As of September 10, 2026, the AI Act is no longer a future compliance issue. The EU law entered into force on August 1, 2024. Its bans on unacceptable-risk practices and its AI literacy duties began applying on February 2, 2025, and key transparency obligations became enforceable on August 2, 2026.
The main 2026 change is narrower than many headlines suggested. The Digital Omnibus on AI, which entered into force on July 27, 2026, delayed the heavier high-risk system rules. Most Annex III high-risk systems now move to December 2, 2027, while high-risk systems embedded in regulated products move to August 2, 2028. For businesses, the immediate priorities are transparency, role mapping, AI literacy and controls against prohibited uses. High-risk governance work still needs to continue, but on a longer timetable.
For more coverage of artificial intelligence policy, regulation and market impact, follow the RoadsNews AI section.
What changed in 2026
The AI Act is the European Union’s horizontal law for artificial intelligence. It regulates AI by risk level rather than by a single technology category. As a result, the same model or system can face different obligations depending on how it is developed, placed on the market or used.
The important 2026 update is the Digital Omnibus on AI. According to EU institutional materials, the Omnibus was designed to simplify implementation and give more time for high-risk rules, standards and oversight structures to settle. It did not remove the AI Act’s core architecture. It changed the timing for some of the most operationally demanding obligations.
That distinction matters because many headlines presented the update as a broad delay. In practice, several duties are already active. The European Commission’s AI Office and national authorities moved into a more concrete enforcement phase on August 2, 2026. Transparency duties under Article 50 also started applying on that date, with a limited transition period until December 2, 2026 for certain systems already on the market before August 2, 2026 that generate synthetic content and must comply with marking and detection requirements.
The AI Act timeline companies should use now
The following calendar reflects the updated implementation path described by the European Commission, the AI Act Service Desk and the Digital Omnibus on AI. It is a practical timeline, not a substitute for legal advice, because classification can depend on the exact use case, product role and market placement.
| Date | What applies | Why it matters |
|---|---|---|
| August 1, 2024 | The AI Act entered into force. | The legal framework became EU law, starting staged application periods. |
| February 2, 2025 | AI system definition, AI literacy duties and prohibited AI practices began applying. | Organizations using AI in the EU needed staff awareness measures and controls against banned practices. |
| August 2, 2025 | General-purpose AI model obligations began applying. | Providers of covered general-purpose AI models faced documentation, transparency and copyright-related duties, with additional obligations for models with systemic risk. |
| July 27, 2026 | The Digital Omnibus on AI entered into force. | It adjusted the timing for high-risk AI rules and confirmed a longer transition for parts of the compliance regime. |
| August 2, 2026 | Transparency obligations and enforcement powers became a major live focus. | Users should be told when they interact with certain AI systems, and synthetic or manipulated content may need disclosure or technical marking depending on the context. |
| December 2, 2026 | Limited transition period ends for certain pre-existing systems under Article 50(2). | Providers relying on the transition should complete synthetic-content marking and detection compliance before this date. |
| December 2, 2027 | Rules for high-risk AI systems listed in Annex III apply. | This affects areas such as employment, education, essential services, law enforcement, migration, justice and certain biometric uses when the AI system meets the legal high-risk criteria. |
| August 2, 2028 | Rules for high-risk AI systems embedded in regulated products apply. | This later date is especially relevant to AI inside products already covered by EU product safety and harmonisation laws. |
Who is in scope
The AI Act can apply to organizations outside the EU when their AI systems are placed on the EU market, put into service in the EU, or when outputs are intended to be used in the Union. A U.S. software vendor, model provider or enterprise platform should not assume it is outside the law simply because it has no EU headquarters.
The first compliance task is role identification. The law distinguishes providers, deployers, importers, distributors and product manufacturers. A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, except in purely personal non-professional contexts. A company can also hold more than one role, especially if it heavily modifies, rebrands or integrates a system into a regulated product.
This role mapping is more than an administrative exercise. Providers usually carry the heavier design, documentation and conformity responsibilities. Deployers may face obligations around appropriate use, monitoring, human oversight, transparency to affected people and evidence that the system is used as intended. Buyers of AI tools should therefore ask suppliers for enough information to classify the system, understand its limitations and document accountability.
The risk categories behind the law
The AI Act’s central idea is that regulatory burden should increase with risk. The European Commission describes the framework as a risk-based approach: unacceptable-risk practices are banned, high-risk systems are subject to strict controls, limited-risk systems face transparency duties, and minimal-risk systems are generally left without additional AI Act obligations.
Unacceptable risk
Unacceptable-risk practices are prohibited. The banned categories include harmful manipulation, exploitation of vulnerabilities, certain social scoring practices, some forms of biometric categorisation and other uses considered incompatible with fundamental rights and safety. These restrictions have applied since February 2, 2025, so organizations should already have internal review processes to prevent procurement or deployment of banned use cases.
High risk
High-risk classification is the most operationally significant part of the law. Annex III covers sensitive areas such as employment, worker management, education, access to essential services, law enforcement, migration and border control, administration of justice and certain biometric systems. Separately, AI embedded in regulated products can be high risk when it falls under listed EU product legislation.
The updated dates give companies more time, but they do not remove the work. High-risk obligations can include risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness, cybersecurity, conformity assessment and post-market monitoring. Mature organizations are unlikely to complete those tasks well in the final weeks before a deadline.
Limited and transparency risk
Article 50 is now one of the most immediate practical provisions. It covers transparency in specific situations, including informing people when they are interacting with certain AI systems unless this is obvious from the circumstances. It also addresses disclosure around emotion recognition, biometric categorisation and AI-generated or manipulated content in defined contexts. For customer-facing chatbots, content tools, marketing workflows and media operations, this is often where the AI Act moves most quickly from legal text into product design.
What organizations should prioritize now
The safest reading of the 2026 update is not that teams can wait. It is that they should separate immediate duties from longer-cycle high-risk readiness. A company using AI in hiring, credit, education or customer service may have short-term transparency duties and later high-risk obligations at the same time. See also: Devices.
- Create an AI inventory. List systems, vendors, use cases, user groups, data inputs, outputs and whether the tool affects people in the EU.
- Map legal roles. Identify whether the organization is acting as provider, deployer, importer, distributor or product manufacturer for each system.
- Screen for prohibited practices. Review use cases against the banned categories that have applied since February 2025.
- Document AI literacy measures. Keep records of training, guidance and role-specific awareness for staff who operate or oversee AI systems.
- Review Article 50 transparency. Check whether users must be told they are interacting with AI, whether synthetic content must be marked, and whether disclosures are clear at the right moment.
- Assess general-purpose AI dependencies. If a product relies on a general-purpose AI model, ask suppliers for documentation, model capability information, usage restrictions and compliance statements.
- Prepare high-risk governance early. For potentially high-risk systems, start building risk management files, human oversight procedures, logs, incident workflows and vendor evidence.
These steps are useful even where final classification remains under review. They also help organizations respond to customer questionnaires, procurement audits and board-level risk reviews. In many sectors, contractual pressure will arrive before formal enforcement action.
Why the high-risk delay still matters
The postponement of high-risk application dates is significant because these are the most demanding provisions. For Annex III systems, the relevant date is now December 2, 2027. For high-risk AI embedded in regulated products, the key date is August 2, 2028. This gives providers and deployers more time to align with standards, guidelines and conformity processes.
Even so, high-risk teams should not treat the extension as idle time. Classification can be complex. A simple productivity tool used to draft generic text may be low or limited risk. A system used to rank job applicants, evaluate students, assist credit decisions or support access to public benefits may raise very different questions. The same underlying model can therefore sit in different legal risk categories depending on its use.
Evidence is another reason to start early. High-risk compliance depends on documentation produced across the lifecycle: design decisions, dataset governance, testing, oversight instructions, incident tracking and monitoring after deployment. Reconstructing those records late is more expensive and less reliable than building them into development and procurement workflows from the start.
Impact for U.S. and global companies
The AI Act is an EU law, but its commercial effects are global. Vendors that sell into Europe, platforms whose outputs are used by EU customers, and multinational employers using AI-enabled tools across regions should expect the law to influence contracts, product labels and risk reviews.
For U.S. companies, the near-term impact is likely to appear in four places. First, enterprise customers may ask for AI Act role mapping and system documentation. Second, consumer-facing products may need clearer notices when users interact with AI or receive AI-generated content. Third, model suppliers may face questions about general-purpose AI obligations, including technical documentation and copyright-related transparency. Fourth, global governance teams may decide that a single higher-standard control is easier than maintaining separate EU and non-EU versions.
There is also a communications risk. Companies should avoid telling customers that the AI Act has been delayed. A more accurate message is that the high-risk timeline has changed, while transparency, AI literacy, prohibited-use and general-purpose AI requirements are already relevant.
Frequently asked questions
Is the AI Act already in force?
Yes. The AI Act entered into force on August 1, 2024. Different parts apply on different dates. As of September 10, 2026, prohibited-practice rules, AI literacy obligations, general-purpose AI obligations and key transparency requirements are already in the active implementation period.
Was the AI Act delayed in 2026?
Only partly. The Digital Omnibus on AI changed the timing for high-risk AI systems. Annex III high-risk rules now apply from December 2, 2027, and high-risk rules for AI embedded in regulated products apply from August 2, 2028. Transparency obligations were not broadly postponed.
Does the AI Act apply to companies outside Europe?
It can. Non-EU providers and deployers may be covered when AI systems are placed on the EU market, put into service in the EU, or when their outputs are intended for use in the EU. Companies with EU customers, users, employees or business partners should perform a scope assessment.
What should companies do first?
The first step is an AI inventory linked to role mapping and risk classification. Without that baseline, it is difficult to know whether the organization is dealing with a banned practice, a transparency duty, a general-purpose AI dependency or a future high-risk obligation.
Are most AI tools high risk under the AI Act?
No. The EU framework does not treat every AI system as high risk. Many ordinary tools may be minimal or limited risk, but classification depends on the use case, sector, effect on people and whether the system falls within the law’s high-risk categories.
The bottom line
The AI Act has moved from legislative debate to staged enforcement. The 2026 update gives organizations more time for high-risk compliance, but it does not remove immediate obligations. The practical priority is to build a defensible map of AI systems, legal roles, risk categories, transparency duties and supplier dependencies. Companies that do this now will be better positioned for the December 2027 and August 2028 high-risk deadlines, and better prepared for the customer, regulator and investor questions arriving much sooner.