EU AI Act deadlines: what really applies now

The EU’s AI Act entered into force on 1 August 2024, but its obligations apply in stages. That is exactly what makes planning tricky for start-ups and SMEs. And since July 2026, there has been an extra twist: with the so-called Digital Omnibus, the EU amended the timeline after the fact, postponed key deadlines and softened some obligations. Here is the current state of play that you really need to know.

The timeline at a glance (as of October 2026)

The Regulation entered into force back on 1 August 2024, at that point without any immediate obligations. Since then, the obligations have been phased in step by step:

What the Digital Omnibus changed

In July 2026, the EU adjusted the AI Act with Regulation (EU) 2026/1744, the Digital Omnibus. The most important changes: the obligations for high-risk AI under Annex III were postponed by 16 months to December 2027, and those for Annex I products to August 2028. The AI literacy obligation in Article 4 was softened. Instead of having to “ensure” a sufficient level of AI literacy, you now have to support the development of AI literacy with concrete measures. The Omnibus also provides for additional relief on fines for small businesses.

Just as important is what was not postponed: the prohibitions still apply, the transparency obligations under Article 50 have applied as planned since 2 August 2026, and the training obligation that has applied since February 2025 remains in place.

What already applies today?

Since February 2025, two things have been binding that many businesses overlook. First, the prohibitions: if you use emotion recognition in the workplace, for example, you are already in breach of the Regulation. Second, Article 4: you must take measures so that your team uses AI competently. This affects practically every business that uses ChatGPT, Claude, Copilot or similar tools in its day-to-day work.

Since 2 August 2026: transparency and supervision

Since 2 August 2026, customer-facing chatbots must be recognisable as AI, deep fakes must be labelled, and AI-generated texts on matters of public interest need a notice if nobody holds editorial responsibility for them. One point where you can relax: ordinary company texts that have been reviewed by someone with the relevant expertise do not have to be labelled.

Supervision has also started: since the end of July 2026, the Federal Network Agency (Bundesnetzagentur) has been the central market surveillance authority under the German AI Market Surveillance Act (KI-MIG) and can request information and proof. For questions from small businesses, it runs the free AI Service Desk. What the Bundesnetzagentur is allowed to check as the AI supervisory authority, and what happens when it sends a request, is explained in the article Bundesnetzagentur: what the AI supervisory authority may do.

2 December 2026: the next key date

On that date, two new prohibitions inserted by the Digital Omnibus take effect: AI systems that generate intimate deep fakes of real people without their consent, and systems that generate child sexual abuse material. A transitional period also ends: generative AI systems that were already on the market before 2 August 2026 must then also mark their outputs in a machine-readable format as AI-generated. This obligation applies to the providers of the tools, not to you as a user. What you have to label yourself is explained in our article on AI labelling requirements.

What happens if you break the rules?

The fines are steep: breaches of the prohibitions can cost up to €35 million or 7% of worldwide annual turnover, and breaches of most other obligations up to €15 million or 3%. For SMEs and start-ups, the lower of the two amounts applies in each case, and the Digital Omnibus provides for further relief for small businesses. Even so, that is hardly reassuring.

How to use the time you have gained

• Create an inventory of all AI applications in your business, including the tools you buy in.
• Classify each application into the right risk category. For high-risk AI, you now have until the end of 2027, but you will need that time.
• Implement labelling under Article 50 if customers interact with your AI.
• Train your team and document the training.

How Klaus helps you never miss a deadline

Which deadline matters to you depends on three questions: which AI systems do you use, in what role (deployer or provider) and in which risk category? Klaus works through them with you in exactly that order:

• First, what has applied for a long time: during company onboarding, Klaus records your complete AI inventory in a chat and uses it to create your AI policy as a PDF. That puts in place the rules that Article 4 has required of you since February 2025. The training module covers the AI literacy obligation at the same time, including training records showing who was trained and when.
• Then a look ahead: for each AI system, Klaus guides you through an assessment project with six phases and 40 fixed topics. In phase 2, Klaus systematically classifies the system into its risk category and works through the topic “Liability, sanctions and deadlines”: which key date applies to this system and what needs to be done by then.
• Deadlines become tasks: after each phase, you get a to-do list sorted into “Urgent”, “Important” and “Can wait”, each with a time horizon. That way, you spread the work out until the end of 2027 instead of putting it off.
• In case the supervisory authority asks: from the assessment project, Klaus generates a compliance report as a PDF that is written for external reviewers, with a list of measures and a separate annex for requests for information and your responses. If the Bundesnetzagentur asks for proof, you do not have to scramble to pull everything together.

Conclusion

The AI Act timeline started to shift in 2026, but sitting and waiting is still the wrong strategy. The obligations that affect small businesses most often already apply, either since February 2025 or since August 2026. If you have taken care of your inventory, labelling and training, you can relax and watch the high-risk obligations being postponed.