EU AI Act Explained: Every Deadline After the Digital Omnibus, Who It Applies To, and the Fines

The EU AI Act is no longer a future problem. It has been law since August 2024, most of it has applied since August 2, 2026, and the next hard deadline lands on December 2, 2026. But the timeline most people remember is out of date. In July, the EU passed an amending law, the Digital Omnibus on AI, that moved the biggest compliance date by 16 months and added a new ban.

This explainer covers what the AI Act does, who it applies to (including companies outside Europe), every deadline as amended, and what the EU's first enforcement steps against frontier labs tell us. It is a general explainer as of October 2026, not legal advice.

The short version

• The AI Act is Regulation (EU) 2024/1689. It entered into force on August 1, 2024.
• It sorts AI by risk: banned practices, high-risk uses, transparency duties, and minimal risk (no new rules).
• It reaches non-EU companies if they sell AI in the EU or if their AI's output is used in the EU.
• The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on July 27, 2026. It pushed high-risk rules to December 2, 2027 (stand-alone uses) and August 2, 2028 (AI inside regulated products).
• A new ban on AI "nudification" tools and AI-generated child sexual abuse material applies from December 2, 2026.
• Rules for general-purpose AI models, such as the big frontier LLMs, have applied since August 2, 2025. The Commission's AI Office has been able to enforce them since August 2, 2026, and it has started sending formal information requests.

Who the AI Act applies to

The AI Act does not only cover European companies. Article 2 lists who is in scope. The main groups:

• Providers that place AI systems or general-purpose AI models on the EU market, "irrespective of whether those providers are established or located within the Union or in a third country." A US lab that offers a model to EU customers is a provider.
• Deployers (organizations that use an AI system in a professional capacity) that are established or located in the EU.
• Providers and deployers outside the EU whose AI system's output is used in the EU.
• Importers, distributors, product manufacturers that ship AI inside their products, and authorized representatives of non-EU providers.

There are notable carve-outs in the same article:

• AI used exclusively for military, defence, or national security purposes.
• Research, testing, and development before a system or model is placed on the market. Testing in real-world conditions is not covered by that exemption.
• People using AI for purely personal, non-professional activity.
• AI released under free and open-source licenses, unless it is a high-risk system, a banned practice, or falls under the transparency rules. Open-source general-purpose models still have some duties.

The provider and deployer split matters most in practice. If you build a hiring tool, you are the provider and carry the heavy obligations. If you buy that tool and use it to screen candidates, you are the deployer, with a smaller but real list of duties.

The four risk levels

The Commission's AI Act page describes four tiers.

1. Unacceptable risk: banned

As amended, the AI Act prohibits nine practices:

1. Harmful AI-based manipulation and deception
2. Harmful AI-based exploitation of vulnerabilities
3. Social scoring
4. Individual criminal offence risk assessment or prediction
5. Untargeted scraping of the internet or CCTV footage to build facial recognition databases
6. Emotion recognition in workplaces and schools
7. Biometric categorization to deduce certain protected characteristics
8. Real-time remote biometric identification for law enforcement in publicly accessible spaces (with narrow exceptions)
9. AI systems that generate non-consensual sexually explicit or intimate content, or child sexual abuse material, such as "nudification" apps

Bans 1 to 8 have applied since February 2, 2025. Ban 9 is new from the Omnibus and applies from December 2, 2026.

2. High risk: strict obligations

High-risk uses include AI in critical infrastructure, education (for example, exam scoring), employment (for example, CV sorting), access to essential services (for example, credit scoring), biometrics, law enforcement, migration and border control, and the administration of justice. AI that is a safety component of a regulated product, such as a medical device or machinery, is also high-risk.

Providers of high-risk systems must have risk management, high-quality training data, activity logging, detailed technical documentation, clear instructions for deployers, human oversight, and appropriate robustness, cybersecurity, and accuracy. These rules now start on December 2, 2027.

3. Transparency risk: disclosure duties

Article 50 covers systems that talk to people or generate content. People must be told when they are interacting with a chatbot, unless that is obvious. Providers of generative AI must make outputs identifiable in a machine-readable way, and deepfakes must be labeled. These duties have applied since August 2, 2026, with one transition period explained below.

4. Minimal risk: no new rules

The Commission says the "vast majority" of AI systems in the EU fall here, such as spam filters and AI in video games. The AI Act adds no obligations for them.

Every deadline, as amended

The Omnibus changed several dates. The full timeline, based on the Commission, the AI Act Service Desk timeline and Article 111:

• August 1, 2024: The AI Act enters into force.
• February 2, 2025: Bans 1 to 8 apply. The original AI literacy duty also started here (the Omnibus later changed it, see below).
• August 2, 2025: Governance rules and obligations for general-purpose AI models apply.
• July 27, 2026: The Digital Omnibus on AI enters into force.
• August 2, 2026: Most of the Act applies, including the transparency duties. The AI Office and national authorities take over enforcement, and the AI Office can enforce against general-purpose model providers.
• December 2, 2026: The nudification and CSAM ban applies. Generative AI systems placed on the market before August 2, 2026 must meet the Article 50(2) machine-readable marking duty.
• August 2, 2027: General-purpose models placed on the market before August 2, 2025 must comply.
• December 2, 2027: High-risk rules apply to stand-alone uses listed in Annex III (hiring, credit, education, biometrics, and the rest). The original date was August 2, 2026.
• August 2, 2028: High-risk rules apply to AI embedded in products covered by EU product law in Annex I (machinery, toys, lifts, medical devices). The original date was August 2, 2027.

What the Digital Omnibus changed

The Commission proposed the Omnibus on November 19, 2025. Parliament and Council negotiators reached a provisional deal on May 7, 2026. Parliament approved it on June 16, 2026 by 423 votes to 57, with 174 abstentions. It was published in the Official Journal on July 24 and entered into force on July 27, before the original August 2 high-risk date could bite.

The changes, per the Commission's summary:

• Later high-risk dates. December 2, 2027 and August 2, 2028, as above. The Commission says the delay gives time for technical standards and support tools to be ready. The first such standard, EN 18286 for quality management systems, was cited in the Official Journal on October 14, 2026.
• New ban. AI systems that generate non-consensual intimate imagery or child sexual abuse material. According to the regulation text, the ban on placing such systems on the market covers tools whose intended purpose is that content, and tools where that output is a "reasonably foreseeable and reproducible outcome" and the system lacks adequate safeguards to prevent it. Deployers are banned from using AI for that purpose.
• AI literacy softened. The original duty on companies to ensure staff AI literacy is replaced by non-binding encouragement, with the Commission and member states taking a stronger role.
• Relief for small mid-caps. Some simplifications for SMEs now extend to small mid-cap companies, including simplified technical documentation. For these firms, the fines in Article 99(4) and (5) are capped at whichever is lower, the fixed amount or the percentage.
• Less paperwork. No EU database registration for AI systems that are exempt from high-risk classification, and no requirement to use a harmonized post-market monitoring plan.
• Bias detection. Processing of special categories of personal data is allowed where needed to detect and correct bias, with safeguards.
• More sandboxes. Wider access to regulatory sandboxes and a new EU-level sandbox.
• Stronger AI Office. Centralized oversight of AI systems built on general-purpose models, including those embedded in very large online platforms and search engines.

What did not move: the original eight bans, the general-purpose model rules, and the chatbot and deepfake disclosure duties.

Rules for general-purpose AI models

This is the part that covers OpenAI, Anthropic, Google, Meta, Mistral, and other model makers. Since August 2, 2025, providers of general-purpose AI models must meet transparency and copyright duties. That includes technical documentation and a public summary of training content using a Commission template.

Models that may pose "systemic risk" have extra duties: they must assess and mitigate those risks. Under Article 51, a model is presumed to have high-impact capabilities when its training compute is greater than 10^25 floating point operations.

The voluntary GPAI Code of Practice, published in July 2025, gives providers a way to show compliance on transparency, copyright, and safety and security.

Enforcement and fines

From August 2, 2026, national authorities and the EU AI Office enforce the Act. The AI Office holds the powers over general-purpose models: it can request documentation, evaluate models, require corrective measures, and fine.

Maximum fines under Article 99, whichever is higher for a company:

• Banned practices: up to €35 million or 7% of worldwide annual turnover.
• Most other violations, including provider, deployer, and transparency duties: up to €15 million or 3%.
• Giving incorrect or misleading information to authorities: up to €7.5 million or 1%.

For SMEs, including startups, each cap is whichever is lower. Small mid-caps get the lower-of rule for the second and third tiers.

The first test: information requests to frontier labs

The AI Office has started using its powers. At the International AI Summit in Dublin last week, Commission Executive Vice-President Henna Virkkunen said, as reported by Technology.org: "Our AI Office has started enforcing these rules, and sent requests for information addressing issues such as security, external evaluation and monitoring how models are used." The report names OpenAI and Anthropic as recipients, and MLex reported that Meta was also asked.

These are requests for information, not findings that any company broke the law. The open legal question, according to the Technology.org report, is whether the research and testing exemption in Article 2 covers incidents during safety tests. Some lawyers say it does. A Commission official quoted in the report said the Act becomes enforceable when a model's actions have an impact on the EU market. How the AI Office answers that will shape how the Act treats agentic AI, which the drafters wrote rules for before agents were common. For a US view of the same problem, see our coverage of NIST, NSA and CISA's practices for agent incidents during training.

What to do before December 2, 2026

If you build or ship AI that people in the EU use, the near-term list is short:

• Image, video, and audio generators. Check whether your system can produce non-consensual intimate imagery of an identifiable person without major modification, and whether your safeguards reliably stop it. If you run a consumer image tool (see our guide to AI image generators), this is the deadline to watch.
• Generative systems launched before August 2, 2026. Add machine-readable marking of AI-generated output by December 2, 2026. Newer systems should already comply.
• Chatbots and deepfakes. Disclosure duties already apply. Tell users they are talking to AI unless it is obvious, and label deepfakes.
• High-risk uses. Classify your systems against Annex III now. December 2027 is the date, but the documentation, data, and oversight work takes time. Deployers should ask vendors how they plan to comply.

Why it matters

The AI Act is the most detailed AI law in force anywhere, and the EU has now shown that it will both delay and tighten it. The Omnibus gave industry more time on high-risk systems but added a ban that applies in six weeks. The AI Office's first requests show the frontier-model rules are not just paper.

The contrast with the US is sharp. There is still no federal AI statute. Instead, states are passing their own laws, and companies are pitching Congress their own drafts, as with Anthropic's draft federal safety bill. Other governments are writing rules too, including China's proposed export controls on frontier models. For global AI companies, the EU timeline above is the one with fixed dates and fines attached.

Sources

• European Commission: AI Act (regulatory framework page)
• European Commission: AI Omnibus enters into force (July 27, 2026)
• Regulation (EU) 2026/1744, Official Journal (EUR-Lex)
• European Parliament: provisional deal on simplification and nudifier ban (May 7, 2026)
• European Parliament: plenary approval (June 16, 2026)
• European Commission: EU agrees to simplify AI rules and ban nudification apps (May 7, 2026)
• AI Act Article 2: Scope
• AI Act Article 50: Transparency obligations
• AI Act Article 51: Classification of GPAI models with systemic risk
• AI Act Article 99: Penalties
• AI Act Article 111: Systems and models already on the market
• Technology.org: EU opens first AI Act enforcement case against OpenAI and Anthropic
• MLex: OpenAI, Anthropic, Meta asked by EU about AI law compliance
• European Commission AI Act Service Desk: Timeline for the implementation of the EU AI Act