The EU AI Act is the world’s first comprehensive AI law. It entered into force on 1 August 2024 and is rolling out in staggered phases through 2030. As of April 2026, two of its four major implementation waves have passed. A third — covering high-risk AI systems — is about to be formally delayed by the Digital Omnibus on AI, currently in trilogue negotiations. And all of this is unfolding against a global backdrop in which the EU, the US, China and a growing number of other jurisdictions are taking fundamentally incompatible approaches to governing artificial intelligence.
This article gives you the full picture: what is already in force, what the Omnibus delay means in practice, how the August 2, 2026 date is being recalibrated, and where global AI regulation stands right now.
What Is Already in Force (April 2026)
August 1, 2024 — Entry into Force
The regulation entered the EU legal order, triggering a two-year awareness and preparation phase. No compliance obligations were immediately enforceable, but every subsequent deadline started running from this point.
February 2, 2025 — Prohibited Practices and AI Literacy
The first substantive wave is now fully active and enforceable. Six categories of AI are banned outright:
- Social scoring by public or private entities
- Subliminal manipulation causing harm
- Exploitation of vulnerable groups
- Real-time remote biometric identification in public spaces (with narrow law enforcement exceptions)
- Biometric categorisation inferring sensitive attributes such as race, religion, political views or sexuality
- AI-based emotion recognition in workplaces and schools
AI literacy obligations for providers and deployers are also active. Organisations must ensure that staff working with AI systems have adequate competence to understand and manage what they are using. This is less prescriptive than it sounds — the Act does not define minimum training hours or certifications — but it creates a documented duty of care that regulators can examine.
August 2, 2025 — GPAI Models and Governance Framework
General-purpose AI model obligations applied from this date to all providers of foundation models and large language models serving the EU market. Requirements include technical documentation, EU copyright law compliance, training data summaries, and bias and toxicity evaluations before deployment. For high-impact GPAI with systemic risk, adversarial testing and incident reporting to the European Commission are mandatory.
The EU AI Office is now operational as the central EU-level enforcement body for GPAI.
There is, however, a significant structural problem. Despite the August 2025 deadline under Article 70, only 8 of 27 EU member states had formally designated their national competent authorities by the required date. Without national market surveillance authorities, notifying authorities and single points of contact in place, ground-level enforcement of AI Act provisions is effectively absent across most of the EU. This is not a technicality — it is a governance gap that affects how seriously any deadline should be read.
The August 2, 2026 Wave — What Was Planned
Under the original Act, 2 August 2026 was the flagship implementation date. The following obligations were scheduled to come into force:
- Annex III high-risk AI obligations: conformity assessments, quality management systems, risk management documentation, EU AI Database registration, and human oversight mechanisms
- Article 50 transparency rules: AI disclosure labelling for chatbots and watermarking of AI-generated synthetic audio, image and video content
- National and EU-level enforcement officially beginning
- At least one AI regulatory sandbox per member state becoming operational
- Full financial penalties becoming enforceable: up to €35 million or 7% of global annual turnover for prohibited practices; up to €15 million or 3% for high-risk violations
The eight Annex III high-risk sectors are: biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential services (including credit scoring, insurance, and social benefits), law enforcement, administration of justice and democratic processes, and border management.
The Digital Omnibus on AI — The Delay Explained
What the Omnibus Proposes
On 19 November 2025, the European Commission published the Digital Omnibus on AI — a targeted amendment to the Act aimed at adjusting timelines and reducing compliance burden. The central change is a significant delay in when high-risk AI obligations actually bite.
| Obligation | Original Deadline | Commission Proposal | Parliament & Council Position |
| Annex III high-risk AI (standalone) | 2 Aug 2026 | Conditional trigger | Dec 2, 2027 (fixed) |
| Annex I high-risk AI (regulated products) | 2 Aug 2027 | Conditional trigger | Aug 2, 2028 (fixed) |
| Article 50 watermarking (existing systems) | 2 Aug 2026 | Delayed | Feb 2, 2027 |
| Article 4 AI literacy (general) | Active Feb 2025 | Abolished | Abolished (training for high-risk deployers remains) |
Both the Parliament and the Council rejected the Commission’s original conditional trigger mechanism — which would have made high-risk deadlines dependent on an executive adequacy decision — in favour of fixed, predictable dates. This consensus position is very likely to survive trilogue intact.
Additional Omnibus Provisions
- An explicit ban on deepfake sexual abuse content added to the Act
- A proposed ban on AI nudifiers — systems creating non-consensual intimate imagery
- Broader bias detection data permissions extended from high-risk providers to all AI system providers and deployers
- Registration of self-assessed non-high-risk systems (those in Annex III contexts that a provider deems not high-risk) reinstated by both institutions
- Parliament proposes that systems meeting Cyber Resilience Act requirements are presumed compliant with AI Act security requirements
Why the Delay Is Happening
Four factors explain it:
- Missing technical standards: the harmonised European standards (CEN/CENELEC) that companies need to demonstrate conformity with Annex III requirements are not yet published. Without them, consistent compliance certification is technically impossible.
- Member state unreadiness: only 8 of 27 NCAs were designated by the August 2025 deadline. Enforcing high-risk rules without national authorities in place would create a legally hollow obligation.
- Industry pressure and competitiveness concerns: European companies, particularly SMEs, have lobbied extensively for more time. The EU also faces political pressure not to appear more burdensome than US and Chinese competitors moving toward deregulation.
- Broader simplification agenda: the Omnibus is part of the Von der Leyen Commission’s second-term push to reduce regulatory burden across digital legislation, also touching GDPR, NIS 2 and the Data Act.
Critics — including the European Data Protection Board, the European Data Protection Supervisor, and civil society groups — have argued that delays could affect fundamental rights protections and represent a regulatory backslide on rules only recently negotiated. This tension is real. The Act was designed as a preventive instrument; delaying its teeth while AI deployment accelerates changes the risk calculus it was built on.
The Trilogue Timeline — Where Things Stand (April 2026)
The legislative process has moved with unusual speed, driven by the pressure of the August 2026 deadline:
- 13 March 2026: Council of the EU adopted its negotiating mandate
- 18 March 2026: IMCO/LIBE committees adopted the joint Parliament position (101 votes for, 9 against, 8 abstentions)
- 26 March 2026: European Parliament adopted the full position in plenary (569 votes for, 45 against); first political trilogue meeting began the same day
- 28 April 2026: Target date for political agreement in trilogue
- May–June 2026: Formal Parliament and Council endorsement expected if agreement is reached
- July 2026: Potential publication in the Official Journal — before the August 2 deadline
The Cypriot Council Presidency has made the Digital Omnibus on AI a priority. As of early April 2026, the Parliament and Council are broadly aligned on fixed dates and major provisions. A deal is likely — but not guaranteed.
The risk: If trilogue collapses or endorsement is delayed past 2 August 2026, the original high-risk obligations apply as written. Organisations should treat August 2 as the operational deadline until Official Journal publication confirms otherwise.
Is August 2, 2026 Still a Meaningful Date?
Yes — significantly so, even if the Omnibus passes in time. The date does not disappear; it is disaggregated.
| Still applies on August 2, 2026 | Shifts to December 2, 2027 (if Omnibus passes) |
| Article 50 transparency for new systems deployed from Aug 2, 2026 onwards Full GPAI enforcement activation Regulatory sandbox obligation per member state | Annex III conformity assessments, QMS and risk management documentation Full Annex III financial penalties EU AI Database registration for most high-risk systems |
August 2, 2026 transitions from ‘the date everything starts’ to a more nuanced milestone: transparency obligations for new systems begin, legacy GPAI enforcement fully activates, and the sandboxes must open. The heavy-lifting Annex III compliance machine is deferred to December 2027.
Global AI Regulation: Where Every Major Jurisdiction Stands
The world has fractured into three structurally incompatible regulatory paradigms:
- EU — Rights-based and risk-based comprehensive regulation: mandatory horizontal law covering all sectors; extraterritorial reach to any AI serving EU users; highest fines globally
- US — Innovation-first deregulation: no federal AI law; Trump revoked Biden-era AI safety requirements in January 2025; states filling the vacuum with their own laws; active federal effort to preempt state rules
- China — State-directed control: mandatory content regulation and pre-launch security assessments enforced by the Cyberspace Administration of China; AI as instrument of state governance
| Jurisdiction | Framework | Approach | Binding? | Max Penalty | Status |
| European Union | EU AI Act (2024/1689) | Risk-based, horizontal, extraterritorial | Yes | €35M or 7% global turnover | Phased through 2028 |
| United States | No federal law; state patchwork | Innovation-first, sector-specific | Mostly voluntary federally; state laws binding | Up to $20,000/violation (Colorado) | Trump EO preemption push; 100+ state laws active |
| China | Algorithm Rules; GenAI Measures; Human-like AI Draft (2025) | State control, content filtering, registration | Yes | Up to ¥100,000; service suspension | Active CAC enforcement; new rules Dec 2025 |
| United Kingdom | No AI law; sector-led | Pro-innovation, principles-based | No comprehensive law | Varies by sector regulator | No AI bill in 2025; uncertain 2026; AI Growth Labs |
| Japan | AI Promotion Act (eff. Sept 2025) | Soft law, no fines | No penalties | None | Fully in effect; no risk-based framework |
| South Korea | Basic AI Act (eff. Jan 2026) | Risk-based, extraterritorial | Yes | TBD | In force; transparency and human oversight requirements |
| Canada | No federal AI law (AIDA died 2025) | Voluntary code of conduct | No | N/A | New legislation planned but unconfirmed |
| India | IT Amendment Rules 2026 (eff. Feb 2026) | Targeted, content/deepfake focus | Yes (for intermediaries) | Service suspension, legal liability | Active; 3-hour takedown rule |
| Brazil | Bill 2338/2023 (under review) | Risk-based, EU-inspired | Not yet in force | TBD | Still under Senate review |
Key Divergences
Scope and philosophy: The EU AI Act regulates the AI system itself across its entire lifecycle, regardless of sector. China focuses on AI content and public opinion risks. The US and India rely on downstream harm in specific sectors. Japan relies on voluntary guidelines.
Enforcement philosophy: The EU shifts the burden of proof to developers to demonstrate compliance before market entry. China requires pre-launch security assessments and state registration. The US largely requires accountability only after harm occurs. The UK relies on existing regulators applying their sector mandates.
Extraterritoriality: Only the EU AI Act and South Korea’s Basic AI Act explicitly claim extraterritorial application. Any organisation deploying AI to EU or Korean users must comply regardless of where the developer is based.
The Brussels Effect
Despite these divergences, the EU AI Act is emerging as the de facto global compliance benchmark for multinationals, because firms serving EU customers must comply regardless of home jurisdiction. Brazil’s pending bill is directly modelled on it. South Korea’s approach echoes its risk-based structure. EU compliance investments often translate into global compliance foundations — which changes the cost-benefit calculation for organisations deciding how seriously to take the Act.
Every major non-EU jurisdiction is explicitly attempting to attract AI investment by reducing compliance burden. Trump’s deregulatory posture, the UK’s AI Growth Labs, Japan’s penalty-free framework and India’s self-regulation preference all reflect the competing thesis that strict ex-ante AI regulation chills beneficial innovation. The EU’s Omnibus delay is partly a concession to this competitive dynamic. But it is a concession that preserves the underlying regulatory architecture rather than dismantling it.
What This Means for SME Compliance Planning
Three clear implications follow from where things stand:
If you deploy chatbots, generative AI tools or anything with deepfake risk: Article 50 transparency obligations for new systems apply from 2 August 2026 regardless of the Omnibus. AI disclosure labelling and synthetic content watermarking capability must be ready by then. This is not deferred.
If you are in scope of Annex III: The compliance runway extends to December 2027 if the Omnibus passes. But gap analysis, documentation and technical preparation should begin now. Conformity assessment for high-risk AI is complex; eighteen months is not generous once you account for procurement cycles and internal change management.
If you are a GPAI provider: August 2025 obligations are already live. Full enforcement by the EU AI Office is active. GPAI compliance documentation should already be completed.
Do not pause on the assumption the Omnibus will pass: The expected Official Journal publication window is July 2026. Until that publication, the legal default is August 2, 2026 for Annex III high-risk obligations. If the deadline shifts, you will have time you budgeted conservatively. If it does not, you will not be scrambling.
Full Implementation Timeline: 2024–2030
| Date | Obligation | Status |
| 1 Aug 2024 | AI Act enters into force | ✅ Done |
| 2 Feb 2025 | Prohibited practices + AI literacy obligations | ✅ Active |
| 2 Aug 2025 | GPAI model obligations + EU AI Office operational | ✅ Active (NCAs mostly missing) |
| 2 Aug 2026 | Article 50 (new systems); GPAI full enforcement; regulatory sandboxes | 🔜 Approaching |
| 2 Feb 2027 | Article 50 watermarking for pre-Aug 2026 systems (if Omnibus passes) | ⏳ Proposed |
| 2 Dec 2027 | High-risk Annex III obligations (if Omnibus passes) | ⏳ Proposed |
| 2 Aug 2028 | High-risk Annex I — sectoral safety legislation (if Omnibus passes) | ⏳ Proposed |
| 2 Aug 2030 | Legacy public-sector IT systems | 📅 Future |
| 31 Dec 2030 | Large-scale EU IT systems (Schengen, border databases) | 📅 Future |
