EU AI Act compliance calendar: every confirmed deadline

Four EU AI Act obligations are already enforceable today: the prohibited-practices list, AI literacy duties, the general-purpose AI (GPAI) model rules, and the AI Office's supervisory powers. Two more dates that used to be firmer moved this year: Annex III high-risk-system obligations now start 2 December 2027, not 2 August 2026, and high-risk AI embedded in regulated products such as machinery, toys and lifts now starts 2 August 2028. Both changes came from the "Digital Omnibus on AI," Regulation (EU) 2026/1744, which entered into force on 27 July 2026.

Which EU AI Act obligations are already in force?

Article 113 of the Act, as amended by the Digital Omnibus, sets the obligations that became enforceable before the Act's general application date. Chapters I and II (prohibited practices) applied from 2 February 2025, with one carve-out: two sub-points on biometric categorisation and emotion inference, added by the Omnibus, apply from 2 December 2026 instead. Chapter III Section 4, Chapter V (the GPAI rules), Chapter VII and Chapter XII, plus Article 78, applied from 2 August 2025.

The Act's general application date, 2 August 2026, is when the AI Office and the Member States' own authorities took over day-to-day supervision and enforcement, and when the transparency rules (labelling AI-generated content, disclosing chatbot interactions) came into effect.

When do Annex III high-risk system obligations apply?

High-risk AI systems listed in Annex III (the stand-alone list covering areas such as employment, access to essential services, law enforcement and migration) were originally due to come under Chapter III, Sections 1 to 3 at the Act's general application date. The Digital Omnibus pushed that specific obligation to 2 December 2027.

When do the rules for high-risk AI embedded in physical products apply?

A separate class of high-risk system, AI embedded in products that are already regulated elsewhere (machinery, toys, lifts, medical devices and similar, under Article 6(1) and Annex I), now starts later still: 2 August 2028.

When do fines for general-purpose AI model providers start?

Article 101, which lets the Commission fine a GPAI provider up to 3% of its worldwide annual turnover or €15 million, whichever is higher, for an infringement of the Regulation, is explicitly carved out of the 2 August 2025 date that brought the rest of the GPAI chapter into force. It is not among the articles the Omnibus moved to 27 July 2026 either, so it falls back to the Act's general application date: 2 August 2026, a full year after GPAI providers' other obligations began.

Articles 102 to 110, which cover the penalty procedure's remaining mechanics, apply from 27 July 2026, the day the Omnibus itself entered into force.

What exactly did the Digital Omnibus on AI change?

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. It amends the AI Act itself (Regulation (EU) 2024/1689) along with two unrelated regulations on civil aviation and machinery, folding AI-specific safety requirements for those sectors into the same simplification exercise. The Commission adopted the package on 19 November 2025, and the Parliament and Council reached political agreement on 7 May 2026.

Beyond the two deadline extensions above, the Commission's own announcement describes the package as "administrative simplification": it did not reopen the prohibited-practices list, the GPAI rules already in force, or the Act's substantive requirements for Annex III or Annex I systems once their new dates arrive.

Where could this calendar still move?

Every date above is from the Act's own text or the Commission's account of it, not a forecast. The Commission has reopened the Annex III timeline once already, by three years and four months from the Act's original schedule, so a security or compliance program with a 2027 or 2028 deadline on its roadmap should treat that date as the current legal requirement, not as fixed years in advance. This page is a calendar, not a forecast: it lists what the law requires as of its last check against EUR-Lex and the Commission's own pages, and it will be updated if either changes again.

For what Article 15's cybersecurity duty and Article 73's incident-reporting deadlines mean in practice for a security team, see this site's explainer on what the EU AI Act requires of a CISO. To check whether a specific system is likely to fall under Annex III once its 2027 date arrives, see this site's Annex III category-by-category lookup.