EU AI Act timeline after the Digital Omnibus (Regulation (EU) 2026/1744)

What applies today?

The Digital Omnibus did not pause the AI Act. Four layers already apply to anyone who places AI systems on the EU market or whose AI output is used in the EU:

• Prohibited practices (since 2 February 2025). Article 5 bans uses such as social scoring, manipulative techniques that cause significant harm, untargeted scraping of facial images and emotion recognition in workplaces and schools, with narrow exceptions.
• AI literacy (since 2 February 2025). The Omnibus rewrote Article 4: providers and deployers must take measures to support the AI literacy of the people who operate their systems, but they are not required to guarantee a specific level for each person.
• General-purpose AI models (since 2 August 2025). Providers of general-purpose AI (GPAI) models keep technical documentation, publish a copyright policy and a summary of the content used for training. Models with systemic risk also need evaluations, serious-incident reporting and cybersecurity protection. Models placed on the market before 2 August 2025 have until 2 August 2027.
• Transparency (since 2 August 2026). Article 50 applies from the Act's general application date. People must be told when they are interacting with an AI system, generative systems must mark synthetic audio, image, video and text in a machine-readable way, and deployers must disclose deepfakes and AI-generated text published to inform the public.

The governance structure (the AI Office and national authorities) and the penalty rules have applied since 2 August 2025. For the full list of requirements behind these dates, see our EU AI Act guide.

What changes on 2 December 2026?

Two things, both introduced by the Omnibus.

New prohibited practices. Article 5 gains two bans:

• AI systems that generate or manipulate realistic images, video or audio of an identifiable person's intimate parts, or of that person engaged in sexually explicit activity, without their explicit consent.
• AI systems that generate or manipulate child sexual abuse material.

Placing such a system on the market is prohibited where that output is its intended purpose, or where it is a reasonably foreseeable and reproducible outcome and the system lacks adequate safeguards to prevent it. Using one is prohibited when the deployer uses it for that purpose.

The marking deadline for systems already on the market. Providers of generative systems placed on the market before 2 August 2026 must meet the Article 50(2) marking duty by 2 December 2026. New systems have had to comply since 2 August 2026.

When do high-risk rules apply?

The Omnibus replaced the original dates for the high-risk obligations in Chapter III, Sections 1 to 3, with fixed calendar dates:

• 2 December 2027 for stand-alone high-risk systems listed in Annex III, such as biometrics, critical infrastructure, education, employment, access to essential services including credit scoring, law enforcement, migration and the administration of justice. The original date was 2 August 2026.
• 2 August 2028 for AI that is a safety component of a product covered by the EU harmonisation legislation in Annex I, such as toys, lifts, radio equipment and medical devices. The original date was 2 August 2027.

The requirements themselves are largely unchanged: risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy and robustness, a quality management system and conformity assessment. For Annex I products, the Commission may use delegated acts, due by 2 August 2027, to limit specific requirements where the sectoral law already gives equivalent protection.

Systems already on the market before these dates are caught only if their design changes significantly afterwards, and the grace period covers further units of the same type and model. High-risk systems intended for public authorities must comply by 2 August 2030 regardless.

What else did the Omnibus change?

• Small mid-cap enterprises (SMCs). Several SME measures now extend to SMCs, including a simplified technical documentation form and, for breaches other than prohibited practices, fines capped at the lower of the fixed amount or the turnover percentage.
• Registration. Systems that a provider concludes are not high-risk under Article 6(3) still go in the EU database, but with less information.
• Bias detection. A new Article 4a lets providers process special categories of personal data where strictly necessary to detect and correct bias, under strict safeguards.
• Supervision. The AI Office becomes exclusively competent for AI systems built on a general-purpose AI model by the same provider, and for AI in very large online platforms and search engines.
• Sandboxes. Each Member State must have a national AI regulatory sandbox running by 2 August 2027, and the AI Office may run one at EU level.

What should you do this quarter?

1. Refresh your AI inventory. Record every AI system you build, buy or embed, and your role for each: provider, deployer, importer or distributor.
2. Close the transparency gaps. Check chatbot disclosures and machine-readable marking now; for generative systems launched before 2 August 2026, the deadline is 2 December 2026.
3. Screen for the new prohibitions. If a product generates images, video or audio of people, document the safeguards that prevent intimate or abusive content and how you correct reported misuse.
4. Re-plan high-risk work, do not pause it. The extra time is for building risk management, documentation and oversight properly. Our EU AI Act compliance checklist walks through each obligation.
5. Collect upstream documentation. If you build on a third-party general-purpose model, keep the provider's documentation in your own technical file.
6. Reuse what you already run. An AI management system under ISO/IEC 42001 and existing security controls cover much of the process work; control mapping avoids doing it twice.

For a plain-language definition of the Act, see the EU AI Act glossary entry; for the wider picture, read what AI compliance involves.