EU AI Act timeline after the 2026 delay: what applies now, and what moves to 2027 and 2028

The short answer

The EU’s Artificial Intelligence Act (Regulation (EU) 2024/1689) did not arrive in one go, and it still has not. Its bans, its rules for general-purpose AI models and its transparency duties towards users already apply. What moved in 2026 is the heaviest part, the obligations for high-risk AI systems: Regulation (EU) 2026/1744, known as the “Digital Omnibus on AI”, sets them to 2 December 2027 and 2 August 2028. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, the third day after publication.

Dates from Article 113 of the AI Act as amended by Regulation (EU) 2026/1744. More on European AI rules in our Society & Law section.

What already applies

According to the European Commission’s AI Act page, last updated on 19 October 2026, three stages are behind us:

• 2 February 2025: prohibited practices (Article 5) and the AI literacy obligation (Article 4) began to apply. The bans include social scoring and certain manipulative techniques.
• 2 August 2025: the governance rules and the obligations for providers of general-purpose AI models, the large models behind mainstream chatbots, became applicable.
• 2 August 2026: the general date of application. Because Article 113 of the AI Act makes no exception for them, the transparency obligations of Article 50 have applied since that date.

Why this matters outside the EU

The AI Act is not limited to European companies. Under Article 2 of the regulation, it applies to providers placing AI systems or general-purpose AI models on the EU market “irrespective of whether those providers are established or located within the Union or in a third country”, and to providers and deployers outside the EU “where the output produced by the AI system is used in the Union”. A US or UK company whose chatbot, hiring tool or image generator is used in Europe therefore needs to track the same dates as a French or German one.

For recruiters, the 2027 date matters most: employment is one of the high-risk areas of Annex III. Our guide to screening CVs with AI under the CNIL’s guidance and the AI Act goes through it step by step.

What the July 2026 amendment changed

Regulation (EU) 2026/1744 rewrites Article 113 of the AI Act, the article that sets the dates of application. The obligations in Sections 1 to 3 of Chapter III, on high-risk systems, will apply:

• on 2 December 2027 for systems classified as high-risk under Annex III (uses considered sensitive, such as employment, education or some uses of biometrics);
• on 2 August 2028 for high-risk systems built into products that are already regulated and listed in Annex I (the Commission gives lifts and toys as instances).

The original text set 2 August 2026 for the first group and 2 August 2027 for the second. In its recitals, Regulation (EU) 2026/1744 explains the shift by “the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities”. It also requires providers and deployers of high-risk systems intended for public authorities, already on the market or in service, to comply “by 2 August 2030”.

The same regulation rewrites Article 4 on AI literacy. Providers and deployers “shall take measures to support the development of AI literacy of their staff”, and the obligation “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.

It goes the other way on prohibitions, adding two to Article 5 that apply from 2 December 2026:

• AI systems that generate or manipulate realistic images, videos, audio or similar material of an identifiable person’s intimate parts, or of an identifiable person engaged in sexually explicit activities, without that person’s explicit consent;
• AI systems that generate or manipulate child sexual abuse material within the meaning of Directive 2011/93/EU.

The Commission describes them as targeting, among others, AI “nudification” apps.

On procedure, a political agreement was reached on 7 May 2026, according to the Commission. The European Parliament adopted its first-reading position on 16 June 2026 (legislative resolution P10_TA(2026)0198) and, according to the footnotes of the published regulation, the Council took its decision on 29 June 2026.

A corrigendum was published in the Official Journal on 29 September 2026. It concerns the German-language version only, changing one word in Article 1, point 8 (on safety components). None of the dates above is affected.

What users will notice: Article 50

For the public, the most visible part is Article 50, which has applied since 2 August 2026 and was not postponed. According to the official text of the AI Act:

• providers of AI systems intended to interact directly with people, such as chatbots, must make sure that people are informed they are interacting with an AI system, “unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect” (Article 50(1));
• providers of generative AI systems must ensure that outputs (audio, image, video or text) are “marked in a machine-readable format and detectable as artificially generated or manipulated” (Article 50(2));
• deployers of a system that generates a deepfake must disclose that the content has been artificially generated or manipulated; the same applies to generated text published to inform the public on matters of public interest, unless it has undergone human review or editorial control and someone holds editorial responsibility for it;
• the information must be given “in a clear and distinguishable manner at the latest at the time of the first interaction or exposure” (Article 50(5)).

The amending regulation adds a transition: providers of generative systems placed on the market before 2 August 2026 must comply with the marking duty of Article 50(2) “by 2 December 2026”. Content generated by a tool already in service may therefore carry no technical marking before that date. For brands and agencies, our guide to labelling AI-generated ads under the AI Act applies these rules to advertising.

These rules do not replace the GDPR, the EU’s data protection law, which still governs the personal data that AI systems use: see how to object to AI training on your personal data. For consumer chatbots, the rules could tighten further: on 10 November 2026, an expert commission proposed to the Élysée, the French presidency, that chatbots be assessed before they are placed on the European market, which would require revising the AI Act.

Who enforces it: one AI Act, 27 sets of regulators

According to the Commission, the European Commission’s AI Office holds the enforcement powers over general-purpose AI models; for the rest, enforcement is national. Article 70 of the AI Act requires each member state to designate “at least one notifying authority and at least one market surveillance authority”, and one market surveillance authority as the single point of contact. Which body checks a chatbot or a hiring tool therefore depends on the country, and each country needs its own law to name them.

France shows how long that can take. As of 11 November 2026, no law naming the French authorities in charge of the AI Act has been finally adopted. The plan published by the Direction générale des Entreprises (DGE, the business directorate of the French Ministry of the Economy; page in French) on 9 September 2025 splits the work between three bodies:

• the DGCCRF, France’s consumer protection and fraud authority, and the Arcom, the French audiovisual and digital communications regulator, for the transparency duties towards chatbot users and synthetic content;
• the CNIL, France’s data protection authority, for part of the prohibited practices and many high-risk uses in Annex III (employment, biometrics, migration…);
• the DGCCRF again as the single point of contact.

The DGE adds that the plan will be implemented “subject to its acceptance by Parliament through a bill” (our translation, DGE page).

That bill exists: a broad bill adapting French law to EU law (projet de loi portant diverses dispositions d’adaptation au droit de l’Union européenne), tabled in the Senate on 10 November 2025. The text adopted by the Senate (in French) on 18 February 2026 follows the same split. It gives the CNIL the prohibited practices in points (c) to (h) of Article 5(1), and the Arcom points (a) and (b) together with the transparency obligations of Article 50 (paragraphs 1, 2 and 4). It also empowers DGCCRF officers on part of the same provisions.

The bill was sent to the Assemblée nationale, the lower house, on 20 February 2026. On 11 November 2026, the Assemblée’s legislative file (in French) still shows it at first reading, with five committees seized: the division of tasks does not yet have force of law.

The next deadlines

These are the dates set by Regulation (EU) 2026/1744:

• 2 December 2026: end of the marking grace period for generative AI tools already on the market; the two new prohibitions start to apply.
• 2 December 2027: rules on high-risk systems in Annex III.
• 2 August 2028: rules on high-risk systems in Annex I.
• 2 August 2030: compliance deadline for high-risk systems intended for public authorities and already on the market or in service.

For how Le Latent reads and dates these texts, and what its English edition covers, see About Le Latent. Every English article is listed on the English edition home page.