EU AI Act Deadlines in 2026: What the Omnibus Changed

If you read that the EU AI Act's high-risk rules land on 2 August 2026, you are reading advice written before the Digital Omnibus. That amendment, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk obligations to 2027 and 2028 and left the other key dates where they were, while rewording the AI-literacy duty and adding two new bans. The result is a timeline most published guides now get wrong: the deadline that actually touches a company using AI is not the one that was delayed. Here is the corrected schedule, what moved, what did not, and what you must do now that 2 August 2026 has passed.

Quick Answer. After the Digital Omnibus (in force since 27 July 2026), most EU AI Act deadlines still stand: it delayed the high-risk obligations, Annex III from 2 August 2026 to 2 December 2027 and Annex I from 2 August 2027 to 2 August 2028. The Article 50 transparency rules and enforcement have applied since 2 August 2026, and the bans, literacy duty and penalties since 2025.

Last updated: 25 September 2026 · Verified against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27 July 2026).

Summary

EU AI Act deadlines after the Omnibus — the high-risk dates moved, the rest stands
│
├─ Already in force — nothing to wait for
│   ├─ 2 Feb 2025 · Art. 5 bans + Art. 4 AI-literacy duty
│   └─ 2 Aug 2025 · GPAI rules + Art. 99 penalties applicable
│
├─ 2 Aug 2026 — applied on schedule, NOT delayed
│   ├─ Art. 50 transparency: label chatbots and AI content
│   └─ Enforcement machinery + supervisory powers switched on
│
└─ What the Omnibus actually moved or added
    ├─ Annex III high-risk: 2 Aug 2026 → 2 Dec 2027
    ├─ Sandboxes to 2 Aug 2027; Annex I high-risk 2 Aug 2028
    ├─ 2 Dec 2026 · two new Art. 5 bans + Art. 50(2) grace for legacy generative tools
    └─ "We have until 2027" holds only for high-risk you may not run

What changed, and what did not, after the Digital Omnibus

The Digital Omnibus, Regulation (EU) 2026/1744, is a simplification amendment to the AI Act. The Council of the EU gave its final green light on 29 June 2026, and the act was signed on 8 July 2026, under procedure 2025/0359(COD) ^3,4. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It is binding law now, so "as amended" means amended by Regulation (EU) 2026/1744.

What the Omnibus did to the dates is narrow. It pushed back the Annex III high-risk regime from 2 August 2026 to 2 December 2027 ³. Those are the heavy obligations for systems used in sensitive contexts such as hiring, creditworthiness and access to essential services. It also moved the Annex I high-risk regime, for safety components of regulated products, from 2 August 2027 to 2 August 2028, set national regulatory sandboxes to be operational by 2 August 2027, and gave generative AI systems placed on the market before 2 August 2026 until 2 December 2026 to meet the Article 50(2) marking duty. That is the extent of the relief that matters to most organisations.

What it did not delay is the part an ordinary AI-using company actually carries. The Article 50 transparency duties have applied since 2 August 2026, and the enforcement machinery with them. Four obligations have been live since 2025: the Article 5 bans, the Article 4 AI-literacy duty, general-purpose AI rules and the Article 99 penalties. Their dates are unchanged and all are binding ^1,2, but the Omnibus reworded Article 4, added two Article 5 bans that apply from 2 December 2026 and amended Article 99 to take account of SMEs and small mid-caps. For a fuller walk-through of what a company using AI owes and how the pieces fit together, our complete EU AI Act documentation guide sets out the deployer-first path. This article is the timeline that sits underneath it.

The corrected EU AI Act timeline (post-Omnibus)

Here is the schedule after the Digital Omnibus. The two rows to read carefully are the ones in bold: the date that did not move, and the one that did.

The headline error in most ranking content is to fold the whole Act into a single "2 August 2026" or "delayed to 2027" line. Neither is true. The Act arrives in layers, most already past, and the Omnibus shifted only the high-risk layers, plus the sandboxes and a short grace period for generative tools already on the market ^1,2.

Which EU AI Act deadlines were delayed, and which were not?

The single most useful way to hold the change in your head is a two-column split. What the Omnibus moved goes on the right, and what it left in place on the left. The left column is the part that binds a company using AI in 2026.

Which of these is your deadline depends on what your AI system does. The routing is short:

In words, the tree routes like this:

• Is the use prohibited (Article 5)? It has been banned since 2 February 2025. There is no compliant version, and the Omnibus added two further bans, on non-consensual intimate deepfakes and on AI-generated child sexual abuse material, which apply from 2 December 2026.
• Is it a chatbot, or does it generate or manipulate content? Article 50 transparency has applied since 2 August 2026. This was not delayed (generative tools already on the market before then have until 2 December 2026 for machine-readable marking): label the AI and disclose it.
• Is it an Annex III high-risk use: hiring, credit scoring, access to essential services? The full high-risk duties apply from 2 December 2027, the date the Omnibus moved ³.
• Is it an Annex I safety component of a regulated product? Those high-risk duties apply from 2 August 2028.
• Anything else: the everyday chatbots, drafting aids and AI features in ordinary software, is limited or minimal risk, with no dated deadline of its own.

Two duties sit across every branch regardless of tier. They are the Article 4 AI-literacy duty, live since February 2025, and the Article 99 penalties, applicable since August 2025. So "we have until 2027" is only true for the high-risk branch, a branch most deployers never enter.

What must you do now that 2 August 2026 has passed?

Because the delay applies only to high-risk systems, the practical to-do list for an ordinary deployer is unchanged and already due. None of it waits for 2027. Do it now:

1. Inventory and classify every AI system. You cannot know which deadline applies until you know what each system does and which tier it falls in. This is the step that turns the timeline above into your timeline.
2. Publish Article 50 transparency notices on customer-facing AI such as chatbots, AI-written content and synthetic media, required since 2 August 2026 ¹.
3. Put Article 4 AI-literacy measures in place and keep the records. This duty has been live since 2 February 2025, so if you have not done it, it is already overdue rather than upcoming.
4. File your vendor and policy documents, so the paper trail exists before a customer or regulator asks, since enforcement powers have applied since 2 August 2026 ².
5. Diarise 2 December 2027 only if classification actually placed one of your systems in Annex III. For most deployers, it will not.

The free EU AI Act Documentation tool does steps one to four for you. It classifies each system you describe, states which of these dates applies to it, and generates the register, transparency notices, policy and training records, sized to your systems. Free checkers tell you if the Act concerns you. This generates the documents that show what you have done.

Generate your own EU AI Act documents — free, in ~20 minutes: https://aiprioritymap.com/en/tools/eu-ai-act

When the "delay" does not help you

The comfort in "high-risk pushed to 2027" is real but narrow, and it breaks down in four ways worth naming plainly.

First, the delay covers only the high-risk regimes. If none of your systems are high-risk, the common case, the Omnibus gives you nothing to defer. Your live duties are transparency and literacy, both already applicable ^1,3.

Second, the duties already in force stay in force. Penalties have been applicable since 2 August 2025. A regulator assessing a 2026 breach is not bound by a 2027 date that governs a different tier ^1,2.

Third, the AI Act sits on top of your existing obligations, not instead of them. If your AI processes personal data, the GDPR applies in full and does not move with the Omnibus. Our cornerstone on how the AI Act sits alongside GDPR and UK data rules maps the overlap. The delay does not touch it.

Fourth, a delayed deadline is still a deadline. Annex III preparation, meaning classification, oversight, records and for many deployers a fundamental rights impact assessment, takes months rather than days. Treating 2 December 2027 as "later" rather than "start now" is how a delay becomes a scramble.

What to do on Monday

Do not wait, and do not plan to the high-risk dates that moved. Take an hour, list every AI system your company uses, and classify each against the tiers above. That single step tells you which row of the timeline is yours. For most companies the answer is the near one: transparency and literacy, live in 2026, not the high-risk regime that slid to 2027. For the full deployer-first method behind this timeline, work through the complete EU AI Act documentation guide. Then generate your pack and attach the dated roadmap to your next customer questionnaire.

Related insights

• EU AI Act Compliance: The Documentation Guide — the deployer-first five-step path and the nine-document pack this timeline sits under.
• AI Governance from Day One: GDPR and the EU AI Act — how the AI Act sits alongside GDPR and existing data rules, unchanged by the Omnibus.

Last updated: 25 September 2026. Version 1.0.