import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689import { classify, obligations } from '@eu/ai-act'; // Regolamento (UE) 2024/1689

const system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenzaconst system = inventory.find((s) => s.name === 'chatbot-assistenza'); // art. 50: trasparenza

const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3const role = system.provider === company ? 'fornitore' : 'utilizzatore'; // art. 3

if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');

if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });

await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');await notice.show('Stai parlando con un assistente virtuale basato su AI');

await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });

const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41const decision = await human.review(cv); // D.Lgs. 179/2026, art. 41

await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });

const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99const fine = Math.min(35_000_000, revenue * 0.07); // PMI: il più basso, art. 99

await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42

await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13

export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });export default compliance.by({ design: true, deadline: '2027-12-02' });

import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });
import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });
import { classify, obligations } from '@eu/ai-act';                         // Regolamento (UE) 2024/1689
const system = inventory.find((s) => s.name === 'chatbot-assistenza');        // art. 50: trasparenza
const role = system.provider === company ? 'fornitore' : 'utilizzatore';      // art. 3
const risk = classify(system, { annexIII: true, profiling: false });          // art. 6
if (risk === 'vietato') throw new Error('Pratica vietata dal 2 febbraio 2025');
if (risk === 'alto') await obligations.highRisk(role, { from: '2027-12-02' });
await notice.show('Stai parlando con un assistente virtuale basato su AI');
await training.log({ team: 'marketing', topic: 'alfabetizzazione AI', art: 4 });
const decision = await human.review(cv);                                      // D.Lgs. 179/2026, art. 41
await workers.inform({ tool: system.name, legge: '132/2025', art: 11 });
const fine = Math.min(35_000_000, revenue * 0.07);                            // PMI: il più basso, art. 99
await dvr.add({ system: system.name, impatto: 'organizzazione del lavoro' }); // art. 42
await client.inform({ studio: true, strumenti: ['assistente di ricerca'] }); // art. 13
export default compliance.by({ design: true, deadline: '2027-12-02' });

EU AI Act

EU AI Act timeline:
every deadline after the Digital Omnibus

The EU AI Act deadlines that matter for companies are five: 2 February 2025 (bans and AI literacy), 2 August 2026 (transparency, enforcement and fines), 2 December 2026 (two new bans and the end of the grace period for marking AI content), 2 December 2027 (high-risk systems in Annex III) and 2 August 2028 (high-risk AI in regulated products).

This timeline reflects the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) and was checked against the official texts on 13 November 2026. It also covers legacy systems, public authorities, what the Commission still owes and a plan for each deadline.

By Cesare D'Adamo/Updated 13 November 2026/10 min read

Book a free consultation All guides

In this guide

01What are the EU AI Act deadlines?
02What happens on 2 December 2026?
03What did the Digital Omnibus delay, and what did it not?
04Do the rules apply to AI systems already on the market?
05What is still missing: guidelines, standards and sandboxes
06National deadlines: what Member States add
07How to prepare for each deadline: a 6-step plan
08Frequently asked questions

What are the EU AI Act deadlines?

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, but its obligations apply in stages set by Article 113. The general date is 2 August 2026: some parts started earlier, others come later. The dates are the same for non-EU companies in scope, for example those whose AI output is used in the EU.

2 Feb 2025Bans and AI literacy
2 Aug 2025General-purpose AI models, national authorities
2 Aug 2026Transparency, enforcement and fines
2 Dec 2026Two new bans, end of the marking grace period
2 Dec 2027High-risk rules, Annex III
2 Aug 2028High-risk AI in regulated products, Annex I
2 Aug 2030High-risk systems used by public authorities

EU AI Act application dates after the Digital Omnibus. Source: European Commission AI Act Service Desk, Articles 111 and 113, checked on 13 November 2026.

Date	What applies	Who is affected
2 February 2025	Prohibited practices (Article 5) and AI literacy (Article 4)	Everyone who develops or uses AI
2 August 2025	Obligations for general-purpose AI model providers; national authorities and penalty rules in place	Model providers, Member States
27 July 2026	Digital Omnibus (Regulation (EU) 2026/1744) in force	Everyone
2 August 2026	Transparency (Article 50), enforcement and fines, including for general-purpose AI models	Companies using chatbots, generated content or deepfakes; model providers
2 December 2026	Two new bans; machine-readable marking for generative systems already on the market	Providers and users of generative AI
2 August 2027	At least one AI regulatory sandbox per Member State; compliance for models placed on the market before 2 August 2025	Member States, model providers
2 December 2027	High-risk obligations for Annex III systems	Providers and deployers of AI for hiring, credit, education, essential services
2 August 2028	High-risk obligations for AI in regulated products (Annex I)	Makers of machinery, medical devices, toys and similar products
2 August 2030	Compliance for high-risk systems used by public authorities	Public bodies and their suppliers
31 December 2030	Compliance for AI in the large-scale EU IT systems of Annex X	Authorities running those systems

Since 2 August 2026 national authorities and the Commission's AI Office can enforce the rules already in application. Small businesses have the same dates, with lower fine caps: the tiers are explained in the EU AI Act guide for companies.

What happens on 2 December 2026?

On 2 December 2026 two new prohibitions added to Article 5 by the Digital Omnibus start to apply. The first covers AI systems that generate or manipulate realistic images, video or audio of an identifiable person's intimate parts or sexually explicit activities without that person's explicit consent. The second covers systems that generate child sexual abuse material.

For providers, the ban applies when that output is the system's intended purpose, or when it is a reasonably foreseeable and reproducible outcome and adequate safeguards are missing. For deployers, it applies when they use the system to produce that material. A general image generator with adequate safeguards therefore stays outside the ban.

The same day, the grace period for machine-readable marking ends. Since 2 August 2026, systems that generate audio, images, video or text must mark their output in a machine-readable format (Article 50(2)); providers whose systems were on the market before that date have until 2 December 2026 (Article 111(4)). The Commission published a voluntary Code of Practice on marking and labelling on 10 June 2026 and transparency guidelines on 20 July 2026.

If you only use third-party tools, ask your image and video vendors which safeguards they apply and how they mark output, and check that chatbot notices and deepfake labels are live. If you publish AI-assisted content to get cited by AI search, keep a named human editor in the loop.

What did the Digital Omnibus delay, and what did it not?

The Digital Omnibus on AI is Regulation (EU) 2026/1744. It was signed in Strasbourg on 8 July 2026, published in the Official Journal on 24 July and entered into force on 27 July 2026. It rewrote Article 113 on application dates and Article 111 on transitional rules.

Original 2024 textAfter the Digital Omnibus

High risk, Annex III2 August 20262 December 2027

High risk, Annex I2 August 20272 August 2028

New bans (Article 5)Not in the original textIntimate deepfakes and child abuse material, from 2 December 2026

Marking, existing systemsFrom 2 August 2026By 2 December 2026

AI literacy (Article 4)Ensure a sufficient levelTake supporting measures, no guaranteed level

Transparency (Article 50)2 August 20262 August 2026, unchanged

The dates changed by the Digital Omnibus. Source: Regulation (EU) 2026/1744 on EUR-Lex, read on 13 November 2026.

The original bans, AI literacy, transparency and enforcement kept their dates. Recital 2 of the Omnibus gives the reason for the delay: late technical standards and late national governance and conformity assessment structures.

Do the rules apply to AI systems already on the market?

Yes, with transitional rules in Article 111, partly rewritten by the Digital Omnibus. What matters is the type of system and the date it was placed on the market or put into service.

Case	Rule	Deadline
High-risk systems placed on the market before the application date	Covered only if their design changes significantly after that date	None, until a significant change
High-risk systems used by public authorities	Must comply in any case	2 August 2030
AI in large-scale EU IT systems (Annex X) placed on the market before 2 August 2027	Must comply	31 December 2030
General-purpose AI models placed on the market before 2 August 2025	Providers must comply	2 August 2027
Generative systems placed on the market before 2 August 2026	Machine-readable marking (Article 50(2))	2 December 2026

Under recital 39 of the Omnibus, the decisive date for high-risk systems is when the first unit of that type and model was placed on the market. Bans, AI literacy and transparency have no such exemption: they apply to tools you have used for years.

If you use a purchased HR or scoring tool, ask the vendor whether it was on the EU market before 2 December 2027 and which significant design changes are planned after that date. Do the same for AI agents that screen candidates or rank customers.

What is still missing: guidelines, standards and sandboxes

Part of the Commission's and Member States' homework is late, mostly on high risk. As of 13 November 2026:

High-risk classification guidelines: Article 6(5) required them by 2 February 2026. The Commission published a draft for consultation on 19 May 2026, and its page still shows the draft.
Harmonised standards: the Commission asked CEN and CENELEC for standards in ten areas, from risk management to cybersecurity. Its page, updated on 19 October 2026, lists one published so far: EN 18286 on quality management systems (Article 17), referenced by Implementing Decision (EU) 2026/2274 of 12 October 2026.
Regulatory sandboxes: each Member State must have at least one operational by 2 August 2027 (Article 57 as amended).
Post-market monitoring: the Commission must adopt a template for providers' monitoring plans by 2 September 2027 (Article 72(3)).

The practical rule: do not wait for standards to start. Your inventory, roles, AI literacy and transparency do not depend on any pending document. Technical documentation for high-risk systems is best built following the standards as they are published.

National deadlines: what Member States add

The AI Act is a regulation, so its dates apply directly in every Member State. Each country had to designate its authorities and set penalty rules by 2 August 2025, and some add their own rules, especially on employment. If you employ people in several EU countries, check each national law.

Italy shows how far national rules can go. Legislative Decree 179/2026, in force since 23 October 2026, adds four points that matter for companies.

Employment: the final decision on hiring, evaluations, disciplinary measures and dismissals must be taken by a person, or it is void (Article 41). AI that affects work organisation, pace or safety goes into the workplace risk assessment (Article 42).
Authorities: ACN is the market surveillance authority and single point of contact, AgID the notifying authority; the Bank of Italy, CONSOB and IVASS supervise high-risk AI in financial services.
Extra fine tier: up to EUR 1 million or 0.5% of turnover for breaches of the fundamental rights impact assessment (Article 27 of the AI Act) and the right to explanation (Article 86).
Professions: by 23 April 2027, professional bodies must add AI literacy and AI use to their training rules (Article 47).

How to prepare for each deadline: a 6-step plan

Most obligations for companies that use AI already apply, so your plan starts now, not in 2027.

01Now, inventory and roles: list every AI tool in use, including those staff use with personal accounts, and decide for each whether you are provider or deployer. Rule out prohibited practices, including the two new ones.
02Now, transparency: an AI notice at the start of every chat, labels on deepfakes, human review by an accountable editor for AI text on matters of public interest.
03Now, AI literacy and policy: role-based training with a record of dates and attendees, and a written policy on approved tools and data that must not be entered.
04By 2 December 2026: if you provide generative systems already on the market, finish machine-readable marking; if you use them, get written confirmation from vendors on marking and safeguards.
05During 2027: identify Annex III uses (hiring, credit, education, essential services), ask providers for instructions and compliance plans, and train the people who will do human oversight.
06From 2 December 2027: for high-risk uses, follow the provider's instructions, assign human oversight, keep logs for at least six months, inform workers and their representatives before use (Article 26) and, where required, run a fundamental rights impact assessment (Article 27).

Turning this timeline into a plan for your own tools and teams is the work of an AI transformation engagement, and the first consultation is free. For scope, roles and fines in one place, read the EU AI Act guide.

Free consultation

Want to apply this to your company?

In a free first call we look at your situation and I tell you where I would start, with which tools and what results to expect.

Book a free consultation Services

Frequently asked questions

When does the EU AI Act come into force?

It entered into force on 1 August 2024 and applies in stages: bans and AI literacy from 2 February 2025, most rules from 2 August 2026, high-risk rules from 2 December 2027 and 2 August 2028.

Has the EU AI Act been delayed?

Only in part. The Digital Omnibus moved high-risk obligations to 2 December 2027, and to 2 August 2028 for AI in regulated products. Bans, AI literacy, transparency and fines were not delayed.

What changes on 2 December 2026?

AI systems that create realistic intimate images, video or audio of identifiable people without explicit consent, and systems that generate child sexual abuse material, become prohibited. The grace period for marking output of generative systems already on the market also ends.

When do EU AI Act fines start?

Enforcement started on 2 August 2026. The maximum is EUR 35 million or 7% of worldwide annual turnover for prohibited practices and EUR 15 million or 3% for most other breaches, whichever is higher; SMEs and start-ups face the lower of the two.

Could the high-risk deadlines move again?

Only through a new EU regulation. Plan on the dates in force today: 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products.

Does the AI Act apply to AI systems already in use?

For bans, AI literacy and transparency, yes. For high risk, systems already on the market are covered only if their design changes significantly afterwards, except those used by public authorities, which must comply by 2 August 2030.

Which deadlines matter if we only use ChatGPT or Copilot?

The ones already in application: AI literacy measures since 2 February 2025 and, if you publish generated content or run a customer chatbot, transparency since 2 August 2026. Check national employment rules too if AI touches HR decisions.

Sources

This guide is for information only and is not legal advice. Sources checked on 13 November 2026.

About the author

Cesare D'Adamo

Product and AI strategy consultant

15+ years in product, growth and AI, more than 20 AI-powered products built, and executive teams trained on EU AI Act compliance. Works from Berlin with companies across Europe, in English and Italian.

LinkedIn Full profile Services

Let's put AI to work

Strategy, products and automation with AI that deliver measurable results, within the rules. It starts with a free call.

Book a free consultation

First call free, no commitment

EU AI Act timeline:
every deadline after the Digital Omnibus

In this guide

What are the EU AI Act deadlines?

What happens on 2 December 2026?

What did the Digital Omnibus delay, and what did it not?

Do the rules apply to AI systems already on the market?

What is still missing: guidelines, standards and sandboxes

National deadlines: what Member States add

How to prepare for each deadline: a 6-step plan

Want to apply this to your company?

Frequently asked questions

When does the EU AI Act come into force?

Has the EU AI Act been delayed?

What changes on 2 December 2026?

When do EU AI Act fines start?

Could the high-risk deadlines move again?

Does the AI Act apply to AI systems already in use?

Which deadlines matter if we only use ChatGPT or Copilot?

Sources

Cesare D'Adamo

Related guides

EU AI Act: what companies must do in 2026

AI agents for business: what they are, examples and costs

GEO: how to get cited by ChatGPT, Gemini and AI Overviews

MCP explained: what the Model Context Protocol means for companies

/services/ai-transformation

All guides

Let's put AI to work

EU AI Act timeline: every deadline after the Digital Omnibus

In this guide

What are the EU AI Act deadlines?

What happens on 2 December 2026?

What did the Digital Omnibus delay, and what did it not?

Do the rules apply to AI systems already on the market?

What is still missing: guidelines, standards and sandboxes

National deadlines: what Member States add

How to prepare for each deadline: a 6-step plan

Want to apply this to your company?

Frequently asked questions

When does the EU AI Act come into force?

Has the EU AI Act been delayed?

What changes on 2 December 2026?

When do EU AI Act fines start?

Could the high-risk deadlines move again?

Does the AI Act apply to AI systems already in use?

Which deadlines matter if we only use ChatGPT or Copilot?

Sources

Cesare D'Adamo

Related guides

EU AI Act: what companies must do in 2026

AI agents for business: what they are, examples and costs

GEO: how to get cited by ChatGPT, Gemini and AI Overviews

MCP explained: what the Model Context Protocol means for companies

/services/ai-transformation

All guides

Let's put AI to work

EU AI Act timeline:
every deadline after the Digital Omnibus