did you build a chatbot or an AI generator that the public uses? Then Article 50 already applies to you. Do you only use ChatGPT, Gemini, Copilot or Claude for writing, summaries and ideas? Then AI literacy and honest labelling of anything deepfake-like are the main jobs.
What is the EU AI Act’s AI literacy rule?
The AI literacy rule in Article 4 has applied since 2 February 2025, and the Digital Omnibus softened its wording: companies that make or use AI must now take measures to support the development of AI literacy
of their staff, and the rule does not require providers or deployers to guarantee any specific level of AI literacy of any individual
.
In practice that can be short training on the AI tools your team uses, what they’re good and bad at, and what not to paste into them — tuned to people’s existing knowledge and to how the AI is used. The amended Article 4 also tells the Commission and EU countries to support businesses in doing it, with SMEs named.
Does the EU AI Act apply to companies outside Europe?
Yes, the EU AI Act applies to companies outside Europe when they place AI systems or general-purpose AI models on the EU market, or when their AI system’s output is used in the EU (Article 2(1)). A U.S. app with European users, for example, is covered for those users.
What does the EU AI Act mean for everyday AI users?
For everyday users in the EU, the AI Act means you should be told when you’re talking to a chatbot, AI-generated images, audio and video should carry hidden machine-readable marks (all tools by 2 December 2026), published deepfakes should be labelled, and nudifier apps are banned from 2 December 2026. Since 2 August 2026 you can also complain to your country’s market surveillance authority if you think a company broke the AI Act (Article 85).
The AI Act doesn’t make you, as a private person, label the AI pictures you make for fun (Article 2(10)). It also doesn’t decide whether an AI company may train on your work — that’s copyright law, which the Act leaves in place, though the General-Purpose AI Code of Practice (published 10 July 2025, with chapters on transparency, copyright, and safety and security) asks the big model makers to respect copyright opt-outs. And the AI Act’s labels won’t catch every fake: scammers ignore the law, so the old habits from our guide to AI voice-clone scam calls — a safe word and a call back — still matter, and the two-minute check for AI news summaries works on AI-made headlines too.
What are the key numbers in the EU AI Act?
The key numbers in the EU AI Act, gathered from the Regulation’s text and the European Commission’s pages:
| Finding | Number | Source |
|---|---|---|
| Top fine for a banned AI practice | €35 million or 7% of worldwide turnover, whichever is higher | Article 99(3) |
| Top fine for most other breaches, including Article 50 | €15 million or 3% | Article 99(4) |
| Top fine for wrong or misleading information to authorities | €7.5 million or 1% | Article 99(5) |
| Banned practices on the Article 5 list | 8 since Feb 2025, plus the new nudifier and abuse-material ban from Dec 2026 | Article 5 |
| Delay to high-risk uses (Annex III) | 16 months (to 2 Dec 2027) | Article 113; our count |
| Delay to high-risk AI in products (Annex I) | 12 months (to 2 Aug 2028) | Article 113; our count |
| Extra time to mark AI output, older tools | 4 months (to 2 Dec 2026) | Article 111(4); our count |
| Days from Omnibus proposal to entry into force | 250 (19 Nov 2025 to 27 Jul 2026) | Commission; our count |
| Signatories of the transparency Code of Practice | About 190, by end of July 2026 | European Commission |
| Days to the next deadline (2 Dec 2026) | 17, from 15 Nov 2026 | Our count |
The short version: the EU AI Act is already live for bans, AI literacy, big AI models and labelling. What got pushed back is the high-risk rulebook. Put 2 December 2026, 2 December 2027 and 2 August 2028 in your calendar, and re-check the Commission’s Service Desk before each one.
So here’s your to-do list, deadline tracker: circle 2 December 2026, 2 December 2027 and 2 August 2028, give your team a little AI literacy time, label the deepfakes, and check the Commission’s Service Desk before each date. Three dates and a highlighter — that’s the whole AI Act survival kit.
Sources and further reading
- Regulation (EU) 2024/1689 — the Artificial Intelligence Act (EUR-Lex) — of 13 June 2024; OJ 12 July 2024; in force 1 August 2024
- Regulation (EU) 2026/1744 — Digital Omnibus on AI (EUR-Lex) — of 8 July 2026; OJ 24 July 2026; in force 27 July 2026
- Timeline for the implementation of the EU AI Act (European Commission, AI Act Service Desk) — takes the Digital Omnibus into account; read Nov 15, 2026
- AI Act Article 113 — Entry into force and application (AI Act Service Desk) — as amended: 2 Dec 2026, 2 Dec 2027, 2 Aug 2028
- AI Act Article 111 — AI systems already placed on the market (AI Act Service Desk) — new paragraph 4: Article 50(2) by 2 Dec 2026; public authorities 2 Aug 2030; older GPAI models 2 Aug 2027
- AI Act Article 5 — Prohibited AI practices (AI Act Service Desk) — new points (ba) and (bb), paragraphs 1a and 1b
- AI Act Article 50 — Transparency obligations (AI Act Service Desk) — chatbots, machine-readable marking, deepfakes, AI-written public-interest text
- AI Act Article 4 — AI literacy (AI Act Service Desk) — amended by the Omnibus: "take measures to support"
- AI Act Article 11 — Technical documentation (AI Act Service Desk) — simplified documentation for SMEs, start-ups and SMCs
- AI Act Article 99 — Penalties (AI Act Service Desk) — €35M/7%, €15M/3%, €7.5M/1%; lower-of cap for SMEs (6) and SMCs (6a)
- AI Act Article 2 — Scope (AI Act Service Desk) — providers outside the EU; personal non-professional use, paragraph 10
- AI Act (European Commission, Shaping Europe’s digital future) — updated Oct 19, 2026; political agreement 7 May 2026, Omnibus in force 27 July 2026
- EU agrees to simplify AI rules to boost innovation and ban "nudification" apps to protect citizens (European Commission) — May 7, 2026
- AI Act: deal on simplification measures, ban on "nudifier" apps (European Parliament press release) — May 7, 2026; Arba Kokalari and Michael McNamara; watermarking to 2 Dec 2026 vs proposed 2 Feb 2027
- Artificial Intelligence: Council gives final green light to simplify and streamline rules (Council of the EU) — June 29, 2026; page refused our fetch, title and date as listed by the Council
- Code of Practice on Transparency of AI-generated Content (European Commission) — final code 10 June 2026; about 190 signatories by end of July 2026; adequate voluntary tool
- Commission publishes guidelines on transparency obligations for providers and deployers of certain AI systems (European Commission) — July 20, 2026
- The General-Purpose AI Code of Practice (European Commission) — published July 10, 2025; transparency, copyright, safety and security
Questions and answers
When does the EU AI Act come into effect?
The EU AI Act entered into force on 1 August 2024 and applies in stages: bans and AI literacy from 2 February 2025, general-purpose AI model rules from 2 August 2025, and most other rules from 2 August 2026. After the Digital Omnibus, high-risk rules apply from 2 December 2027 and 2 August 2028.
Has the EU AI Act been delayed?
Partly. The Digital Omnibus on AI, in force since 27 July 2026, delayed the high-risk rules from 2 August 2026 to 2 December 2027, and for AI in regulated products from 2 August 2027 to 2 August 2028. The bans, AI literacy and Article 50 labelling rules were not delayed.
What happens on 2 December 2026 under the EU AI Act?
On 2 December 2026 the ban on AI systems that generate non-consensual intimate images or child sexual abuse material starts to apply, and AI generators that were on sale before 2 August 2026 must mark their output in a machine-readable way under Article 50(2).
Does the EU AI Act require labeling AI-generated content?
Yes. Under Article 50, providers must mark AI-generated images, audio, video and text in a machine-readable way, and deployers who publish deepfakes, or AI-written text meant to inform the public without human editorial review, must disclose it. Purely personal, non-professional use is exempt.
What are the fines under the EU AI Act?
Fines go up to €35 million or 7% of worldwide annual turnover for banned AI practices, €15 million or 3% for most other breaches including the transparency rules, and €7.5 million or 1% for misleading information to authorities. For SMEs and small mid-caps, the lower of the two amounts applies.