EU AI Act compliance, on the 2027–2028 timeline
The 2026 Digital Omnibus moved the high-risk deadlines: Annex III to 2 December 2027, Annex I to 2 August 2028.
The EU AI Act (Regulation (EU) 2024/1689) regulates AI by risk tier: prohibited, high-risk, limited-risk and minimal-risk. Prohibitions have applied since February 2025 and general-purpose AI duties since August 2025. After the 2026 Digital Omnibus, stand-alone high-risk systems must comply by 2 December 2027 and product-embedded ones by 2 August 2028.
TL;DR
- The Digital Omnibus on AI, Regulation (EU) 2026/1744, amended the Act from 27 July 2026.
- High-risk duties apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Transparency duties apply from August 2026.
- Fines reach €35 million or 7% of worldwide annual turnover for prohibited practices.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
Sources: European Commission, AI Omnibus enters into forceEuropean Commission, AI ActEuropean Parliament, AI Act: deal on simplification measures (7 May 2026)EUR-Lex, Regulation (EU) 2024/1689EUR-Lex, Regulation (EU) 2026/1744
What does the EU AI Act require?
The requirements below define the EU AI Act. ComplyEasyAI maps your environment to each one.
Risk classification
Determine the risk tier of each AI system you build or deploy, and your role for it.
Prohibited practices
Avoid the uses banned outright under the Act.
High-risk obligations
Risk management, data governance, documentation, logging, human oversight and robustness, due 2 December 2027 (Annex III) or 2 August 2028 (Annex I).
Technical documentation
Maintain the documentation required to demonstrate conformity.
Transparency & monitoring
Inform people where required, label synthetic content and monitor systems after deployment.
General-purpose AI models
Technical documentation, a copyright policy and a training-content summary for GPAI providers, plus extra duties for systemic-risk models.
When do EU AI Act obligations apply?
- The AI Act enters into force.
- Prohibited AI practices and AI-literacy obligations apply.
- Governance rules and obligations for general-purpose AI models apply.
- The Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force.
- Transparency rules (Article 50) apply, such as telling people they are interacting with AI.
- Ban on AI systems that generate non-consensual intimate content or child sexual abuse material; delayed deadline for watermarking AI-generated content.
- High-risk rules apply to Annex III uses such as biometrics, critical infrastructure, education, employment and law enforcement.
- High-risk rules apply to AI in products covered by Annex I, such as machinery, toys and lifts.
How do you prepare for the EU AI Act?
Scope
Define the systems, boundaries and requirements your program will cover.
Connect your stack
Link cloud, identity, code and ticketing systems, read-only for evidence collection; controls are discovered and mapped.
Collect evidence
AI agents gather configuration and activity evidence on a schedule, building a versioned trail.
Monitor & remediate
Continuous monitoring flags drift the moment it happens and routes it to an owner.
Track effectiveness
Operating effectiveness is recorded over time, ready for your observation window.
Report & hand off
Organized, current evidence is packaged for auditors and stakeholders.
How does ComplyEasyAI automate EU AI Act compliance?
Control mapping
Your environment is mapped to each requirement, so you see exactly which control satisfies what.
Automated evidence
Integrations build a versioned, timestamped evidence trail instead of manual screenshots.
Continuous monitoring
Drift surfaces as soon as it happens, not during fieldwork.
Readiness dashboards
Real-time views highlight failing or unmapped controls with owners attached.
Multi-framework reuse
Shared controls are mapped once and reused across every framework you run.
Audit-ready reporting
Export organized, current evidence packages on demand.
Which frameworks are related to the EU AI Act?
EU AI Act FAQ
Who does the EU AI Act apply to?
Providers, deployers, importers and distributors of AI systems placed on the EU market or whose output is used in the EU, including companies established outside the EU.
How are AI systems classified?
By risk tier: unacceptable (banned), high (strict obligations), limited (transparency duties) and minimal (no specific obligations).
When do the obligations apply?
In stages: prohibitions from 2 February 2025, general-purpose AI duties from 2 August 2025, transparency rules from 2 August 2026, stand-alone high-risk systems from 2 December 2027, and high-risk AI in regulated products from 2 August 2028.
What did the 2026 Digital Omnibus change?
Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the high-risk deadlines and banned AI systems that generate non-consensual intimate content or child sexual abuse material. It also extended simplifications to small mid-cap companies, simplified the AI-literacy duty, created an EU-level regulatory sandbox and widened the AI Office’s enforcement powers.
How do you help?
The platform structures risk classification, technical documentation and post-market monitoring in one place, and maps AI Act controls alongside ISO 42001.
Start your EU AI Act program.
Map the requirements, automate the evidence, stay audit-ready.