EU AI Act Timeline 2024–2028: Every Deadline After the Digital Omnibus
The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since 27 July 2026 — rewrote Article 4 and pushed the high-risk deadlines back by one year. Most AI Act content published before July 2026 quotes dates that are now wrong. This is the corrected timeline, with the legal basis for each row.
The full deadline table (consolidated, September 2026)
| Date | What applies | Legal basis |
|---|---|---|
| 1 Aug 2024 | AI Act entered into force | Reg. (EU) 2024/1689 |
| 2 Feb 2025 | Prohibited practices (Art. 5) + Article 4 AI literacy duty start applying | Reg. 2024/1689 Art. 113 |
| 2 Aug 2025 | GPAI model obligations (Art. 53) + governance chapter apply | Reg. 2024/1689 |
| 8 Jul 2026 | Digital Omnibus on AI adopted | Reg. (EU) 2026/1744 |
| 24 Jul 2026 | Omnibus published in the Official Journal | Reg. (EU) 2026/1744 |
| 27 Jul 2026 | Omnibus in force — Article 4 fully rewritten; high-risk dates moved | Reg. (EU) 2026/1744 Art. 1(5) |
| 2 Aug 2026 | Article 50(1) transparency: anyone deploying AI that interacts directly with people (yes, your website chatbot) must design it so the person knows they are talking to a machine. Penalties chapter fully applicable. | Reg. 2024/1689 Art. 50, Art. 113 |
| 2 Dec 2026 | Article 50(2) synthetic-content marking for systems placed on the market before 2 Aug 2026 (Art. 111(4) transition); new Article 5 prohibitions | Reg. 2024/1689 as amended |
| 2 Aug 2027 | Member State regulatory sandboxes operational | Reg. 2024/1689 as amended |
| 2 Dec 2027 | High-risk obligations, Annex III (standalone: biometrics, critical infrastructure, education, employment, essential services incl. credit scoring, law enforcement, migration, justice) — moved from 2 Aug 2026 by the Omnibus | Reg. (EU) 2026/1744 |
| 2 Aug 2028 | High-risk obligations, Annex I (AI as safety component in products under existing EU product law) — moved from 2 Aug 2027 by the Omnibus | Reg. (EU) 2026/1744 |
What the Omnibus changed, in one paragraph
Regulation (EU) 2026/1744 did three things that matter to operators. One: it replaced Article 4 in full — the AI literacy duty survives, but as an obligation of effort ("take measures to support the development of AI literacy") instead of an obligation of result ("ensure a sufficient level"), and it now states explicitly that no specific level of literacy must be guaranteed for any individual. Two: it delayed the high-risk regime by one year on both routes (Annex III → 2 Dec 2027, Annex I → 2 Aug 2028). Three: it tasked the Commission with publishing practical compliance examples on the Article 62 single information platform, with particular regard to SMEs.
Why the delay is a trap, not a relief
A realistic compliance programme for a single high-risk system takes 12–24 months: 3–6 months gap assessment and QMS design, 6–12 months technical documentation (Annex IV), data governance and conformity assessment, 3–6 months EU database registration and CE marking. Against the 2 December 2027 deadline, a programme starting in late 2026 is inside the window with no slack — and notified-body capacity tightens as the date approaches. Organizations treating December 2027 as "far away" are the ones who will be queuing for assessment slots in 2027.
Which AI Act deadlines have already passed as of September 2026?
Three: prohibited practices and the Article 4 AI literacy duty (2 February 2025), GPAI obligations (2 August 2025), and Article 50(1) transparency for interactive AI (2 August 2026). If you run any AI system in the EU today, at least one of these applies to you right now — most deployers are already under the literacy and transparency duties.
Does the Digital Omnibus repeal the AI Act?
No. Regulation (EU) 2026/1744 amends Regulation (EU) 2024/1689. The risk-tier architecture, the Annex III high-risk categories, the provider/deployer split, the penalty regime (up to €35M or 7% of global turnover for prohibited practices; €15M or 3% for most other violations) all stand. What changed: Article 4's wording, the high-risk application dates, and new support mechanisms for SMEs.
Is my website chatbot affected by Article 50?
Yes, since 2 August 2026. Article 50(1) requires that AI systems intended to interact directly with natural persons be designed so those persons know they are interacting with a machine, unless it is obvious to a reasonably well-informed person. An ordinary support chatbot counts. Disclosure must be clear, at first interaction, and accessible.
The action sequence for deployers (most companies)
- Inventory every AI system you develop or use — including AI features inside SaaS you bought. You cannot classify what you haven't listed.
- Fix your role per system: provider or deployer (Art. 3). Watch the Art. 25 trap — rebranding, substantially modifying, or repurposing a system makes you the provider with the full conformity burden.
- Check Art. 5 first: if any system touches a prohibited practice (social scoring, workplace emotion recognition, manipulative techniques), it must stop — that deadline passed in February 2025.
- Meet the duties that bind today: Article 4 literacy measures (documented, role-appropriate) and Article 50 transparency.
- Classify against Annex III / Annex I and, if high-risk, start the 12–24 month programme now — classification decisions are the single most audited artefact, so record the category, reasoning, evidence, date and accountable person.
Sources
- Regulation (EU) 2024/1689 (EUR-Lex) — the AI Act
- Regulation (EU) 2026/1744 (EUR-Lex) — Digital Omnibus on AI, adopted 8 July 2026, published OJ 24 July 2026, in force 27 July 2026; replaced Article 4 in full (Art. 1 point 5)
- European Commission AI literacy guidance and Article 62 single information platform
- regulatoryai.eu, dsak.tech, aiactinsight.eu, complipath.io — cross-checked deadline analyses (August–September 2026)
LuminaAct (a MonAItize division) classifies your AI systems into the correct risk tier and documents obligations with article-level citations: www.luminaact.eu. Last updated: 22 September 2026.