The EU AI Act in Autumn 2026: What Applies, What Moved
· TexaHub · Regulation & Ethics, Artificial Intelligence, Geopolitics & Tech
Prohibitions, general-purpose model rules and transparency duties now apply, while the Digital Omnibus has pushed high-risk obligations to December 2027 and August 2028.
What already applies
The AI Act entered into force on 1 August 2024, and according to the European Commission it became applicable on 2 August 2026, with earlier phases for specific chapters [2]. The first of those phases, the list of prohibited practices, entered into application on 2 February 2025 [2]. The Commission's FAQ states that the AI literacy provisions became binding on the same date [12].
To support the prohibitions, the Commission published guidelines on prohibited AI practices on 4 February 2025, covering among other things harmful manipulation, social scoring and real-time remote biometric identification [11]. Those guidelines are non-binding, and the Commission notes that authoritative interpretation is reserved for the Court of Justice of the European Union [11].
The Commission's FAQ lists maximum penalties of up to EUR 35 million or 7% of total worldwide annual turnover of the preceding financial year, whichever is higher, for prohibited practices, up to EUR 15 million or 3% for other non-compliance, and up to EUR 7.5 million or 1% for supplying misleading information to authorities [12]. The transparency obligations in Article 50, which cover deepfakes, AI-generated text published on matters of public interest and disclosure that a user is interacting with an AI system such as a chatbot, apply from 2 August 2026 [9].
General-purpose models: obligations, code and enforcement
Obligations for providers of general-purpose AI (GPAI) models entered into application on 2 August 2025, while the Commission's enforcement powers over those providers entered into application on 2 August 2026 [7]. Providers of GPAI models placed on the market before 2 August 2025 have until 2 August 2027 to comply, according to the Commission's guidelines page [7]. The Commission's FAQ puts the maximum fine for GPAI providers at EUR 15 million or 3% of total worldwide annual turnover [12].
The General-Purpose AI Code of Practice was published on 10 July 2025 and has three chapters: transparency, copyright, and safety and security [8]. The Commission and the AI Board have confirmed that the code is an adequate voluntary tool [8]. The Commission's list of signatories includes Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI; xAI signed only the safety and security chapter and, the Commission says, will have to demonstrate compliance on transparency and copyright via alternative adequate means [8]. Meta does not appear on that list [8]. The Commission describes the AI Office as supporting providers in their compliance, especially code signatories [7].
Enforcement has begun. According to EU Perspectives, Commission Executive Vice-President Henna Virkkunen confirmed the Commission's first formal information requests under the AI Act on 29 August 2026 [17]. Agence Europe reported that the Commission specified on 1 September 2026 that the AI Office had sent these requests to more than 30 AI providers [18]. It quoted Commission spokesperson Thomas Regnier as saying the first strand "concerns safety and security" and the second "focuses more on copyright and transparency issues" [18]. EU Perspectives reported that the requests ask how companies secure their models, whether independent experts have reviewed them and how the models are monitored once deployed [17]. None of the sources reviewed for this article contains an official list of recipients, so reports naming specific companies are treated here as unconfirmed.
The Digital Omnibus: what moved, and what did not
The Commission proposed the Digital Omnibus on AI on 19 November 2025 [3]. Its proposal linked the start of the high-risk rules to the availability of standards and other support tools, with a backstop: Annex III rules would apply at most 16 months, and Annex I rules at most 12 months, later than originally envisaged [6]. Parliament and Council reached a political agreement on 7 May 2026 [3]. Parliament adopted its first-reading position on 16 June 2026, the Council adopted the act on 29 June 2026, it was signed on 8 July 2026 and it was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 [5]. The Commission states that it entered into force on 27 July 2026 [2].
The legislative question is therefore settled: the delay is law, not a proposal. The final text replaced the proposal's standards-linked trigger with fixed dates. Chapter III, Sections 1 to 3, now applies from 2 December 2027 for high-risk systems classified under Article 6(2) and Annex III, and from 2 August 2028 for those classified under Article 6(1) and Annex I [1]. The recital explains that the original date of 2 August 2026 was moved because of the delayed availability of standards, common specifications and alternative guidance [1]. In the Commission's description, the December 2027 date covers areas including biometrics, critical infrastructure, education, employment, migration, asylum and border control, and the August 2028 date covers products such as lifts or toys [3].
Other changes are narrower. Article 5 gains new prohibitions on AI systems that generate or manipulate non-consensual intimate material and child sexual abuse material, applying from 2 December 2026 [1][2]. Providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the Article 50(2) marking obligation [1]. The regulation's recital calls this a four-month transitional period [1], whereas the Council's press release describes the grace period as reduced "from 6 months to 3 months" [4]; the official text and the press release differ in how they describe it. Article 4 was rewritten so that providers and deployers "shall take measures to support the development of AI literacy" of their staff [1]. The deadline for each Member State's national AI regulatory sandbox moves to 2 August 2027 [1], and the Commission says certain SME privileges are extended to small mid-cap companies [3].
Two points deserve attention. High-risk systems used by public authorities that were already on the market must still comply by 2 August 2030 [1]. And the Commission's high-risk classification guidelines remain in draft: they were published on 19 May 2026, consultation closed on 23 July 2026 after an extension, and the Commission plans to adopt the final version by the end of 2026 [15]. On standards, CEN and CENELEC adopted exceptional procedures in October 2025 with the aim of delivering AI standards by Q4 2026 [16]. Whether that target holds is not confirmed in the sources reviewed here.
Who enforces
According to the Commission, from 2 August 2026 the AI Office and Member State authorities are responsible for implementing, supervising and enforcing the AI Act [2]. The AI Office oversees GPAI models and AI systems integrated into very large online platforms, national competent authorities handle other AI systems, and the European Data Protection Supervisor supervises systems used by EU institutions [13]. The Omnibus amends Article 75 to make the AI Office exclusively competent for AI systems based on GPAI models where the model and the system come from the same provider or the same undertaking, with exceptions that include systems related to Annex I products [1].
National readiness is uneven, and the most recent comprehensive tally found for this article is several months old. The Future of Life Institute's tracker, last updated on 17 June 2026, rated the designation of national competent authorities as clear in 9 Member States, partially clear in 12 and unclear in 6 [14]. It recorded Spain's Artificial Intelligence Supervisory Agency as single point of contact and a market surveillance authority, and noted that Germany's draft law designating the Federal Network Agency still had to pass the Bundestag and the Bundesrat [14]. The picture may have changed since June, and this article has not independently confirmed each Member State's current status.
What companies are checking now
The following reflects what the law and official guidance describe, not legal advice. The first question is role: the Commission distinguishes providers, who develop or release systems, from deployers, who operate them in specific contexts [12]. The second is whether any use case touches the Article 5 list, including the additions applying from 2 December 2026 [1]. The third is transparency: the Commission published a voluntary Code of Practice on marking and labelling AI-generated content on 10 June 2026 [9], and reported that about 190 organisations had signed it by the end of July 2026 [10].
For GPAI model providers, the relevant references are the obligations in force since August 2025, the 2 August 2027 deadline for legacy models [7] and the GPAI Code of Practice [8]. For organisations with possible high-risk systems, the Commission's FAQ lists deployer duties that include human oversight, use in line with provider instructions, informing affected employees and, for public authorities and providers of public services, fundamental rights impact assessments [12]. The draft classification guidelines are the most detailed official reading so far of what falls into the high-risk categories [15].
In our assessment, the additional 16 months for Annex III systems is better read as preparation time than as a pause. With the classification guidelines still in draft and the standards timetable not confirmed in the sources reviewed, the detailed content of high-risk compliance remains partly unsettled, even though the dates are now fixed in law.
Sources
[1] Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) — Official Journal of the European Union (EUR-Lex), 24 Jul 2026
[2] AI Act — European Commission, Shaping Europe's digital future, last updated 3 Aug 2026
[3] EU agrees to simplify AI rules to boost innovation and ban 'nudification' apps to protect citizens (IP/26/1024) — European Commission press release, 7 May 2026
[4] Artificial Intelligence: Council gives final green light to simplify and streamline rules — Council of the EU press release, republished by the EEAS, 30 Jun 2026
[5] Procedure file 2025/0359(COD): Digital Omnibus on AI — European Parliament Legislative Observatory, accessed 1 Oct 2026
[6] Digital Package — European Commission, 20 Nov 2025
[7] Guidelines for providers of general-purpose AI models — European Commission, last updated 28 Apr 2026
[8] The General-Purpose AI Code of Practice — European Commission, last updated 31 Jul 2026
[9] Commission publishes Code of Practice on marking and labelling AI-generated content — European Commission, 10 Jun 2026
[10] Strong backing for the Code of Practice on Transparency of AI-generated Content — European Commission, 31 Jul 2026
[11] Commission publishes the Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act — European Commission, 4 Feb 2025
[12] Navigating the AI Act — European Commission, last updated 7 Aug 2026
[13] The enforcement framework of the AI Act — European Commission, last updated 24 Aug 2026
[14] Overview of all AI Act National Implementation Plans — Future of Life Institute, last updated 17 Jun 2026
[15] Targeted consultation on the draft guidelines for the classification of high-risk artificial intelligence systems — European Commission, 19 May 2026
[16] Update on CEN and CENELEC's Decision to Accelerate the Development of Standards for Artificial Intelligence — CEN-CENELEC, 23 Oct 2025
[17] The AI Act gives Brussels new powers. Frontier labs are first in line — EU Perspectives (Lucie Pazderkova), 1 Sep 2026
[18] European Commission sends first requests for information to more than 30 AI providers — Agence Europe, 2 Sep 2026