The EU AI Act: a legislative timeline for businesses

The EU Artificial Intelligence Act¹ entered into force on 1 August 2024, but its obligations apply in phases. Some are already in force. The most consequential ones take effect on 2 August 2026, unless the proposed Digital Omnibus² delays them. Here is what you need to know.

What is already in force

Since 2 February 2025, two requirements apply to every business that uses or provides AI systems. First, you must ensure your staff understand the AI systems they work with. The European Commission has clarified that simply asking people to read the manual is not enough – you need a proportionate, documented effort.³ Second, AI that materially distorts behaviour through manipulative and deceptive techniques, or infers emotions in the workplace, is already banned. The penalties for infringement are up to EUR 35 million or 7% of global turnover (Art 99).

Since 2 August 2025, obligations for providers of large foundation models (ie OpenAI, Anthropic, Google, etc) and the EU’s governance and oversight bodies are in place (Art 113). Most small companies are not directly affected by this phase, unless they fine-tune models substantially enough to become providers themselves.

What comes on 2 August 2026

This is the big date. The Regulation’s core obligations become applicable: high-risk AI system requirements, deployer obligations, transparency rules, and national enforcement.

High-risk classification depends on the purpose of the system, not its complexity (Art 6). AI used in recruitment, worker monitoring, credit scoring, insurance, or education is likely high-risk. Providers of such systems face substantial requirements: risk management, technical documentation, conformity assessment, CE marking. Deployers must ensure human oversight, monitor the system, and inform affected individuals that AI is involved in decisions about them (Art 26).

Transparency obligations apply regardless of risk level (Art 50). If your product talks to people, they must know it is AI. If it generates content, that content must be machine-readably labelled. These obligations are not affected by the Digital Omnibus.

In Estonia, the Consumer Protection and Technical Regulatory Authority has been designated as the supervisory authority but has not yet published compliance guidance.⁴

The Digital Omnibus

The Council and Parliament have both agreed in principle to postpone the high-risk obligations until 2 December 2027 (standalone systems) and 2 August 2028 (embedded systems).⁵ Trilogue negotiations are underway, with a second session scheduled for April 2026.⁶

The postponement is politically likely but procedurally uncertain. For it to take effect, the amended regulation must be published in the Official Journal before 2 August 2026. If it is not, the original deadline applies. Transparency obligations and everything already in force remain unchanged regardless.

What this means for your business

Start by identifying your role: are you a provider, a deployer, or both (Art 3(3) and (4))? Then assess whether any of your AI systems fall within the high-risk categories. The compliance work (documentation, risk assessment, quality management) takes months. Beginning now means you will be ready on time regardless of the Omnibus outcome.