# EU AI Act Deadlines: What Buyers Need to Know

The EU AI Act applies in stages from 2025 to 2030. The Digital Omnibus on AI moved the main high-risk dates to 2 December 2027 and 2 August 2028. Here are the dates, the risk tiers and the fines.

Updated 2026-10-29. Also on the [web page](https://aigovernancetools.fyi/guides/eu-ai-act-deadlines-what-buyers-need-to-know).

The EU AI Act is Regulation (EU) 2024/1689. It does not apply all at once. Different rules start on different dates. In 2026 the EU changed some of those dates. This guide gives the current dates for a buyer of AI governance software.

This guide is general information. It is not legal advice.

## The risk tiers

The Act sorts AI systems by risk ([artificialintelligenceact.eu, high-level summary](https://artificialintelligenceact.eu/high-level-summary/)):

| Tier | What it means | Examples |
| --- | --- | --- |
| Unacceptable risk | Prohibited | Social scoring, manipulative AI, emotion recognition in the workplace |
| High risk | Strict requirements, mostly for providers | Recruitment, credit scoring, education access, critical infrastructure |
| Limited risk | Transparency duties | Chatbots, deepfakes |
| Minimal risk | No specific duties | Most other AI |

General-purpose AI (GPAI) models have their own rules. Providers of GPAI models must keep technical documentation, comply with EU copyright law and publish a summary of their training content.

Most duties fall on **providers**, who develop the system. **Deployers**, who use it in a professional capacity, have fewer duties. If you buy AI, you are usually a deployer. If you build AI and sell it under your name, you are a provider.

## The Digital Omnibus on AI

The Commission proposed the Digital Omnibus on AI in November 2025. The Parliament and the Council adopted it. It was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 of 8 July 2026. It entered into force on 27 July 2026 ([Cuatrecasas, 24 July 2026](https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published); [artificialintelligenceact.eu](https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/)). It is adopted law, not a proposal.

The main changes for buyers ([Orrick, 29 July 2026](https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes)):

- Annex III high-risk rules moved from 2 August 2026 to 2 December 2027.
- Annex I high-risk rules (AI in regulated products) moved from 2 August 2027 to 2 August 2028.
- Two new prohibitions: AI that generates non-consensual intimate imagery, and AI that generates child sexual abuse material. They apply from 2 December 2026.
- A new legal basis to process special category data to detect and correct bias, under a "strict necessity" test.
- SME relief now also covers "small mid-cap" companies.
- The AI literacy duty stays, but in a softer form. Providers and deployers must "take measures to support" AI literacy of their staff ([Article 4](https://artificialintelligenceact.eu/article/4/)).

## Key dates

From the [implementation timeline](https://artificialintelligenceact.eu/implementation-timeline/) and [Article 113](https://artificialintelligenceact.eu/article/113/), as amended:

| Date | What applies |
| --- | --- |
| 1 August 2024 | The Act enters into force. No duties yet. |
| 2 February 2025 | Prohibited practices and AI literacy (Chapters I and II) |
| 2 August 2025 | GPAI model rules, governance, notified bodies, penalties |
| 27 July 2026 | The Digital Omnibus on AI enters into force |
| 2 August 2026 | Most remaining rules, including Article 50 transparency |
| 2 December 2026 | New prohibitions on intimate imagery and CSAM. Watermarking (Article 50(2)) for generative systems placed on the market before 2 August 2026. |
| 2 August 2027 | GPAI models placed on the market before 2 August 2025 must comply |
| 2 December 2027 | High-risk rules for Annex III systems |
| 2 August 2028 | High-risk rules for Annex I systems |
| 2 August 2030 | High-risk systems used by public authorities must comply |

A high-risk system placed on the market before its date is covered only if its design changes significantly after that date.

## What deployers of high-risk AI must do

[Article 26](https://artificialintelligenceact.eu/article/26/) lists deployer duties. They include:

- Use the system as the provider's instructions say.
- Assign human oversight to people with the right competence, training and authority.
- Make sure the input data you control is relevant and sufficiently representative.
- Monitor the system. Tell the provider and the authority about risks and serious incidents.
- Keep the logs under your control for at least six months, unless other law says otherwise.
- As an employer, tell workers before you use a high-risk system at the workplace.

## Penalties

[Article 99](https://artificialintelligenceact.eu/article/99/) sets the maximum fines:

| Breach | Maximum fine |
| --- | --- |
| Prohibited practice (Article 5) | EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher |
| Most other duties, including deployer duties and Article 50 transparency | EUR 15,000,000 or 3%, whichever is higher |
| Incorrect or misleading information to authorities | EUR 7,500,000 or 1%, whichever is higher |

For SMEs, the lower of the two amounts applies. After the Omnibus, small mid-caps also get the lower amount for the second and third rows. Try the [EU AI Act penalty calculator](/tools/eu-ai-act-penalty-calculator) to see the ceiling for your turnover.

## What to do now

1. Make an inventory of every AI system you build or buy.
2. Mark each one as prohibited, high-risk, limited-risk or minimal-risk.
3. Check Article 50 transparency now. It already applies.
4. Plan high-risk work for 2 December 2027. Do not wait for the last year.
5. Read [how to choose an AI governance platform](/guides/how-to-choose-an-ai-governance-platform) before you buy tools.

## Sources

- [Implementation Timeline](https://artificialintelligenceact.eu/implementation-timeline/), artificialintelligenceact.eu (Future of Life Institute), last updated 31 August 2026, accessed 2026-10-29
- [Article 113: Entry into Force and Application](https://artificialintelligenceact.eu/article/113/), artificialintelligenceact.eu, accessed 2026-10-29
- [Article 99: Penalties](https://artificialintelligenceact.eu/article/99/), artificialintelligenceact.eu, accessed 2026-10-29
- [Article 4: AI literacy](https://artificialintelligenceact.eu/article/4/), artificialintelligenceact.eu, accessed 2026-10-29
- [Article 26: Obligations of Deployers of High-Risk AI Systems](https://artificialintelligenceact.eu/article/26/), artificialintelligenceact.eu, accessed 2026-10-29
- [High-level summary of the AI Act](https://artificialintelligenceact.eu/high-level-summary/), artificialintelligenceact.eu, updated 31 August 2026, accessed 2026-10-29
- [Digital Omnibus on AI (Regulation (EU) 2026/1744)](https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/), artificialintelligenceact.eu, accessed 2026-10-29
- [Digital Omnibus on AI has been published](https://www.cuatrecasas.com/en/global/intellectual-property/art/digital-omnibus-ai-has-been-published), Cuatrecasas, 24 July 2026, accessed 2026-10-29
- [EU AI Act Update: Digital Omnibus Finalizes 8 Compliance Changes](https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes), Orrick, 29 July 2026, accessed 2026-10-29

## Questions

### Did the high-risk deadline move from 2 August 2026?

Yes. Regulation (EU) 2026/1744, the Digital Omnibus on AI, is adopted law. It was published in the Official Journal on 24 July 2026. High-risk systems under Annex III now apply from 2 December 2027. High-risk systems in products under Annex I now apply from 2 August 2028.

### Which parts of the Act already apply?

The prohibited practices and the AI literacy rules have applied since 2 February 2025. The rules for general-purpose AI models, governance and penalties have applied since 2 August 2025. Most of the remaining rules, including the Article 50 transparency rules, have applied since 2 August 2026.

### What is the highest fine?

For a prohibited practice, the fine can be up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. SMEs pay whichever is lower.

### Does the Act apply to a company outside the EU?

It can. It applies to providers that place high-risk AI systems on the EU market and to deployers outside the EU when the output of the AI system is used in the EU.