Skip to content
TechToolHub
AI ToolsGuide

EU AI Act 2026: Key Deadlines and What They Mean for You

The EU AI Act timeline after the 2026 Digital Omnibus: what already applies, what changes on 2 December 2026, the delayed high-risk rules and a checklist for businesses.

By Sameera Jayakodi
Last updated 6 min read
EU AI Act 2026: Key Deadlines and What They Mean for You
On this page

If you live or work in Europe and use tools such as ChatGPT, Claude, Gemini or Mistral, the EU AI Act affects you, even if you never build AI yourself. In 2026 the rules changed again: the Digital Omnibus on AI pushed back the strictest obligations and added new bans.

This guide explains, in plain English, what already applies, what is coming next and what small businesses, freelancers and everyday users should actually do. Dates are from the adopted regulation and legal analysis listed at the end, checked on 3 November 2026.

Not legal advice

This is a practical overview, not legal advice. If your organisation builds or deploys AI in a regulated area (hiring, credit, education, health, critical infrastructure), speak to a qualified adviser.

The EU AI Act timeline at a glance

DateWhat applies
1 August 2024AI Act enters into force
2 February 2025Banned AI practices and the AI literacy duty apply
2 August 2025Rules for general-purpose AI models (the models behind ChatGPT, Claude, Gemini, Mistral) apply
27 July 2026Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force
2 August 2026Transparency rules (Article 50) apply: people must know when they are dealing with AI
2 December 2026New ban on AI "nudifier" and child sexual abuse material generators; grace period for watermarking existing generative AI ends
2 August 2027National AI regulatory sandboxes must be in place
2 December 2027High-risk AI rules for stand-alone systems (Annex III: hiring, education, credit, etc.)
2 August 2028High-risk rules for AI built into regulated products (Annex I: machinery, medical devices, toys, etc.)
2 August 2030Deadline for certain high-risk systems used by public authorities

What changed with the 2026 Digital Omnibus?

The Digital Omnibus on AI was adopted as Regulation (EU) 2026/1744 of 8 July 2026 and has applied since 27 July 2026. The main changes:

  • High-risk deadlines moved. Stand-alone high-risk systems now have until 2 December 2027 (originally 2 August 2026), and AI inside regulated products until 2 August 2028. The dates are now fixed rather than depending on when standards are ready.
  • A new ban. AI systems that create realistic intimate images, video or audio of an identifiable person without their explicit consent, or that generate child sexual abuse material, are prohibited from 2 December 2026.
  • AI literacy softened. Organisations must now take measures to support their staff's AI literacy, rather than guarantee a specific level of skill.
  • Lighter paperwork for smaller firms. SMEs and small mid-caps can provide technical documentation in a simplified form, and fines for small mid-caps are capped at the lower of the percentage or fixed amount.
  • Stronger central supervision. The EU AI Office now directly supervises AI systems built on a provider's own general-purpose model.

What did not change: the transparency rules started on 2 August 2026 as planned, and the obligations for general-purpose AI model providers stay the same.

What this means for you

If you just use AI tools personally

Very little changes day to day. You should increasingly see clear labels when you are chatting with an AI or looking at AI-generated or manipulated content (deepfakes). From 2 December 2026, "nudify" apps that create intimate images of real people without consent are illegal to place on the EU market.

If your business uses ChatGPT, Claude, Gemini or Mistral

Most small businesses are deployers (users) of general-purpose AI, not providers. Your main duties are:

  1. AI literacy: take reasonable steps so staff who use AI understand its basics and risks. Short internal guidelines and training count.
  2. Transparency: if you put an AI chatbot on your website or in customer service, tell people they are talking to an AI. If you publish deepfake images, video or audio, label them as AI-generated.
  3. Avoid banned uses: for example, emotion recognition of employees at work or social scoring.
  4. Keep GDPR in mind: the AI Act sits on top of GDPR. Don't paste customers' personal data into tools without a legal basis and a data-processing agreement.

If you build AI products

Check whether your use case is high-risk (Annex III covers areas such as recruitment, education, credit scoring and access to essential services). If so, you now have until 2 December 2027 to meet requirements such as risk management, data governance, logging, human oversight and conformity assessment. If you offer generative AI, make sure its outputs are machine-readable as AI-generated (watermarking) by 2 December 2026 at the latest for systems already on the market.

Do this now

  • Write a one-page AI use policy for your team
  • Label AI chatbots and AI-generated media
  • List the AI tools you use and what data goes into them
  • Choose business plans with a data-processing agreement

Avoid

  • Pasting customer personal data into consumer AI plans
  • Publishing unlabelled deepfakes
  • Using AI for hiring or credit decisions without checking the high-risk rules
  • Assuming the delay means "no rules until 2027"

Fines

Under the original AI Act, the most serious breaches (banned practices) can be fined up to €35 million or 7% of worldwide annual turnover, whichever is higher, with lower caps for other breaches. The Omnibus gives small mid-caps the benefit of the lower of the two amounts, and lets the AI Office impose fines on general-purpose AI providers directly.

Choosing AI tools as a European user

If data location matters to you, compare where each assistant stores your data. Mistral's assistant hosts data in the EU by default, while ChatGPT's EU data residency is only offered on business and education plans. Read our Mistral Vibe vs ChatGPT comparison and our list of European alternatives to Google and Microsoft apps.

FAQ

Has the EU AI Act been delayed?

Partly. The Digital Omnibus delayed the high-risk obligations to 2 December 2027 and 2 August 2028. Bans, AI literacy, general-purpose AI rules and transparency rules are already in force.

Does the EU AI Act apply to small businesses using ChatGPT?

Yes, but lightly. As a deployer you mainly need to support staff AI literacy, be transparent when people interact with AI or see deepfakes, and avoid banned uses.

What happens on 2 December 2026?

The ban on AI systems that generate non-consensual intimate content or child sexual abuse material applies, and providers of generative AI already on the market must have AI-content marking in place.

Does the AI Act replace GDPR?

No. GDPR still applies whenever personal data is processed. The AI Act adds AI-specific rules on top.

Sources

#eu-ai-act#europe#ai-regulation#gdpr#compliance

How this was researched

This article is based on official documentation, pricing pages and the other sources listed in the article. It does not include my own hands-on testing. I update articles when pricing or features change. Read my review process.

Photo of Sameera Jayakodi

About the author

Sameera Jayakodi

Software engineer and founder of TechToolHub

I'm Sameera Jayakodi, a software engineer based in Sri Lanka. I use AI, developer and productivity tools in my own work every day, and I started TechToolHub to give clear, honest comparisons without the hype. Every article is researched from official sources, and the ones marked "Hands-on tested" include my own testing.

githubGitHubMore about me

Related articles