Analysis
EU AI Act timeline: what businesses must do after the 2026 changes
The EU AI Act has been in force since 1 August 2024, but its obligations apply in stages: prohibited practices and AI literacy from 2 February 2025, general-purpose AI models from 2 August 2025. The Digital Omnibus package, Regulation (EU) 2026/1744, moved the obligations for high-risk systems under Annex III to 2 December 2027 and for products under Annex I to 2 August 2028.132
The EU AI Act timeline as of 9 October 2026
The EU AI Act applies in stages, and several deadlines changed in July 2026. Regulation (EU) 2026/1744, known as the Digital Omnibus package, has been in force since 27 July 20262. As a result, many articles online still quote outdated dates for high-risk systems.
| Date | What starts to apply | Source |
|---|---|---|
| 1 August 2024 | entry into force of the Regulation | 1 |
| 2 February 2025 | prohibited practices (Art. 5) and AI literacy (Art. 4) | 3 |
| 2 August 2025 | obligations for providers of general-purpose AI models, governance, penalties | 3 |
| 2 August 2026 | general date of application (with the exceptions in the rows below) | 1 |
| 2 December 2026 | new prohibitions (non-consensual sexual deepfakes, AI-generated child sexual abuse material) and labelling of content from systems placed on the market before 2 August 2026 | 2 |
| 2 August 2027 | deadline for setting up national AI regulatory sandboxes | 4 |
| 2 December 2027 | requirements for high-risk systems under Annex III (including employment and education) | 2 |
| 2 August 2028 | requirements for high-risk systems in products under Annex I (Art. 6(1)) | 2 |
| 2 August 2030 | high-risk systems used by public authorities | 2 |
What already applies to your business today
If your company uses AI tools, it has been barred since 2 February 2025 from using the practices prohibited under Art. 5 and should look after its employees’ AI literacy3. Since 27 July 2026, Art. 4 has been worded more softly: providers and deployers are to support the development of this literacy, and the provision does not require them to guarantee a specific level for every individual2.
Systems that generate text, images, audio or video and were placed on the market before 2 August 2026 must meet the content-labelling obligation under Art. 50(2) by 2 December 20262. In practice, this means asking the provider of the tool you use whether its outputs are labelled.
Fines
Breaching the prohibitions in Art. 5 can lead to a fine of up to EUR 35 million or up to 7% of total worldwide annual turnover, breaching operator obligations up to EUR 15 million or 3%, and supplying incorrect information to authorities up to EUR 7.5 million or 1%, in each case whichever is higher1. For SMEs the lower amount applies1, and since 27 July 2026 the same rule has covered some of the fines for small mid-cap companies2.
National implementation: the example of Poland
Poland’s Act of 3 July 2026 on artificial intelligence systems was published in the Journal of Laws (Dz.U. 2026 item 1003) and has applied since 11 August 2026, with some of its provisions entering into force on 28 October 20265. The market surveillance authority and single point of contact is the Commission for the Development and Safety of Artificial Intelligence (KRiBSI)5; the Polish parliament (Sejm) appointed its chair on 18 September 20266.
What to do now
- Draw up a list of the AI systems your company uses: in-house, commissioned and built into software you have bought.
- Assign each system to a risk category and check whether any of them falls under Annex III.
- Plan training and rules for using AI across your team.
- Ask providers of generative tools how they label content and what their compliance plan is.
- For systems that make decisions about people, keep a human in the loop who can review and change the result.
We support compliance with the EU AI Act on the technical and organisational side: inventorying systems, designing human oversight and preparing documentation. This text is not legal advice; your legal advisers should assess how it applies to your case.
Frequently asked questions
Does the EU AI Act already apply?
Yes. The Regulation entered into force on 1 August 2024, and the first obligations, prohibited practices and AI literacy, have applied since 2 February 2025. The remaining obligations are phased in up to 2030.132
When do the requirements for high-risk AI systems apply?
Following the amendments made by Regulation (EU) 2026/1744: from 2 December 2027 for systems listed in Annex III and from 2 August 2028 for systems that form part of products covered by Annex I.2
What fines does the EU AI Act provide for?
Up to EUR 35 million or up to 7% of total annual turnover for breaching the prohibitions in Art. 5, up to EUR 15 million or 3% for other breaches of obligations, and up to EUR 7.5 million or 1% for supplying incorrect information; for SMEs the lower amount applies.1
Who supervises the AI Act in Poland?
The Polish Act of 3 July 2026 on artificial intelligence systems designates the Commission for the Development and Safety of Artificial Intelligence (KRiBSI) as the market surveillance authority and single point of contact.5
Sources
- EUR-Lex, Urząd Publikacji UE: Rozporządzenie (UE) 2024/1689 w sprawie sztucznej inteligencji (AI Act)
- EUR-Lex, Urząd Publikacji UE: Rozporządzenie (UE) 2026/1744 (Digital Omnibus on AI) zmieniające rozporządzenie 2024/1689
- Komisja Europejska: AI Act — Regulatory framework for AI
- Rada Unii Europejskiej: Artificial Intelligence: Council gives final green light to simplify and streamline rules
- Kancelaria Sejmu RP: Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (Dz.U. 2026 poz. 1003)
- Kancelaria Sejmu RP: Uchwała Sejmu z 18 września 2026 r. w sprawie powołania Przewodniczącego KRiBSI (M.P. 2026 poz. 945)