Regulation (EU) 2024/1689 timeline: what applies and when, after the Omnibus

The Regulation (EU) 2024/1689 timeline runs in stages. The Regulation entered into force on August 1, 2024, and in July 2026 the EU changed several of its dates with the "Digital Omnibus", Regulation (EU) 2026/1744, which entered into force on July 27, 2026. This guide sets out what applies now and what comes next, with the article for each rule, from the texts published in the Official Journal and checked on October 1, 2026.

It is general information, not legal advice. If your company builds or sells systems that could be high-risk, talk to a lawyer who knows the regulation.

Timeline: what applies and when

The two high-risk dates are the main change made by the Omnibus. They were originally August 2, 2026 for Annex III systems and August 2, 2027 for Annex I. The Omnibus's own recitals say that keeping the original date risked "a significant increase in implementation costs" because the supporting standards and tools were not ready.

Who has obligations

The regulation assigns duties by role:

• Providers develop a system or model covered by the Regulation and place it on the market under their name. Most obligations fall on them.
• Deployers use such a system under their own authority in a professional activity. A company that uses a chatbot such as ChatGPT or Claude at work, or runs a chatbot for its customers, is a deployer; if it builds an agent on top of a model, it may be a provider too, depending on what it puts on the market under its own name.
• Importers and distributors have their own, lighter obligations.

What applies to most businesses using these systems today

Staff literacy (Art. 4). As amended by the Omnibus, providers and deployers must take measures to support the literacy of their staff, and of others who use these systems on their behalf, in how the systems work, considering their knowledge and the context of use. The amended text adds that this does not require them to guarantee any specific level for any individual. In practice: training and guidance proportionate to how your people use these tools.

Transparency (Art. 50), from August 2, 2026:

• Chatbots and other systems that talk to people: providers must design them so people are told they are interacting with a machine, unless that is obvious from the context.
• Generated content: providers of systems that generate synthetic audio, images, video or text must mark the output in a machine-readable format so it can be detected as machine-generated.
• Deepfakes: deployers that generate or manipulate image, audio or video "constituting a deep fake" must disclose it. For evidently artistic, satirical or fictional work, the duty is limited to disclosing it in a way that does not spoil the work.
• machine-written text about matters of public interest: deployers that publish machine-generated text "with the purpose of informing the public on matters of public interest" must disclose it, unless the text has gone through human review or editorial control and a person or company holds editorial responsibility for it.
• Emotion recognition and biometric categorisation: deployers must inform the people exposed to them.

The information must be given "in a clear and distinguishable manner", at the latest at the first interaction or exposure. Our guide to Article 50 of Regulation (EU) 2024/1689 goes through each of these duties and the Commission's reading of them.

The Omnibus did not change these duties: it only rewrote Article 50(7), on codes of practice, and gave older generative systems until December 2, 2026 to mark their output. The European Commission's questions and answers on Article 50 read the exception for machine-written text narrowly. Human review means "the deliberate examination of the substance of the content" by people with relevant knowledge; "spell-checking or grammatical correction" does not count; and a person must hold "the ultimate legal responsibility over the publication". The same page lists what it treats as matters of public interest, from politics and public health to "any economic, financial, political, scientific, or cultural developments that may be relevant subject of public debate".

Prohibited practices

Since February 2, 2025, Article 5 bans systems that:

1. use subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm;
2. exploit vulnerabilities due to age, disability or a specific social or economic situation;
3. score people on their social behaviour or personal traits, leading to unjustified or unrelated detrimental treatment;
4. predict the risk of a person committing a crime based solely on profiling or personality traits;
5. build facial recognition databases through untargeted scraping of facial images from the internet or CCTV;
6. infer emotions in the workplace or in education, except for medical or safety reasons;
7. categorise people by biometric data to infer race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation;
8. use real-time remote biometric identification in public spaces for law enforcement, except in narrowly defined cases.

From December 2, 2026, the Omnibus adds two more: systems that generate or manipulate realistic intimate images, video or audio of an identifiable person without their explicit consent, and systems that generate child sexual abuse material. For providers, the ban covers systems whose intended purpose is that output, and systems whose design makes it "a reasonably foreseeable and reproducible outcome" and that lack reasonable and adequate safeguards to prevent it. For deployers, it covers using a system for that purpose.

Penalties

Member states set the penalties within the regulation's limits. Breaching the prohibitions can cost up to €35 million or 7% of worldwide annual turnover, whichever is higher. Breaching most other obligations, including the transparency rules of Article 50 and deployers' obligations, can cost up to €15 million or 3%. The regulation requires penalties to take into account the interests and economic viability of small and medium-sized enterprises. For them, each fine is capped at whichever of the two figures is lower, not higher (Article 99(6)); the Omnibus extends that cap to small mid-cap companies for the fines in Article 99(4) and (5).

A short checklist

1. List where you use language models, from chat assistants (see Claude vs ChatGPT) to API integrations, and for each use whether you are a provider or a deployer.
2. Check Article 5 against anything that scores, profiles, monitors emotions or uses biometric data.
3. Put staff literacy measures in place: guidance and training matched to how each team uses these tools.
4. Label chatbots and machine-generated media from August 2, 2026, and keep records of how you do it.
5. Check whether any use is high-risk under Annex III (for example, recruitment, education, credit or essential services). If so, plan for December 2, 2027.

For how agents fit into this, including the security side, see agents for business.