This post sets out the EU AI Act application dates after the 2026 AI Omnibus, as the European Commission’s AI Act page states them. The page shows a last update of 3 August 2026, and as of 9 October 2026 it is the only source used here. We cover what applies when, what the Omnibus changed and who enforces the Act.
What is the AI Act application timeline?
The Commission page describes the AI Act as Regulation (EU) 2024/1689 laying down harmonized rules on artificial intelligence. It says the Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions. Prohibited AI practices and AI literacy obligations entered into application from 2 February 2025. The governance rules and the obligations for general-purpose AI (GPAI) models became applicable on 2 August 2025.
The page also lists the dates that follow from the AI Omnibus and the transparency rules. The block below restates them in order.
- 1 Aug 2024Entry into forceThe AI Act entered into force.
- 2 Feb 2025Prohibitions and AI literacyProhibited AI practices and AI literacy obligations entered into application.
- 2 Aug 2025GPAI and governanceGovernance rules and GPAI obligations became applicable.
- 19 Nov 2025AI OmnibusThe legislative proposal was adopted.
- 7 May 2026AI OmnibusA political agreement was reached.
- 27 Jul 2026AI OmnibusIt entered into force.
- 2 Aug 2026AI Act applicableApplicable with some exceptions. The AI Office and Member State authorities are responsible for enforcing it.
- Aug 2026Transparency rulesThe transparency rules come into effect.
- Dec 2026Prohibition 9It comes into effect, introduced as part of the AI Omnibus.
- 2 Dec 2027High-risk, Annex IIIRules for systems used in certain high-risk areas apply.
- 2 Aug 2028High-risk, Annex IRules for systems integrated into products apply.
What did the AI Omnibus change?
The Commission page says its Digital Package on Simplification proposed amendments to simplify AI Act implementation. The legislative proposal, called the AI Omnibus, was adopted on 19 November 2025. A political agreement was reached on 7 May 2026, and the Omnibus entered into force on 27 July 2026.
Besides the new dates, the page lists these amendments:
- A prohibition of AI systems that generate non-consensual sexually explicit and intimate content or child sexual abuse material, such as AI ‘nudification’ apps.
- Reinforced powers for the AI Office, and centralized oversight of AI systems built on GPAI models.
- Certain simplified requirements for small and medium-sized enterprises extended to small mid-cap companies, including simplified technical documentation requirements.
- Access to regulatory sandboxes for more innovators, including an EU-level sandbox.
- A clarified interplay between the AI Act and EU product safety laws, in particular the Machinery Regulation.
The page says prohibitions 1 to 8 became effective in February 2025. Prohibition 9, the one above, comes into effect in December 2026.
When do the high-risk rules apply after the Omnibus?
The page says the Omnibus sets a clear implementation timeline for high-risk AI systems. Rules for systems used in certain high-risk areas, including biometrics, critical infrastructure, education, employment, migration, asylum and border control, apply from 2 December 2027. For systems integrated into products such as lifts or toys, the rules apply from 2 August 2028. The page says this ensures the rules apply when companies have the right support tools, such as standards.
| Topic | Annex III areas | Annex I products |
|---|---|---|
| Applies from | 2 December 2027 | 2 August 2028 |
| What it covers | Certain high-risk areas, such as biometrics and employment | Systems integrated into products, such as lifts or toys |
The page says that from 2 December 2027 high-risk AI systems are subject to strict obligations before they can be put on the market. They include risk assessment and mitigation systems, high-quality datasets, logging of activity for traceability, detailed documentation, information for the deployer, human oversight, and a high level of robustness, cybersecurity and accuracy. For the wider set of rules that sit beside the AI Act, see our post on cyber security regulations security teams must know in 2026.
What applies from August 2026: transparency and enforcement?
The page says the transparency rules come into effect in August 2026. For chatbots, humans should be made aware that they are interacting with a machine. Providers of generative AI have to ensure that AI-generated content is identifiable. Certain content should be clearly and visibly labeled, namely deep fakes and text published to inform the public on matters of public interest.
The Commission lists two supporting documents. The Code of Practice on Marking and Labelling of AI-generated Content is a voluntary tool. The Guidelines on transparency obligations clarify the scope, definitions, obligations and exceptions.
On enforcement, the page says that from 2 August 2026 the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the Act. The AI Office holds enforcement powers over GPAI models. A Commission press release of 31 July 2026 says the AI Office, together with national authorities, begins enforcing the Act from 2 August 2026, and that chatbots and other interactive AI systems have to tell users they are dealing with AI, not a human. It can request technical documentation, evaluate models, require corrective measures and issue fines for non-compliance. The page’s news list also carries a 31 July 2026 press release titled “Commission starts enforcing AI Act rules and new transparency requirements on 2 August”. For other dated obligations to plan around, see our cyber compliance calendar for 2026 and 2027.
What does the July 2026 action plan on cybersecurity and AI say?
The page says the July 2026 action plan on Cybersecurity and AI sets out a coordinated approach to help Member States, businesses and public authorities address cybersecurity and resilience challenges posed by the most advanced AI models. It says the Commission will launch a call to increase EU evaluation capacity of AI models before they are placed on the EU market. The page says this is expected to be operational by 2027.
It adds that the Commission and the European Union Agency for Cybersecurity (ENISA) will also create a blueprint to secure access to advanced AI systems for cybersecurity purposes. They will establish a secure testing platform to help organizations in critical sectors, such as energy, transport, health, finance and public administration, safely test and deploy AI solutions. These are plans as the page states them, not completed work.
For what agencies report on AI-related threats, see AI cyber threats in 2026: what agencies report and threat intelligence priorities for 2027. For background on terms, our glossary has entries on AI agents and generative AI.
What questions do these dates raise?
The dates suggest some checks for your legal, risk and security teams. Which of your AI uses fall under the page’s four risk levels, and do any sit in the high-risk areas it lists? Do you provide or deploy generative AI whose output the transparency rules cover? Do you provide GPAI models, which the AI Office can evaluate? Does any product you make integrate an AI system, which the page places on the 2 August 2028 date? The page points readers with questions to the AI Act Single Information Platform and the AI Act Service Desk.
Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.
For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.