EU AI Act Timeline After the 2026 AI Omnibus

The EU AI Act timeline changed in 2026. The EU institutions adopted an AI Omnibus that moves the main high-risk requirements away from the original dates while leaving the general AI Act and Article 50 transparency framework on their own timelines.

As of this article's 22 July 2026 review date, the practical milestones are:

• 2 February 2025 — prohibited practices and AI-literacy provisions began applying.
• 2 August 2025 — governance rules and obligations for providers of general-purpose AI models began applying.
• 2 August 2026 — the general application date, including Article 50 transparency duties.
• 2 December 2027 — the adopted application date for Annex III high-risk AI systems.
• 2 August 2028 — the adopted application date for high-risk AI connected to regulated products under the Article 6(1)/Annex I path.

Because legislation and implementation guidance can change, teams should verify the final amending text in the Official Journal and check current Commission guidance before making a legal decision.

Need a first-pass orientation? Use the browser-only EU AI Act Risk Checker. It now covers EU scope, operator role, intended purpose, Article 6(3) exceptions, transparency, and related data-law flags.

---

The timeline, in one place

| Date | Current engineering significance | | --- | --- | | 1 August 2024 | AI Act entered into force | | 2 February 2025 | Prohibited practices and AI literacy began applying | | 2 August 2025 | GPAI provider duties and governance provisions began applying | | 2 August 2026 | Article 50 transparency duties and the general application date | | 2 December 2027 | Annex III high-risk requirements under the adopted Omnibus timeline | | 2 August 2028 | Regulated-product high-risk requirements under the adopted Omnibus timeline |

The penalty tiers also need precise wording. The maximum €35 million or 7% of worldwide annual turnover tier is associated with prohibited-practice violations. Many other operator and transparency violations fall under a maximum €15 million or 3% tier, subject to the Act's detailed rules, SME treatment, proportionality, and national enforcement.

---

High-risk classification is about intended purpose

Using AI somewhere in employment, education, finance, or healthcare does not automatically make every system high-risk. Article 6 and Annex III identify specific intended purposes.

Common examples include:

• Employment — targeted job advertising, filtering applications, candidate evaluation, promotion or termination decisions, task allocation, and worker monitoring.
• Education — admission, access, material learning-level decisions, assessment of learning outcomes, and certain test-monitoring uses.
• Essential services — public benefits, natural-person creditworthiness, life and health insurance risk/pricing, emergency dispatch, and emergency healthcare triage.
• Biometrics — certain remote biometric identification, biometric categorisation, and emotion-recognition systems where their use is permitted. Simple one-to-one authentication is excluded from the remote-identification category.
• Critical infrastructure — safety components used in the management or operation of specified critical infrastructure.
• Law enforcement, migration, justice, and elections — only the listed purposes and conditions in Annex III.

The operator role matters too. A provider, deployer, importer, distributor, and product manufacturer can have different obligations. An organisation may hold more than one role.

---

Article 6(3): the exception that a checkbox cannot decide

An Annex III system may avoid high-risk classification where it does not pose a significant risk of harm and does not materially influence the relevant decision. The Act lists situations such as a narrow procedural task, improving a previously completed human activity, detecting patterns without replacing or influencing the human assessment, or performing a preparatory task.

Three cautions matter:

1. An Annex III system that performs profiling of natural persons remains high-risk.
2. These exceptions do not replace the separate Article 6(1) regulated-product analysis.
3. A provider relying on an exception must document the assessment before placing the system on the market or putting it into service and complete the applicable registration step.

That is why the SovAIHub checker returns "Article 6(3) classification review needed" rather than declaring such a system minimal-risk.

---

Article 50 applies from 2 August 2026

On 20 July 2026, the European Commission published adopted guidelines and supporting Q&A on the Article 50 transparency obligations. The guidance confirms that the duties are more specific than "label everything made by AI."

• Providers of systems designed for a genuine, direct two-way exchange with natural persons must ensure people are informed from the start of the first interaction, unless the AI interaction is obvious in context. Background processing and machine-to-machine communication do not trigger that interaction duty.
• Providers of systems generating in-scope synthetic audio, image, video, or text must support effective machine-readable marking. The guidance discusses exclusions and exceptions for outputs such as source code, short sequences, machine-to-machine outputs, some closed-loop industrial development outputs, standard editing, technical feasibility, and narrow industrial or business-to-business situations.
• Deployers must clearly disclose applicable deepfakes no later than first exposure. A deployer cannot rely only on the provider's machine-readable marking because the deployer disclosure is a human-facing control.
• Deployers publishing AI-generated or manipulated text on matters of public interest may rely on the human-review/editorial-control exception only where the review is substantive and an accountable person or entity holds editorial responsibility. Spelling, grammar, or merely formal checks are insufficient.
• Deployers of emotion-recognition or biometric-categorisation systems must inform exposed people, whether exposure happens in real time or through later processing.

Provider and deployer obligations should therefore be mapped separately in product requirements and test evidence.

There is no general Article 50 grace period. The Commission describes a limited transition only for the Article 50(2) marking and detection obligation for systems placed on the market before 2 August 2026; those systems must comply with that specific obligation from 2 December 2026. Content generated before 2 August 2026 does not need to be labelled retroactively.

---

What high-risk engineering evidence looks like

The detailed compliance work still benefits from starting early. The core evidence stack includes:

| Obligation | Engineering evidence | | --- | --- | | Risk management (Art. 9) | Versioned risk register connected to releases and incidents | | Data governance (Art. 10) | Data lineage, suitability, quality, and bias-examination records | | Technical documentation (Art. 11) | Intended purpose, architecture, versions, limitations, and validation dossier | | Logging (Art. 12) | Automatic event records designed for traceability | | Instructions (Art. 13) | Capabilities, limitations, oversight, input, and maintenance guidance | | Human oversight (Art. 14) | Named authority, review points, override/interruption, and training | | Accuracy and robustness (Art. 15) | Quality, failure, adversarial, drift, and cybersecurity tests | | Conformity and registration | Applicable assessment, declarations, marking, and database records |

These are not documents that can be reconstructed reliably after a system has been operating for months. Logs, evaluation baselines, approvals, and change records should be built into the delivery workflow.

---

Sovereign deployment helps evidence; it does not create compliance

The AI Act does not require self-hosting or an air gap. A controlled deployment can nevertheless make evidence easier to produce:

• Runtime and tool-call logs can cover the complete request path.
• Model, prompt, retriever, and policy versions can be pinned and reproduced.
• Data flows and administrator access can be inspected directly.
• Evaluation can run against approved datasets without sending sensitive examples to an external judge.
• Artifact provenance and release approvals can be retained with the system record.

The trade-off is responsibility. Self-hosting transfers availability, patching, model provenance, security, monitoring, and lifecycle operations to the organisation. Air gaps substantially reduce external network exposure but do not remove removable-media, administrator, physical-access, or artifact-import risks.

---

A practical preparation sequence

1. Inventory systems and roles. Record intended purpose, owner, users, affected people, market, provider, deployer, model, tools, and deployment boundary.
2. Screen prohibited practices. Treat a possible Article 5 match as a stop-and-review condition.
3. Perform the Article 6 analysis. Identify the exact Annex III or regulated-product path and document any claimed exception.
4. Map Article 50 separately. Split provider marking duties from deployer disclosure duties.
5. Build the evidence pipeline. Version test datasets, evaluation results, logs, approvals, model artifacts, incidents, and material changes.
6. Connect evidence to ownership. A control without an owner, review cadence, or release gate is not an operating control.

The proposed AI System Passport brings this inventory, evidence, evaluation, and change record together. The Sovereign EvalOps pattern adds regression gates, while Sovereign AI FinOps connects the operating cost to utilization and outcomes.

---

Official references

• Regulation (EU) 2024/1689 — EUR-Lex
• European Commission — high-risk system guidelines and current timeline
• European Commission — Article 50 transparency Code of Practice
• European Commission — adopted Article 50 transparency guidelines
• European Commission — Article 50 transparency questions and answers
• Council — final approval of the 2026 AI simplification rules

Reviewed 22 July 2026. This article is an engineering orientation, not legal advice. Verify the Official Journal and current Commission guidance, and use qualified counsel for classification or conformity decisions.