EU AI Act: what applies and when, after the 2026 Omnibus

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024, but its rules apply in stages. In July 2026 the EU changed several of those dates with the "Digital Omnibus on AI", Regulation (EU) 2026/1744, which entered into force on July 27, 2026. This guide sets out what applies now and what comes next, with the article for each rule, from the texts published in the Official Journal and checked on October 1, 2026.

It is general information, not legal advice. If your company builds or sells AI systems that could be high-risk, talk to a lawyer who knows the regulation.

Timeline: what applies and when

The two high-risk dates are the main change made by the Omnibus. They were originally August 2, 2026 for Annex III systems and August 2, 2027 for Annex I. The regulation's own recitals say that keeping the original date risked "a significant increase in implementation costs" because the supporting standards and tools were not ready.

Who has obligations

The regulation assigns duties by role:

• Providers develop an AI system or model and place it on the market under their name. Most obligations fall on them.
• Deployers use an AI system under their own authority in a professional activity. A company using an AI assistant or a chatbot for its customers is a deployer.
• Importers and distributors have their own, lighter obligations.

What applies to most businesses using AI today

AI literacy (Art. 4). As amended by the Omnibus, providers and deployers must "take measures to support the development of AI literacy" of their staff and others who use AI systems on their behalf, considering their knowledge and the context of use. The amended text adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". In practice: training and guidance proportionate to how your people use AI.

Transparency (Art. 50), from August 2, 2026:

• Chatbots and other systems that talk to people: providers must design them so people are told they are interacting with an AI system, unless that is obvious from the context.
• Generated content: providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format so it can be detected as AI-generated.
• Deepfakes: deployers that generate or manipulate image, audio or video "constituting a deep fake" must disclose it. For evidently artistic, satirical or fictional work, the duty is limited to disclosing it in a way that does not spoil the work.
• AI-written text about matters of public interest: deployers that publish AI-generated text "with the purpose of informing the public on matters of public interest" must disclose it, unless the text has gone through human review or editorial control and a person or company holds editorial responsibility for it.
• Emotion recognition and biometric categorisation: deployers must inform the people exposed to them.

The information must be given "in a clear and distinguishable manner", at the latest at the first interaction or exposure.

Prohibited practices

Since February 2, 2025, Article 5 bans AI systems that:

1. use subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm;
2. exploit vulnerabilities due to age, disability or a specific social or economic situation;
3. score people on their social behaviour or personal traits, leading to unjustified or unrelated detrimental treatment;
4. predict the risk of a person committing a crime based solely on profiling or personality traits;
5. build facial recognition databases through untargeted scraping of facial images from the internet or CCTV;
6. infer emotions in the workplace or in education, except for medical or safety reasons;
7. categorise people by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation;
8. use real-time remote biometric identification in public spaces for law enforcement, except in narrowly defined cases.

From December 2, 2026, the Omnibus adds two more: AI systems that generate or manipulate realistic intimate images, video or audio of an identifiable person without their explicit consent, and AI systems that generate child sexual abuse material. For providers, the ban covers systems whose intended purpose is that output, or whose design makes it "a reasonably foreseeable and reproducible outcome".

Penalties

Member states set the penalties within the regulation's limits. Breaching the prohibitions can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher. Breaching most other obligations, including the transparency rules of Article 50 and deployers' obligations, can cost up to €15 million or 3%. The regulation requires penalties to take into account the interests and economic viability of small and medium-sized enterprises.

A short checklist

1. List where you use AI, and for each use whether you are a provider or a deployer.
2. Check Article 5 against anything that scores, profiles, monitors emotions or uses biometric data.
3. Put AI literacy measures in place: guidance and training matched to how each team uses AI.
4. Label chatbots and AI-generated media from August 2, 2026, and keep records of how you do it.
5. Check whether any use is high-risk under Annex III (for example, recruitment, education, credit or essential services). If so, plan for December 2, 2027.

For how AI agents fit into this, including the security side, see AI agents for business.