# EU AI Act timeline (2026 Digital Omnibus)

**Purpose.** The dates that actually bind you, reflecting the 2026 Digital Omnibus amendments — what is already in force, what was deferred, and what to work backwards from.

**When to use it.** When planning your roadmap, and whenever you are asked "how long have we got?". Re-check before you rely on any date; this area is still moving.

**How to use it.** Treat the dates as the deadline to *be compliant*, then work backwards from them. Classification, conformity assessment, and documentation take many months, so the practical start date is far earlier than the legal one.

---

> **Verify before you rely on this**
> The Digital Omnibus on AI is now **enacted law**: Regulation (EU)
> 2026/1744, published in the Official Journal on **24 July 2026** and in
> force from **27 July 2026**. It amends Regulation (EU) 2024/1689 (the AI
> Act) and two other regulations. Because implementing acts, guidance, and
> national measures continue to evolve, **confirm each date against the
> official EU sources** before making compliance decisions. This page is a
> planning aid, not legal advice.

### Key dates at a glance

| Obligation | Original date | Current date | Change |
|---|---|---|---|
| **Prohibited practices** (Art. 5) | 2 Feb 2025 | 2 Feb 2025 | In force — unchanged |
| **AI literacy** (Art. 4) | 2 Feb 2025 | 2 Feb 2025 | In force — but **softened** by the Omnibus to an effort-based duty |
| New bans (CSAM / "nudifiers") | — | 2 Dec 2026 | Added by Omnibus, transitional |
| **GPAI model obligations** (Art. 51–56) | 2 Aug 2025 | 2 Aug 2025 | In force — unchanged |
| **Art. 50 transparency** (deepfakes, chatbots) | 2 Aug 2026 | 2 Aug 2026 | Proceeds as scheduled |
| ↳ Watermarking grace for existing systems | — | 2 Dec 2026 | 4-month grace added |
| **High-risk — Annex III** (stand-alone) | 2 Aug 2026 | **2 Dec 2027** | Deferred ~16 months |
| **High-risk — Annex I** (embedded in products) | 2 Aug 2027 | **2 Aug 2028** | Deferred ~12 months |
| AI regulatory sandboxes (national) | 2 Aug 2026 | 2 Aug 2027 | Deferred ~12 months |

### What changed since the Omnibus was enacted

Three developments matter for planning, all confirmed:

| What | When | Why it matters |
|---|---|---|
| **Art. 50 transparency Guidelines** (final, 51 pages) | 20 Jul 2026 | The Commission's own reading of what disclosure and marking actually require, published two weeks before the obligations applied. Non-binding, but it is what supervisors will work from. |
| **Code of Practice on Transparency of AI-Generated Content** assessed **adequate** | Jul 2026 | A voluntary route to demonstrating Art. 50 compliance. Around 190 organisations had signed by end of July 2026. |
| **GPAI enforcement powers begin** | 2 Aug 2026 | The obligations applied from August 2025; the Commission's power to enforce them starts now. |

> **Art. 4 AI literacy was softened, not removed**
> The Omnibus replaced Art. 4 with an effort-based duty: you must **take
> measures to support the development of** AI literacy, rather than
> **ensure** it. The text is explicit that this "does not require
> providers or deployers to guarantee any specific level of AI literacy of
> any individual". The obligation still bites — it is simply no longer an
> outcome you must achieve.

> **Art. 6(3) registration survived, in simplified form**
> If you rely on the Art. 6(3) derogation to say a system in an Annex III
> area is not high-risk, you must still register it in the EU database.
> The Omnibus streamlined what Annex VIII requires rather than removing
> the duty. Claiming the exemption is not the same as walking away.

### What the Digital Omnibus changed

The Omnibus is a **simplification and timeline-relief** package. The headline
is that **high-risk obligations were pushed back** — Annex III stand-alone
systems (recruitment, credit scoring, education, law enforcement, border
control) now apply from **2 December 2027** rather than August 2026, and
Annex I systems embedded in regulated products (medical devices, machinery,
vehicles) move to **2 August 2028**.

It also adds a **four-month watermarking grace period** for pre-existing
systems under the Article 50 transparency rules, introduces **new
prohibitions** (child sexual abuse material and non-consensual "nudifier"
tools) with a transitional period to 2 December 2026, and includes
**targeted exemptions** to reduce duplication where machinery-regulation
products already carry equivalent requirements.

### What this means for your programme

The deferral is **breathing room, not a reprieve.** The heavy lifting for
high-risk systems — classification, conformity assessment, technical
documentation, human oversight, logging, and post-market monitoring — still
takes many months to build. Treat the new dates as the deadline to *be
compliant*, and work backwards.

A sensible sequencing:

1. **Now** — inventory and classify every AI system (see the
   AI System Inventory). You cannot manage what you have not catalogued.
2. **Now** — confirm you are clear of prohibited practices and are meeting
   the GPAI, AI literacy, and Article 50 transparency duties already in force.
3. **2026** — build the control framework for anything that will be
   high-risk: risk management, data governance, documentation, human
   oversight.
4. **Ahead of Dec 2027** — complete conformity assessments and post-market
   monitoring for Annex III systems.

> **Work backwards from December 2027**
> If an Annex III system needs a conformity assessment, count back: the
> assessment needs complete technical documentation, which needs a finished
> risk management process, which needs classified systems and governed
> training data. That chain is comfortably an 18-month programme.

### Sources

**Primary sources — check these first.** Commentary is useful for
interpretation, but only the official text is authoritative.

- [Regulation (EU) 2024/1689 — the AI Act, consolidated text on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [Regulation (EU) 2026/1744 — the Digital Omnibus on AI, OJ 24 Jul 2026](https://eur-lex.europa.eu/eli/reg/2026/1744/oj)
- [Commission Guidelines on transparency obligations (Art. 50), 20 Jul 2026](https://digital-strategy.ec.europa.eu/en/policies/guidelines-transparency-ai-generated-content)
- [Code of Practice on Transparency of AI-generated Content](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content)
- [EUR-Lex — AI Act procedure file and amendments](https://eur-lex.europa.eu/legal-content/EN/HIS/?uri=CELEX:32024R1689)
- [European Commission — AI Act policy pages and implementing guidance](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)
- [European Commission — Digital Omnibus package](https://digital-strategy.ec.europa.eu/en/library/digital-omnibus)
- [European AI Office](https://digital-strategy.ec.europa.eu/en/policies/ai-office)

**Secondary commentary** — helpful summaries, but confirm against the above.

- [Gibson Dunn — EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/)
- [DLA Piper — The Digital AI Omnibus: proposed deferral of high-risk AI obligations](https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2026/The-Digital-AI-Omnibus-Proposed-deferral-of-high-risk-AI-obligations-under-the-AI-Act)
- [Covington Inside Privacy — Timeline Relief, Targeted Simplification, and New Prohibitions](https://www.insideprivacy.com/artificial-intelligence/eu-ai-act-update-timeline-relief-targeted-simplification-and-new-prohibitions/)
- [Freshfields — EU AI Act unpacked #34: the final Digital Omnibus on AI](https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/eu-ai-act-unpacked-34-the-final-digital-omnibus-on-ai-key-amendments-to-the-a-102nber)

Always cross-check against the official *Official Journal of the European
Union* text and the European Commission's AI Act pages for the definitive
dates.

---

## Adaptation notes

- **Non-EU organisations:** These dates bind you where you place systems on the EU market or where output is used in the EU. Check scope first — many organisations assume they are out and are not.
- **Long product cycles:** If your release cycle is 12 months or more, the December 2027 date is effectively one or two releases away. Treat it as current-roadmap work, not future work.
- **Maintaining this page:** This is the page most likely to age. Re-verify against official sources each quarter and update the dates here in `data/templates.yml`.

---

*From the [Open Data & AI Governance Kit](https://lsdeva.github.io/governance-kit/). Licensed [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — free to use, adapt, and share with attribution.*

***Not legal advice.** Adapt to your jurisdiction, sector, and risk appetite, and have qualified counsel review anything material.*