The EU AI Act's timeline changed in July 2026. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on July 24, 2026 and entered into force three days later. It moved the start of the high-risk rules by more than a year, added two prohibitions with their own start date, and gave providers of content-generating systems a short transition. Many pages that rank for the Act's dates still give the original timetable. This guide sets out every date from the Official Journal texts themselves: the original Act, the amending regulation and the consolidated text of July 27, 2026, with what already applies, what is still to come, what changed and why, and how to handle dates in the AIGP exam.
The short answer
- In force: since August 1, 2024, the twentieth day after publication.
- Already applying: the prohibitions and AI literacy (since February 2, 2025); the rules for general-purpose AI models, governance and penalties (since August 2, 2025); and, since August 2, 2026, the rest of the Act except the high-risk requirements, including the transparency duties of Article 50.
- Next: two new prohibitions, on non-consensual intimate imagery and child sexual abuse material, from December 2, 2026, the same day content-generating systems already on the market must meet the marking duty.
- High-risk: the requirements apply from December 2, 2027 for the systems listed in Annex III, and from August 2, 2028 for systems that are products, or safety components of products, under the legislation in Annex I.
- Last dates: August 2, 2027 for general-purpose models already on the market before August 2, 2025; August 2, 2030 for high-risk systems used by public authorities; December 31, 2030 for the large EU IT systems in Annex X.
The EU AI Act timeline at a glance
| Date | What applies | Where the Act sets it |
|---|---|---|
| August 1, 2024 | The Act enters into force | Article 113, first paragraph |
| February 2, 2025 | Chapters I and II: general provisions, AI literacy, the original prohibitions | Article 113(a) |
| August 2, 2025 | Notifying authorities and notified bodies, general-purpose AI models, governance, penalties and Article 78, except Article 101 | Article 113(b) |
| July 27, 2026 | Regulation (EU) 2026/1744 in force; Articles 102 to 110, which amend other EU laws, apply | Article 4 of 2026/1744; Article 113(d) |
| August 2, 2026 | The general date: everything not given another date, including Article 50 and Article 101 | Article 113, second paragraph |
| December 2, 2026 | The two new prohibitions; the marking duty for content generators already on the market | Article 113(a); Article 111(4) |
| August 2, 2027 | General-purpose AI models placed on the market before August 2, 2025 must comply | Article 111(3) |
| December 2, 2027 | High-risk requirements for Annex III systems | Article 113(c)(i) |
| August 2, 2028 | High-risk requirements for Annex I systems | Article 113(c)(ii) |
| August 2, 2030 | High-risk systems used by public authorities, already in service | Article 111(2) |
| December 31, 2030 | AI systems in the large EU IT systems of Annex X | Article 111(1) |
What applies today
As of October 2026, most of the Act is in application, and only the high-risk chapter waits.
The prohibitions in Article 5 have applied since February 2, 2025, because Article 113 provides that "Chapters I and II shall apply from 2 February 2025". Chapter I also holds AI literacy, which the Omnibus rewrote. Article 4 now reads: "Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". The new text adds that "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual."
General-purpose AI models, governance and penalties have applied since August 2, 2025: "Chapter III Section 4, Chapter V, Chapter VII and Chapter XII and Article 78 shall apply from 2 August 2025, with the exception of Article 101". Article 101 holds the fines for providers of general-purpose AI models, so those fines waited for the general date.
Everything else outside the high-risk chapter has applied since the general date: "It shall apply from 2 August 2026." That includes the transparency obligations of Article 50, for chatbots, synthetic content and deepfakes among others, and Article 101.
Articles 102 to 110, which amend other EU laws, from aviation security to consumer representative actions, to bring the AI Act into them, are the one place where the Omnibus brought a date forward: "Articles 102 to 110 shall apply from 27 July 2026."
What is still to come
December 2, 2026. Two prohibitions join Article 5. Point (ba) covers an AI system "that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities", without that person's "freely-given, specific, informed, unambiguous and explicit consent". Point (bb) covers systems generating child sexual abuse material within the meaning of Directive 2011/93/EU. A new paragraph 1a narrows both: placing such a system on the market is prohibited where that generation is its intended purpose, or a reasonably foreseeable and reproducible outcome that the system lacks adequate safeguards to prevent, and using one is prohibited where the deployer uses it for that purpose. The same day is the deadline for systems already on the market that generate synthetic content: "Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026."
August 2, 2027. "Providers of general-purpose AI models that have been placed on the market before 2 August 2025 shall take the necessary steps in order to comply with the obligations laid down in this Regulation by 2 August 2027." This date is unchanged from 2024.
December 2, 2027 and August 2, 2028. The high-risk requirements, Sections 1, 2 and 3 of Chapter III, "shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I". Annex III is the list of high-risk uses (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice). Annex I is the list of EU product legislation, so its date covers AI that is a product, or a safety component of one, already regulated as a product.
2030. High-risk systems already in service before their chapter's date are caught only if they change: the Act applies to them "only if, as from that date, those systems are subject to significant changes in their designs." Public authorities get a fixed end date: providers and deployers of high-risk systems "intended to be used by public authorities shall take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030." AI systems in the large-scale EU IT systems listed in Annex X have until December 31, 2030.
What the Digital Omnibus changed
| Provision | Date in the 2024 text | Date after 2026/1744 |
|---|---|---|
| High-risk requirements, Annex III systems | August 2, 2026, the general date | December 2, 2027 |
| High-risk requirements, Annex I systems | August 2, 2027 | August 2, 2028 |
| Prohibitions on intimate imagery and child sexual abuse material | Not in the Act | December 2, 2026 |
| Marking duty for content generators already on the market | August 2, 2026, the general date | December 2, 2026 |
| Articles 102 to 110 | August 2, 2026, the general date | July 27, 2026 |
| The cutoff for high-risk systems already in service | Placed on the market before August 2, 2026 | Placed before the date its chapter applies |
The 2024 text had a simpler shape: "(c) Article 6(1) and the corresponding obligations in this Regulation shall apply from 2 August 2027." Everything else in the high-risk chapter followed the general date. The amendment split the chapter by annex and pushed both halves out: Annex III systems by 16 months, Annex I systems by 12.
The amending regulation gives its reason in its recitals: "the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities lead to challenges that jeopardise the effective entry into application of those obligations and that risk a significant increase in implementation costs in a way that does not justify maintaining their initial date of application, namely 2 August 2026."
Dates the Commission must meet
The timeline also binds the Commission, and its deadlines tell you when the Act's details may move again.
- Guidelines on high-risk classification. Article 6(5) required the Commission, "no later than 2 February 2026", to "provide guidelines specifying the practical implementation of this Article" with a list of practical examples of high-risk and non-high-risk use cases. The Omnibus kept that paragraph out of the delay: the high-risk sections apply later "with the exception of Article 6(5)".
- A yearly look at the lists. Under Article 112(1), "The Commission shall assess the need for amendment of the list set out in Annex III and of the list of prohibited AI practices laid down in Article 5, once a year following the entry into force of this Regulation". Both lists can therefore change between exam updates.
- Reports from 2028. "By 2 August 2028 and every four years thereafter, the Commission" reports on extending Annex III, on the list of systems needing transparency measures under Article 50, and on supervision and governance. A full evaluation of the Act follows by August 2, 2029 and every four years after that.
For a governance professional, these are the dates to put in the calendar alongside the obligations: each is a point at which the scope of the Act may be widened or clarified.
Was the EU AI Act delayed?
Partly. The high-risk requirements were delayed, by 16 months for Annex III systems and 12 for Annex I systems. Nothing else was: the prohibitions, AI literacy, the general-purpose model rules, governance and penalties all kept their dates, the general date of August 2, 2026 held, and the list of prohibitions grew. A summary that says the AI Act was delayed is right about the part of the Act most organizations worried about and wrong about the rest.
Two consequences follow for anyone planning compliance. Obligations that already apply, such as AI literacy, the prohibitions and Article 50, are not waiting for 2027. And the extra time for high-risk systems also moves the cutoff for systems already in service, which are now judged against the date their chapter applies rather than August 2, 2026.
How the AIGP exam treats the dates
The AIGP's Body of Knowledge v2.1 was approved on September 9, 2025, ten months before the Omnibus, and its competency II.C asks candidates to "Understand the enforcement framework and penalties for noncompliance" and to know the main elements of AI-specific laws such as the EU AI Act. The IAPP communicates changes to the Body of Knowledge "at least 90 days before the new content appears in the exam", and none of the IAPP pages we pin announced a change for the Omnibus when this guide was written.
Two things follow. The structure the exam tests did not change: the risk tiers, the requirements on high-risk systems, the roles of providers and deployers, the general-purpose model regime and the penalty ceilings are all where they were. What changed is dates and edges. So learn the structure from the Act as amended, learn both the original and the amended high-risk dates, and read any question that turns on a date twice: it may have been written for the 2024 text. The EU AI Act as the AIGP tests it covers the structure, indicator by indicator.
Where to start
The AIGP's first competency, AI and the need for governance, is free in full with a free account: five lessons, 100 questions and 118 flashcards on what AI is, its risks and the principles of responsible AI, the ground the AI Act's definitions and risk tiers stand on. The rest of the course follows the Body of Knowledge through the laws, the EU AI Act among them, with practice in the exam's format. How hard is the AIGP exam? sets out what the law domain asks of you.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.