Reference · European Union
EU AI Act Obligations and Dates After the Digital Omnibus
Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved the EU AI Act's high-risk obligations to 2 December 2027 for systems classified as high-risk under Annex III and to 2 August 2028 for systems classified under Annex I.Digital Omnibus · Art. 1(40) It entered into force on 27 July 2026, the third day after its publication in the Official Journal on 24 July 2026.Digital Omnibus · Art. 4 The rest of the schedule in Article 113 of Regulation (EU) 2024/1689 stands.AI Act · Art. 113
Key dates
| Date | What applies | Article |
|---|---|---|
| 2 February 2025 | Prohibited practices; AI literacy | Art. 5, Art. 4 |
| 2 August 2025 | General-purpose AI model obligations, governance, penalties | Chapter V, Art. 99 |
| 2 August 2026 | General application; transparency obligations | Art. 50 |
| 2 December 2026 | New prohibitions on non-consensual intimate imagery and child sexual abuse material; output marking for systems placed on the market before 2 August 2026 | Art. 5(1)(ba), (bb); Art. 50(2) |
| 2 December 2027 | Annex III high-risk obligations, including deployer duties and the impact assessment | Art. 26, Art. 27 |
| 2 August 2028 | Annex I product-embedded high-risk obligations | Art. 6(1), Annex I |
Banks, insurers and employers are mostly deployers
The Act applies to providers that place AI systems or general-purpose AI models on the EU market wherever they are established, to deployers established or located in the EU, and to providers and deployers in third countries where the system's output is used in the EU.AI Act · Art. 2(1) An organization that licenses a system and puts it to work is a deployer. It takes on a provider's obligations if it puts its name or trademark on a high-risk system, makes a substantial modification to one, or changes a system's intended purpose so that it becomes high-risk.AI Act · Art. 25(1)
Annex III lists the uses treated as high-risk, and three points cover most financial and employment use. Point 4 covers recruitment and selection, decisions on promotion and termination, task allocation, and monitoring of performance and behaviour at work. Point 5(b) covers evaluating the creditworthiness of natural persons or establishing their credit score, except systems used to detect financial fraud. Point 5(c) covers risk assessment and pricing for natural persons in life and health insurance.AI Act · Annex III
Bans and AI literacy have applied since 2 February 2025
The prohibited practices in Article 5 have applied since 2 February 2025, with the rest of Chapters I and II.AI Act · Art. 113(a) The Omnibus adds two prohibitions: systems that generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without that person's explicit consent, and systems that generate child sexual abuse material. Both apply from 2 December 2026.Digital Omnibus · Art. 1(7), 1(40)
The Omnibus also rewrote Article 4. Providers and deployers now take measures to support the development of AI literacy among their staff and the other people who operate and use AI systems on their behalf, and the article states that the duty does not require any specific level of literacy in any individual. The replaced text asked for measures to ensure, to their best extent, a sufficient level of AI literacy.Digital Omnibus · Art. 1(5)AI Act · Art. 4
General-purpose AI rules and penalties have applied since 2 August 2025
Chapter V, the obligations on providers of general-purpose AI models, has applied since 2 August 2025, together with the chapters on governance and penalties. The fines for providers of general-purpose AI models in Article 101 are the exception and apply from 2 August 2026.AI Act · Art. 113(b)
Member States set penalties within the ceilings in Article 99: up to EUR 35 million or 7% of total worldwide annual turnover for a prohibited practice, and up to EUR 15 million or 3% for breaching most other obligations, a deployer's duties under Article 26 among them, whichever is higher in each case.AI Act · Art. 99(3), (4) For SMEs the lower of the two applies. The Omnibus extends the lower figure to small mid-cap enterprises for the two smaller tiers.Digital Omnibus · Art. 1(38)
Bars
EU AI Act fine ceilings, by type of infringement
Transparency duties have applied since 2 August 2026
2 August 2026 is the Act's general application date, and the Omnibus kept it. From that date, providers of systems that interact directly with natural persons must ensure those persons are informed they are interacting with an AI system; providers of systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format and make them detectable as artificially generated; and deployers of systems that generate deep fakes must disclose that the content was artificially generated or manipulated. The information is due at the latest at the first interaction or exposure.AI Act · Art. 50(1), (2), (4), (5)
Providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the marking requirement.Digital Omnibus · Art. 1(39)
The Omnibus moved the high-risk regime to 2 December 2027 and 2 August 2028
Before the Omnibus, the high-risk obligations for Annex III systems applied from the general application date, 2 August 2026, and those for systems classified under Article 6(1) from 2 August 2027. Article 6(1) covers AI that is a safety component of a product, or is itself a product, under the Union harmonisation legislation listed in Annex I and that must undergo third-party conformity assessment.AI Act · Art. 6(1), 113(c)
The Omnibus replaced Article 113(c). Sections 1, 2 and 3 of Chapter III, other than Article 6(5), now apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.Digital Omnibus · Art. 1(40) Those sections hold the classification rules, the requirements for high-risk systems, Article 12 logging among them, and the obligations of providers and deployers.
Before and after
What the Omnibus moved, and what it left alone
What a deployer of a credit, insurance or hiring system must do from 2 December 2027
The Omnibus changed the date of the deployer duties and left their substance largely as written. A deployer of an Annex III system must:
- Use the system in accordance with the provider's instructions for use, through appropriate technical and organisational measures.AI Act · Art. 26(1)
- Assign human oversight to natural persons with the necessary competence, training and authority, and the support to exercise it.AI Act · Art. 26(2)
- Monitor the system's operation against the instructions for use. Where use may present a risk, inform the provider or distributor and the market surveillance authority and suspend use; report a serious incident first to the provider. A financial institution subject to internal governance rules under Union financial services law meets the monitoring duty by complying with those rules.AI Act · Art. 26(5)
- Keep the logs the system generates, to the extent they are under the deployer's control, for a period suited to the intended purpose and of at least six months, unless Union or national law provides otherwise. A financial institution keeps them as part of the documentation its financial services law requires.AI Act · Art. 26(6)
- Before using a high-risk system at the workplace, inform workers' representatives and the affected workers.AI Act · Art. 26(7)
- Inform natural persons that they are subject to a high-risk system that makes, or assists in making, decisions about them.AI Act · Art. 26(11)
- For lenders and life and health insurers using Annex III point 5(b) or 5(c) systems, and for public bodies and private entities providing public services, carry out a fundamental rights impact assessment before first use and notify the market surveillance authority of the results.AI Act · Art. 27(1), (3) As amended, the assessment may cross-refer to an existing data protection impact assessment.Digital Omnibus · Art. 1(13)
Systems already in service come under the Act through significant design changes
As amended, Article 111(2) applies the Act to operators of high-risk systems placed on the market or put into service before the Chapter III application date only if those systems are subject to significant changes in their design from that date. Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 in any case.Digital Omnibus · Art. 1(39)
For an Annex III system, that date is 2 December 2027. A deployer that cannot show when a system went into service, and what has changed in its design since, cannot show which side of the line the system sits on.
Sandboxes and bias-detection data moved too
- Each Member State's national AI regulatory sandbox must be operational by 2 August 2027, a year later than the original 2 August 2026.Digital Omnibus · Art. 1(22)AI Act · Art. 57(1)
- A new Article 4a lets providers of high-risk systems process special categories of personal data where strictly necessary to detect and correct bias, under listed safeguards, and extends the same permission, under the same conditions, to providers and deployers of other AI systems and models and to deployers of high-risk systems. The provision it replaces, Article 10(5), covered providers of high-risk systems only. Article 4a creates no obligation to carry out such bias detection.Digital Omnibus · Art. 1(6), 1(9)
Control mapping
What a reviewer expects to be able to see.
| Obligation | What the system must do | Evidence a reviewer expects |
|---|---|---|
| Classification (Annex III) | Map every AI system in use to a tier, and record the provider-or-deployer determination for each | Inventory with tier, role, Annex III point, and the dated rationale |
| AI literacy (Art. 4) | Take measures supporting the AI literacy of staff and others operating AI on the organization's behalf | Program description, coverage of the people using AI, and delivery records |
| Transparency (Art. 50) | Disclose AI interaction, mark synthetic output, and label deep fakes on customer-facing surfaces | Disclosure text, marking implementation, and the surfaces they cover |
| Logs (Art. 12, 26(6)) | Retain the logs a high-risk system generates for at least six months, or longer where other law requires | Retention policy per system and the retained log record itself |
| Human oversight (Art. 14, 26(2)) | Name the people overseeing each high-risk system and show they have authority to intervene | Oversight assignments, training records, and intervention records |
| Impact assessment (Art. 27) | Complete a fundamental rights impact assessment before first use of a credit-scoring or insurance-pricing system | The assessment, its date, and the notification to the market surveillance authority |
| Systems in service (Art. 111(2)) | Know when each high-risk system went into service and record significant changes to its design | Service dates and a dated change record per system |
Full timeline
Timeline, drawn to scale
EU AI Act: what applies when, after the Digital Omnibus
- 1 August 2024Regulation (EU) 2024/1689 enters into force.
- 2 February 2025Chapters I and II apply: prohibited practices (Article 5) and AI literacy (Article 4).
- 2 August 2025General-purpose AI model obligations (Chapter V), governance, and penalties apply.
- 8 July 2026Digital Omnibus on AI (Regulation (EU) 2026/1744) adopted.
- 24 July 2026Digital Omnibus published in the Official Journal.
- 27 July 2026Digital Omnibus enters into force.
- 2 August 2026General application date; Article 50 transparency obligations apply.
- 2 December 2026Article 50(2) marking applies to systems placed on the market before 2 August 2026; the new Article 5 prohibitions on non-consensual intimate imagery and child sexual abuse material apply.
- 2 August 2027National AI regulatory sandboxes must be operational.
- 2 December 2027Annex III high-risk obligations apply (moved from 2 August 2026).
- 2 August 2028Annex I product-embedded high-risk obligations apply (moved from 2 August 2027).
- 2 August 2030High-risk systems intended for use by public authorities that were in service before the Chapter III date must comply.
Sources cited
Common gaps
Where deployers most often misread the schedule.
- Reading the deferral as a pause on everything. The Omnibus moved the high-risk dates. Article 4, Article 5, Chapter V and Article 50 were binding before it was published and remain so.
- No classification on file. Until each system is mapped to a tier, the organization cannot say which obligations it carries or when they arrive. A dated classification record is the document every later obligation depends on.
- A customer chatbot without disclosure. Article 50(1) has applied since 2 August 2026. A support assistant that presents as a person is a finding visible from a screenshot.
- Logs that start in 2027. Article 26(6) sets a minimum retention period and no start date. A deployer that starts logging in November 2027 arrives at the application date with weeks of history.
- Becoming a provider by accident. Putting the organization's name on a high-risk system, modifying it substantially, or changing its intended purpose shifts the organization into the provider role under Article 25(1). Record the decision either way.
- No change record for systems already in service. Under Article 111(2), a high-risk system in service before its Chapter III date comes under the Act once its design changes significantly. Without a dated change record the question cannot be answered.
Related
Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.