For most of 2025 the working assumption was that the EU AI Act's high risk obligations would apply from 2 August 2026. That is no longer the date. The Digital Omnibus on AI, adopted by the European Parliament on 16 June 2026 and by the Council on 29 June 2026, and published in the Official Journal on 24 July 2026, moved the high risk deadlines and changed several other things along the way. If your plan was built on the old calendar, this is the correction.
The timeline as it stands
- 2 February 2025. The original prohibited practices and the AI literacy duty began to apply. Nothing here moved.
- 2 August 2025. The rules for general purpose AI models, the governance structure, and the penalty provisions began to apply. Nothing here moved.
- 2 August 2026. The Act became generally applicable, including the Article 50 transparency obligations: telling people when they are dealing with an AI system and marking synthetic content. This date did not move.
- 2 December 2026. Two new prohibitions apply, covering AI systems that generate child sexual abuse material and systems that generate intimate images of people without their consent. The same date ends the grace period for providers of systems that were already on the market before 2 August 2026 and generate synthetic content; from here on they must meet Article 50(2).
- 2 August 2027. General purpose AI models placed on the market before 2 August 2025 must comply. Each member state must have at least one regulatory sandbox running.
- 2 December 2027. The high risk obligations in Chapter III apply to the systems listed in Annex III: the use cases such as employment, education, access to essential services, and law enforcement. This is the date that moved, from August 2026.
- 2 August 2028. The same obligations apply to high risk systems under Annex I, meaning AI that is a safety component of, or is itself, a product already covered by EU product legislation such as machinery or medical devices.
- 2 August 2030. Systems intended for use by public authorities reach their compliance date.
What else changed
The dates are the headline, but the Omnibus did more than shift them, and a few of the other changes matter for scoping.
- Systems already on the market. An Annex III system placed on the market before 2 December 2027 falls under the high risk rules only if it is substantially modified after that date. That is a real grandfathering provision, and it rewards getting a system to market in its final form before the deadline rather than after.
- Safety component, narrowed. A system now counts as a safety component only if it is intended to prevent or mitigate risks to health and safety. Some products that would have been pulled into Annex I by a broad reading are out.
- Small mid cap relief. Companies with fewer than 750 employees and turnover up to 150 million euros get the lighter compliance treatment that was previously reserved for small and medium enterprises. Many US firms selling into Europe fit that band.
- Bias detection. The Act now provides its own legal basis for processing special category personal data for the purpose of detecting and correcting bias, under strict necessity and safeguards. It does not create a duty to run bias detection.
- Overlap with sector law. Where the Act overlaps with sector rules such as the Machinery Regulation, the Commission can limit duplicate obligations through implementing acts, and a delegated act on this is due by 2 August 2028.
- Enforcement. The AI Office takes exclusive supervision of certain systems built on general purpose models and of systems embedded in very large online platforms and search engines, and can recover its enforcement costs.
What a US company should do this year
A sixteen month extension on the high risk rules is not a reason to stop. It is one budget cycle, and the work that takes longest, the inventory and the classification, has to be done before you know whether the deadline applies to you at all.
- Confirm whether you are in scope. The Act reaches providers who place a system on the EU market and deployers established there, and it also reaches providers and deployers outside the EU when the output of the system is used in the EU. A US company with European customers is usually in scope for at least one system.
- Inventory every AI system, agent, and automated workflow, and record for each whether you are the provider, the deployer, or both. Roles drive obligations, and most organizations are deployers of far more systems than they think.
- Classify against Annex III and Annex I. For each system, decide which list it falls under, if either, and write the reasoning down. The Commission's classification guidelines are due by August 2027; until then, your documented reasoning is the record.
- Treat Article 50 as live, because it is. Any system that talks to people or generates text, images, audio, or video needs the disclosure and marking in place now, not in 2027.
- Decide what to ship before 2 December 2027. If a high risk Annex III system is on your roadmap, the grandfathering provision makes the ordering of releases a compliance decision as well as a product one.
- Build the management system once. The high risk requirements for risk management, data governance, technical documentation, logging, human oversight, and accuracy map closely onto ISO/IEC 42001 and the NIST AI Risk Management Framework. An organization that stands up one governance program against those two can produce the AI Act evidence from it rather than running a separate exercise.
The short version
High risk moved to 2 December 2027 for Annex III and 2 August 2028 for Annex I. Transparency did not move and applies today. New prohibitions arrive on 2 December 2026. The inventory and classification work decides everything else, and it is the part worth starting now.
Sources
- The AI Act implementation timeline: what changes under the AI Omnibus, Future of Privacy Forum.
- EU AI Act update: Digital Omnibus finalizes 8 compliance changes, Orrick.
- Regulation (EU) 2024/1689, the AI Act, EUR-Lex.