What Actually Applies Today, and What Was Just Postponed
Most coverage from mid-2026 still describes the EU AI Act as fully applying from 2 August 2026, and until three weeks before that date, it was correct. A Digital Omnibus law, Regulation 2026/1744, entered into force on 27 July 2026 and rewrote the Act's own staggered schedule, pushing the expensive part, Annex III high-risk obligations covering hiring tools, credit scoring, insurance, and similar use cases, out to 2 December 2027.
| 1 August 2024 | AI Act enters into force; nothing yet applies |
|---|---|
| 2 February 2025 | Prohibited practices (Article 5) and AI-literacy duties apply |
| 2 August 2025 | GPAI provider duties, governance bodies, and the penalty framework apply |
| 2 December 2026 | New prohibition on AI-generated non-consensual intimate content and CSAM applies |
| 2 February 2027 | Article 50 labelling enforcement begins for systems already on the market before August 2026 |
| 2 December 2027 | Annex III high-risk obligations apply (postponed from 2 August 2026) |
| 2 August 2028 | Annex I high-risk obligations apply (postponed from 2 August 2027) |
Nothing else in the original schedule moved. Prohibited practices and GPAI provider duties are unaffected, and a business that assumed the whole Act arrived in August 2026 is both wrong about what already binds it and unaware of a real reprieve on the expensive part.
Why the Postponement Happened, and Why It Isn't Unconditional
The Omnibus followed a normal legislative path, proposed by the Commission on 19 November 2025, agreed in trilogue on 7 May 2026, adopted by Parliament on 16 June 2026, adopted by Council on 29 June 2026, and signed 8 July 2026, before entering into force on 27 July. Its stated reason for the delay is that harmonised technical standards for high-risk systems were not ready in time for companies to actually comply.
The new dates are not an unconditional two-year holiday: the postponement is written as a hard backstop tied to a Commission decision confirming those standards and guidance are genuinely available, with compliance due twelve months after that confirmation. A business planning its 2027 compliance budget around 2 December 2027 should treat that as the latest date, not a guaranteed one, since an earlier standards confirmation could pull it forward.
What's Actually Enforceable Now, With Real Fines
Two obligations already carry the Act's full penalty weight. Article 5's prohibited-practices list, banning things like social scoring, manipulative dark-pattern AI, untargeted facial-recognition scraping, and workplace emotion inference, has applied since February 2025, with fines up to 35 million EUR or 7 percent of global turnover. Article 50 transparency and labelling duties, covering AI-generated content and chatbot disclosure, are also live, though enforcement against systems already on the market before August 2026 carries a grace period until 2 February 2027.
Anyone who merely calls an API from a frontier model provider, rather than training one, sits outside the GPAI systemic-risk regime entirely: that tier only binds companies whose own training compute exceeds roughly 10 to the 25 FLOPs, a threshold the Commission itself says currently costs tens of millions of euros to reach. The practical checklist for a mid-size European business today is narrower than most coverage implies: confirm any AI-generated marketing content or chatbot carries the required disclosure, confirm none of your tools resemble the Article 5 list, and treat Annex III conformity work as a 2027 project with a real but conditional deadline, not a 2026 emergency.
Read next: A King Asked AI's Leaders for Reassurance, Not Rules | Your AI Auditor Now Needs a License From California
