EU AI Act: what applies now, as high-risk rules slip to 2027

Key takeaways

• The EU AI Act has applied in general since August 2, 2026. Transparency duties for chatbots and deepfakes, the rules for general-purpose AI (GPAI) models and the AI Office's enforcement powers are all live.
• The "Digital Omnibus on AI," Regulation (EU) 2026/1744, entered into force on July 27, 2026. It delayed the high-risk rules to December 2, 2027 for areas such as hiring, education and credit, and to August 2, 2028 for AI built into regulated products.
• Two deadlines arrive on December 2, 2026: a ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material, and the last date for older generative AI systems to mark their output as AI-generated.
• Maximum fines are unchanged: up to €35 million or 7% of worldwide annual turnover for banned practices, and up to €15 million or 3% for GPAI providers, whichever is higher.
• According to PPC Land, on October 12 the Commission opened a consultation, running until November 9, on how the AI Office will run fining proceedings against AI systems it supervises directly.

The EU AI Act has applied in general since August 2, 2026: transparency duties for chatbots and deepfakes, rules for general-purpose AI models and the AI Office's enforcement powers are live. The Digital Omnibus delayed high-risk rules to December 2, 2027 and August 2, 2028.

This explainer sets out what applies today, what changed, who is affected and what it means for users and companies inside and outside the EU.

Background: a law in stages

The AI Act entered into force on August 1, 2024, and was designed to apply in stages. A first group of prohibited practices, such as certain manipulative AI systems and social scoring, and a duty on AI literacy, applied from February 2, 2025. Obligations for providers of general-purpose AI models, the large models behind chatbots and coding assistants, followed on August 2, 2025. The general application date was August 2, 2026.

In November 2025, the Commission proposed a "Digital Omnibus" to simplify parts of its digital rulebook, including the AI Act. Negotiators reached a political agreement on May 7, 2026. The AI part was published in the EU's Official Journal on July 24 as Regulation (EU) 2026/1744 and entered into force on July 27, 2026, according to the Commission and the law firm Cooley.

The timeline as it stands

Sources: European Commission AI Act policy page; AI Act Service Desk text of Article 113 as amended; Cooley analysis of Regulation (EU) 2026/1744.

What the Omnibus changed

High-risk rules delayed. The most demanding obligations, covering risk management, data quality, documentation and human oversight for high-risk systems, were due on August 2, 2026 for stand-alone systems. They now apply from December 2, 2027, a 16-month delay. Rules for AI used as safety components in regulated products moved from August 2027 to August 2028.

Transparency not delayed. Article 50 duties for new systems still applied from August 2, 2026: people must be told when they are interacting with an AI system, and deepfakes must be labeled. Providers of generative systems already on the market before that date get a grace period until December 2, 2026 to machine-mark their output.

New prohibitions. The Omnibus added bans on AI systems that generate or manipulate non-consensual intimate imagery and on systems that generate child sexual abuse material. According to Cooley, providers are caught where this is the intended purpose or a reasonably foreseeable outcome without adequate safeguards; deployers are caught when they use a system to produce such material. There is no exemption for systems already on the market.

Lighter load for smaller firms. Relief that the Act already gave small and medium-sized enterprises was extended to "small mid-caps," which can file simplified technical documentation and, when fined, face the lower rather than the higher of the percentage and fixed caps.

AI literacy softened. The original text required providers and deployers to ensure their staff had sufficient AI literacy. The amended version reframes this as an obligation on the Commission and member states to support and facilitate it.

More power for the AI Office. The Commission's AI Office gains exclusive supervisory competence over AI systems built on a general-purpose model when the system and the model come from the same provider or group, and over AI systems integrated into designated very large online platforms and search engines. National authorities keep the lead in sensitive sectors such as law enforcement and finance. Some public bodies are setting their own limits: Sweden's Government Offices will block ChatGPT and Claude on staff computers from 26 October.

Registration kept. The Commission had proposed dropping the requirement to register certain self-assessed systems in the EU database. According to Cooley, lawmakers rejected that idea; providers must still register, though they can use a simplified procedure.

The fines

Sources: AI Act text of Articles 99 and 101 via artificialintelligenceact.eu; Omnibus changes via artificialintelligenceact.eu.

The Commission's power to fine GPAI providers under Article 101 was held back when the other penalty provisions took effect in 2025; it appears to apply from August 2, 2026 under Article 113. What is still missing is the detailed procedure for the AI systems the AI Office supervises directly. According to PPC Land, on October 12 the Commission published a draft implementing regulation on Articles 75c and 75d, the provisions on fines, limitation periods and access to the file that the Omnibus inserted. The same detailed report says the draft sets five-year limitation periods for imposing and enforcing fines, which can restart with certain investigative steps up to a ten-year cap, limits full file access to named external advisers, and requires digital submissions with qualified electronic signatures. Feedback is open until November 9, and adoption is planned for the fourth quarter of 2026.

What changes for users

• Chatbots must say they are AI. When you interact with an AI system that is not obviously one, you should be told.
• Deepfakes must be labeled, and from December 2, 2026 output from older generative systems should carry machine-readable marking.
• "Nudify" apps become illegal in the EU from December 2, 2026.
• Hiring and credit decisions: the stronger protections for AI used in recruitment, education or creditworthiness assessments will not apply until December 2027.

Impact: what it means for companies

Big AI developers face the most immediate exposure. GPAI obligations have applied for over a year, the Commission can now fine, and the AI Office's direct supervision of products built on its own models, such as assistants offered by the same company, puts both model and product under one regulator. The procedural rules now out for consultation will determine how those cases run.

Companies using AI in HR, education or lending gained time, but not an exemption. December 2027 is roughly 13 months away, and conformity work, documentation and risk management take time to build. Treating the delay as a reprieve rather than a reason to stop is the safer course.

Generative AI providers have a hard deadline in six weeks: December 2 for output marking on legacy systems and for the new prohibitions. Image and video tools with weak safeguards are most at risk under the "reasonably foreseeable" test. New entrants such as Canva's first in-house AI image model, Craft, will need marking in place for EU users, and platforms are writing their own rules too: Etsy now bans AI-generated recipes and patterns from its marketplace.

Healthcare AI is another area to watch. Studies such as the one in which a Microsoft AI diagnostic tool outperformed generalist doctors show how quickly clinical tools are maturing, and AI built into regulated products such as medical devices falls under the Annex I high-risk rules, which apply from August 2, 2028 according to the timeline above.

Non-EU companies are covered if they place AI systems on the EU market or their output is used in the EU, so US and Asian providers face the same dates. For smaller firms, the expanded small mid-cap relief lowers the cost of compliance and caps fines at the lower figure.

What remains uncertain: harmonized standards, Commission guidelines on several high-risk provisions and the final form of the procedural rules are still being written. Several deadlines for that guidance fall in 2027.

Sources

• European Commission: AI Act policy page and timeline
• European Commission AI Act Service Desk: Article 113 (as amended)
• Cooley: Digital AI Omnibus delays key deadlines, introduces new rules
• artificialintelligenceact.eu: Digital Omnibus on AI
• artificialintelligenceact.eu: Article 99, Penalties
• artificialintelligenceact.eu: Article 101, Fines for GPAI providers
• PPC Land: EU draft lets AI Office restart five-year fining clock