The EU AI Act entered into force on 1 August 2024 and applies in stages. In 2026 the Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744 and in force since 27 July 2026, moved the main high-risk deadlines. Many companies now ask the same question: what do we have to do today, and what can be planned for later? Here is the current timeline.
The timeline at a glance
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited AI practices (Article 5) and the first general provisions. |
| 2 August 2025 | Obligations for providers of general-purpose AI models, governance and penalties. |
| 2 August 2026 | Transparency obligations of Article 50, for example telling people they are interacting with an AI system. |
| 2 December 2026 | Marking of AI-generated content (Article 50(2)) and two new prohibitions added by the Omnibus. |
| 2 December 2027 | Stand-alone high-risk AI systems listed in Annex III, such as recruitment, credit scoring, education and critical infrastructure (previously 2 August 2026). |
| 2 August 2028 | High-risk AI embedded in products regulated under Annex I, such as machinery and medical devices (previously 2 August 2027). |
This overview is for orientation only and is not legal advice. Check your own role (provider, deployer, importer) and systems with your legal team.
What the Digital Omnibus changed, and what it did not
The Omnibus postponed the high-risk obligations because harmonised standards and national authorities were not ready. It did not remove them. The requirements for high-risk systems are the same; only the date moved. Transparency duties and the prohibitions were not postponed.
What to do now
- Build an AI inventory. List every AI system you develop or use, including AI features inside third-party software.
- Classify each system. Prohibited, high-risk (Annex III or Annex I), transparency obligations only, or minimal risk.
- Close transparency gaps. Chatbots and generated content already have disclosure duties.
- Start high-risk work early. Risk management (Article 9), data governance, technical documentation, logging, human oversight and accuracy, robustness and cybersecurity (Article 15) take months to put in place.
- Test security and robustness. Adversarial testing such as LLM security testing gives you evidence for Article 15.
- Consider a management system. ISO/IEC 42001 gives AI governance a structure auditors recognise.
Penalties
Fines for the most serious breaches, the prohibited practices, can reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Lower ceilings apply to other obligations.
Use the extra time well
December 2027 sounds far away, but conformity work for a high-risk system involves several teams and many documents. Companies that use the extra time to build governance and testing into their development process will be ready without a last-minute rush.
Setexe helps companies classify their AI systems, build practical governance and test AI security. See our AI security and governance services or book a free consultation.
