If you follow EU AI Act news at all, you know the headlines keep changing. One month Brussels is refusing to pause the world’s first big AI law. A few months later, it agrees to delay the toughest parts of that same law. This guide sorts out what actually happened, in plain English, with every key date checked against official sources.
The stakes go far beyond Europe. The European Commission calls the AI Act the first comprehensive legal framework on AI anywhere in the world. When the EU moved first on data privacy with the GDPR, its rules quietly became the global default. Lawyers expect the same pattern here, which is why companies in the United States and Asia watch every EU AI Act update closely.
The EU AI Act in 60 Seconds
The AI Act, formally Regulation (EU) 2024/1689, became law on August 1, 2024. Instead of regulating all AI the same way, it sorts systems by risk. The most dangerous practices are banned outright. High-risk systems, such as AI used in hiring or credit scoring, face strict duties around data quality, record keeping and human oversight. Chatbots and AI content tools face lighter transparency duties, like telling people they are talking to a machine. Most everyday AI, from spam filters to game characters, faces no new rules at all.
A separate layer covers general-purpose AI models, the big models behind popular chatbots and AI agents. The most powerful models carry extra duties, including risk testing and incident reporting. You can read the full breakdown on the European Commission’s AI Act page, and the fines for breaking the rules reach up to 35 million euros or 7 percent of a company’s worldwide turnover.
EU AI Act Timeline: The Dates That Matter
The Act never had a single start date. It switches on in stages, and a 2026 simplification package, nicknamed the AI Omnibus, moved the two biggest high-risk deadlines. This is the EU AI Act timeline as it stands now.
| Date | What happens |
|---|---|
| August 1, 2024 | The AI Act enters into force |
| February 2, 2025 | Bans on prohibited practices and the AI literacy duty begin |
| July 10, 2025 | Final GPAI Code of Practice is published |
| August 2, 2025 | Rules for general-purpose AI models and EU governance begin |
| November 19, 2025 | The Commission proposes the Digital Omnibus simplification package |
| May 7, 2026 | Parliament and Council reach a political agreement on the Omnibus |
| July 27, 2026 | The Omnibus, Regulation (EU) 2026/1744, enters into force |
| August 2, 2026 | The Act generally applies; transparency rules and GPAI enforcement begin |
| December 2, 2026 | Marking deadline for older generative AI systems; new ban on AI-made non-consensual intimate imagery begins |
| August 2, 2027 | Deadline for GPAI models launched before August 2025 to fully comply |
| December 2, 2027 | High-risk rules for sensitive uses (Annex III) apply |
| August 2, 2028 | High-risk rules for AI inside regulated products (Annex I) apply |
The Latest Developments, Step by Step
July 2025: The GPAI Code of Practice Lands
On July 10, 2025, the Commission received the final General-Purpose AI Code of Practice. It was written by 13 independent experts with input from more than 1,000 stakeholders, and it has three chapters: transparency, copyright, and safety and security for the most powerful models. In the same month, the Commission published guidelines on the scope of the GPAI rules and a template that model makers must use to summarize their training content. Signing the code is voluntary, but it is the clearest route for model providers to show they follow the law.
July 2025: Brussels Refuses to Stop the Clock
The code arrived under heavy pressure. More than 40 European companies, including Airbus, Mercedes-Benz and Philips, had signed an open letter asking for a two-year pause, warning of unclear and overlapping rules. Some member states, including Poland and the Czech Republic, also pushed for delays. The Commission refused. As IAPP reported, spokesperson Thomas Regnier told reporters on July 4, 2025: “There is no stop the clock, there is no grace period, there is no pause.”
August 2025: The GPAI Rules Switch On
On August 2, 2025, the obligations for general-purpose AI models became applicable, along with the EU governance structure. Model providers must keep technical documentation, publish a summary of their training content and follow EU copyright law. Models with the highest capability, measured at more than 10 to the power of 25 computing operations in training, face extra duties to assess and reduce systemic risks. Models already on the market before that date have until August 2, 2027 to fully comply.
November 2025: The Simplification Turn
By the autumn, the Commission changed its own tune. On November 19, 2025, it proposed the Digital Omnibus on AI, a package to simplify the Act. Its core argument was sequencing: the technical standards and support tools that companies need in order to comply were not ready, so the high-risk deadlines should move. The proposal also extended lighter requirements from small and medium companies to small mid-caps, widened access to regulatory sandboxes, and added a new ban on AI systems that generate non-consensual intimate imagery or child sexual abuse material.
May to July 2026: Deal Done, Dates Moved
After months of negotiation, the European Parliament and the Council reached a political agreement on the Omnibus on May 7, 2026. Parliament approved the package in June 2026 and the Council gave its final approval on June 29, 2026. The amending law, Regulation (EU) 2026/1744, entered into force on July 27, 2026, just days before the original August deadline it replaced. One important detail survived every draft: the new dates are fixed calendar dates, not tied to when standards bodies finish their work.
August 2026: Transparency Rules Go Live
On August 2, 2026, the Act reached its general application date. The transparency rules now apply: chatbots must disclose that they are machines, deepfakes must be labeled, and AI-generated content must carry machine-readable marks. Generative systems already on the market before that date get until December 2, 2026 to add the marking. Since August 2026, the EU AI Office can also enforce the GPAI rules directly, including fines of up to 15 million euros or 3 percent of worldwide turnover for model providers. Enforcement is split three ways: the AI Office in Brussels polices the big general-purpose models, national market surveillance authorities handle most other systems, and the European Data Protection Supervisor covers AI used by the EU institutions themselves.
What Counts as High Risk?
High-risk is the category that drives most EU AI Act compliance work. It covers two groups. The first, listed in Annex III of the Act, is AI used in sensitive areas: biometric identification, critical infrastructure, education admissions and exam scoring, hiring and worker management, access to essential services such as credit scoring and insurance pricing, law enforcement, migration and border control, and the courts. The second group, in Annex I, is AI built into products that already have EU safety rules, such as medical devices, machinery, lifts and toys.
Before a high-risk system can be sold, its provider must run a risk management process, train it on quality data, keep detailed documentation and logs, design in human oversight, and pass a conformity check. The bans sit above even this category: since February 2025, practices such as social scoring, emotion recognition at work and in schools, and untargeted scraping of faces from the internet have been prohibited across the EU. Biometric tools carry some of the heaviest duties of all, as our explainer on agentic AI and identity security shows.
What Companies Must Do Now
The delay is not a holiday, and compliance teams are treating the extra time as build time. The practical checklist looks like this:
- List and classify every AI system you sell or use. You cannot meet a deadline you have not mapped to a risk category.
- Handle transparency today. Chatbot disclosures, deepfake labels and content marking already apply and were not delayed.
- Collect documentation from your model providers. If your provider signed the GPAI Code of Practice, the paperwork you need should exist. Ask for it.
- Prepare high-risk systems for 2027 and 2028. Risk management, logging, human oversight and conformity checks take months, and retrofitting them costs far more than designing them in.
- Train your staff. The AI literacy duty has applied since February 2025, and the Omnibus kept it in place.
The full legal text is free to read in the official journal version of the Act on EUR-Lex, and the Commission runs an AI Act Service Desk for company questions.
How the Tech Industry Reacted
Reaction split along predictable lines, and the signing list for the code of practice tells the story. OpenAI, Anthropic, Microsoft, Amazon, IBM and the French lab Mistral AI all signed. Google signed on July 30, 2025, but its president of global affairs, Kent Walker, warned in a company statement that parts of the Act and the code risk slowing Europe’s development and deployment of AI. Elon Musk’s xAI signed only the safety and security chapter, leaving its transparency and copyright duties to be shown by other means.
Meta was the biggest holdout. Its chief global affairs officer, Joel Kaplan, announced in July 2025 that Meta would not sign, writing that “Europe is heading down the wrong path on AI” and that the code goes far beyond the scope of the AI Act. Major Chinese model makers, including Alibaba, Baidu and DeepSeek, have also stayed off the list. From the other side, trade unions and civil society groups criticized the 2026 Omnibus delay itself, calling it a pause on crucial protections that industry lobbying had won. The Commission’s answer is that the safeguards themselves did not change; only the calendar did.
What It Means for People Outside the EU
You do not need a European office to be covered. The Act applies to any provider whose system is placed on the EU market, and to companies anywhere whose AI output is used inside the Union. A hiring tool built in Texas that screens applicants in Berlin is in scope. Non-EU model makers selling into Europe face the same GPAI duties as European ones.
For regular users worldwide, the most visible effect will be labels. Because global companies rarely build a separate product for one region, AI content disclosures and training summaries written for Europe are already showing up everywhere, much as GDPR privacy notices did. Readers who want more personal control over AI features can also check our guide on how to turn off Google AI.
What to Watch Next
Three stories will dominate EU AI Act news over the next year. First, December 2, 2026 brings both the marking deadline for older generative systems and the start of the new ban on AI-generated non-consensual intimate imagery. Second, enforcement capacity is uneven: industry trackers reported in early 2026 that only a minority of member states had their national authorities fully in place, and the AI Office’s first big enforcement actions against model providers are still to come. Third, the standards race continues, with the first harmonised standard under the Act published in 2026 and the rest of the suite, covering risk management and bias testing, still in progress ahead of the December 2027 high-risk deadline. The Commission’s separate code of practice on marking and labelling AI-generated content, complete with standard disclosure icons, will also face its first real-world test as platforms roll the labels out to users.
The Bottom Line
The EU AI Act is no longer a future event. The bans are live, the model rules are live, the transparency rules are live, and the fines behind them are real. What changed in 2026 is the calendar for the heaviest high-risk duties, now December 2027 and August 2028, not the direction of the law. Companies that use the extra time to build their compliance properly will be fine. Companies that treat the delay as a cancellation will not. For more coverage like this, browse our AI news and regulation section.
