Skip to content

EU AI Act timeline (2026 Digital Omnibus)

Ready  ·  v1.2  ·  Last reviewed 2026-08-03

Word Markdown

Purpose. The dates that actually bind you, reflecting the 2026 Digital Omnibus amendments — what is already in force, what was deferred, and what to work backwards from.

When to use it. When planning your roadmap, and whenever you are asked "how long have we got?". Re-check before you rely on any date; this area is still moving.

How to use it. Treat the dates as the deadline to be compliant, then work backwards from them. Classification, conformity assessment, and documentation take many months, so the practical start date is far earlier than the legal one.

The template

Verify before you rely on this

The Digital Omnibus on AI is now enacted law: Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. It amends Regulation (EU) 2024/1689 (the AI Act) and two other regulations. Because implementing acts, guidance, and national measures continue to evolve, confirm each date against the official EU sources before making compliance decisions. This page is a planning aid, not legal advice.

Key dates at a glance

Obligation Original date Current date Change
Prohibited practices (Art. 5) 2 Feb 2025 2 Feb 2025 In force — unchanged
AI literacy (Art. 4) 2 Feb 2025 2 Feb 2025 In force — but softened by the Omnibus to an effort-based duty
New bans (CSAM / "nudifiers") — 2 Dec 2026 Added by Omnibus, transitional
GPAI model obligations (Art. 51–56) 2 Aug 2025 2 Aug 2025 In force — unchanged
Art. 50 transparency (deepfakes, chatbots) 2 Aug 2026 2 Aug 2026 Proceeds as scheduled
↳ Watermarking grace for existing systems — 2 Dec 2026 4-month grace added
High-risk — Annex III (stand-alone) 2 Aug 2026 2 Dec 2027 Deferred ~16 months
High-risk — Annex I (embedded in products) 2 Aug 2027 2 Aug 2028 Deferred ~12 months
AI regulatory sandboxes (national) 2 Aug 2026 2 Aug 2027 Deferred ~12 months

What changed since the Omnibus was enacted

Three developments matter for planning, all confirmed:

What When Why it matters
Art. 50 transparency Guidelines (final, 51 pages) 20 Jul 2026 The Commission's own reading of what disclosure and marking actually require, published two weeks before the obligations applied. Non-binding, but it is what supervisors will work from.
Code of Practice on Transparency of AI-Generated Content assessed adequate Jul 2026 A voluntary route to demonstrating Art. 50 compliance. Around 190 organisations had signed by end of July 2026.
GPAI enforcement powers begin 2 Aug 2026 The obligations applied from August 2025; the Commission's power to enforce them starts now.

Art. 4 AI literacy was softened, not removed

The Omnibus replaced Art. 4 with an effort-based duty: you must take measures to support the development of AI literacy, rather than ensure it. The text is explicit that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". The obligation still bites — it is simply no longer an outcome you must achieve.

Art. 6(3) registration survived, in simplified form

If you rely on the Art. 6(3) derogation to say a system in an Annex III area is not high-risk, you must still register it in the EU database. The Omnibus streamlined what Annex VIII requires rather than removing the duty. Claiming the exemption is not the same as walking away.

What the Digital Omnibus changed

The Omnibus is a simplification and timeline-relief package. The headline is that high-risk obligations were pushed back — Annex III stand-alone systems (recruitment, credit scoring, education, law enforcement, border control) now apply from 2 December 2027 rather than August 2026, and Annex I systems embedded in regulated products (medical devices, machinery, vehicles) move to 2 August 2028.

It also adds a four-month watermarking grace period for pre-existing systems under the Article 50 transparency rules, introduces new prohibitions (child sexual abuse material and non-consensual "nudifier" tools) with a transitional period to 2 December 2026, and includes targeted exemptions to reduce duplication where machinery-regulation products already carry equivalent requirements.

What this means for your programme

The deferral is breathing room, not a reprieve. The heavy lifting for high-risk systems — classification, conformity assessment, technical documentation, human oversight, logging, and post-market monitoring — still takes many months to build. Treat the new dates as the deadline to be compliant, and work backwards.

A sensible sequencing:

  1. Now — inventory and classify every AI system (see the AI System Inventory). You cannot manage what you have not catalogued.
  2. Now — confirm you are clear of prohibited practices and are meeting the GPAI, AI literacy, and Article 50 transparency duties already in force.
  3. 2026 — build the control framework for anything that will be high-risk: risk management, data governance, documentation, human oversight.
  4. Ahead of Dec 2027 — complete conformity assessments and post-market monitoring for Annex III systems.

Work backwards from December 2027

If an Annex III system needs a conformity assessment, count back: the assessment needs complete technical documentation, which needs a finished risk management process, which needs classified systems and governed training data. That chain is comfortably an 18-month programme.

Sources

Primary sources — check these first. Commentary is useful for interpretation, but only the official text is authoritative.

Secondary commentary — helpful summaries, but confirm against the above.

Always cross-check against the official Official Journal of the European Union text and the European Commission's AI Act pages for the definitive dates.

Adaptation notes

  • Non-EU organisations: These dates bind you where you place systems on the EU market or where output is used in the EU. Check scope first — many organisations assume they are out and are not.
  • Long product cycles: If your release cycle is 12 months or more, the December 2027 date is effectively one or two releases away. Treat it as current-roadmap work, not future work.
  • Maintaining this page: This is the page most likely to age. Re-verify against official sources each quarter and update the dates here in data/templates.yml.

Not legal advice

These templates are a head start, not a substitute for professional judgement. Adapt them to your jurisdiction, sector, and risk appetite, and have qualified counsel review anything material before you rely on it.