The EU AI Act is the world's first broad law on artificial intelligence. It entered into force in August 2024 and applies in stages. In July 2026 the EU changed the timetable through the "Digital Omnibus on AI", delaying the strictest rules for high-risk systems while keeping others on schedule. If you build, buy or use AI in a business with customers or staff in the EU, including from the UK, this is what applies and when.
The timeline at a glance
AI Act enters into force
Regulation (EU) 2024/1689, applied in stages.
Prohibited practices and AI literacy
Bans on unacceptable-risk AI such as social scoring and manipulative systems.
General-purpose AI models
Obligations for providers of large models: documentation, copyright policy, and more for models with systemic risk.
Digital Omnibus in force
Regulation (EU) 2026/1744 changes the timetable and simplifies some rules.
Transparency obligations (Article 50)Now
Disclose AI interactions, label synthetic content and deepfakes.
New bans and labelling grace period endsUpcoming
Prohibition of AI generating non-consensual intimate images or CSAM; watermarking for systems already on the market.
National regulatory sandboxesUpcoming
Member states must have AI sandboxes running.
High-risk: stand-alone systemsUpcoming
Annex III areas such as employment, education, credit and essential services.
High-risk: AI in regulated productsUpcoming
Annex I products such as medical devices.
The four levels of risk
The Act sorts AI by what it is used for, not by the technology. The same model can be minimal risk in one use and high risk in another.
- Unacceptable risk: banned
- Social scoring, manipulative techniques, untargeted scraping of faces, emotion recognition at work or school, and from December 2026 AI generating non-consensual intimate content or CSAM.
- High risk: strict rules
- AI used for hiring and managing staff, education, credit scoring, insurance pricing, essential services, law enforcement and more. Needs risk management, data governance, logging, human oversight and registration.
- Limited risk: transparency
- Chatbots, AI-generated or manipulated images, audio, video and text, and emotion recognition. People must be informed.
- Minimal risk: no new rules
- Most AI, such as spam filters, recommendations and forecasting for internal planning. Voluntary codes of conduct encouraged.
What has applied since 2 August 2026
The transparency obligations in Article 50 took effect on schedule and apply to every in-scope system, regardless of when it was first put on the market:
- 1
Tell people they are talking to AI
Chatbots and voice agents must make clear they are AI, unless it is obvious from the context.
- 2
Mark AI-generated content
Providers of systems that generate images, audio, video or text must make the output identifiable as AI-generated in a machine-readable way. For systems already on the market before August 2026, this watermarking part has a grace period until 2 December 2026.
- 3
Disclose deepfakes
Anyone deploying AI to create realistic images, audio or video of real people or events must say so.
- 4
Label AI-written public information
Text published to inform the public on matters of public interest must be disclosed as AI-generated, unless a human has reviewed it and takes editorial responsibility.
Fines
Whichever is higher of the fixed amount and the share of worldwide annual turnover. Lower caps apply to SMEs and start-ups.
What the Omnibus changed
Delayed
- High-risk stand-alone systems: Aug 2026 → 2 Dec 2027
- High-risk AI in products: → 2 Aug 2028
- Watermarking for existing systems: → 2 Dec 2026
- National sandboxes: → 2 Aug 2027
Simplified
- AI literacy is now something the Commission and member states support, not a direct duty on every company
- AI that only assists users or optimises performance is not automatically high risk
- Some SME exemptions extended to small mid-caps
Added or kept
- New bans on AI generating non-consensual intimate images and CSAM
- General-purpose AI rules unchanged since August 2025
- Registration still required for self-assessed exempt systems
A practical checklist for data teams
Start here
- 1
Build an AI inventory
List every model and AI feature you build or buy: what it does, who uses it, which countries it reaches and who owns it.
- 2
Classify each use
Map each to banned, high, limited or minimal risk. Hiring, credit and insurance uses are the ones to look at carefully.
- 3
Fix transparency now
Add "you are talking to an AI assistant" notices and label generated images, reports and summaries that go to customers.
- 4
Document your data
High-risk systems need evidence of data quality and bias checks. Data lineage, tests and documentation, the core of analytics engineering, are exactly what auditors will ask for.
- 5
Use the extra time well
The high-risk delay is a window to build governance properly, not a reason to stop.
Check your understanding
1/3Which obligations have applied since 2 August 2026?
Article 50 transparency applied on schedule; high-risk rules were delayed to 2027 and 2028.
2/3An AI tool that screens job applicants is most likely...
Employment is one of the Annex III high-risk areas.
3/3Does the AI Act affect a UK business?
Like GDPR, the Act reaches companies outside the EU that serve the EU market.
You got 0 out of 3.
The rest of this month's AI rules, in the US and the EU, are in AI rules this month. Building AI features on your own data? See The best AI models in October 2026 and why good data quality tests matter more than ever.
Sources: Regulation (EU) 2024/1689 (AI Act); Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force 27 July 2026; Cloud Security Alliance research note on the high-risk deadline; Sidley Austin and Stephenson Harwood briefings. This is a plain-English summary, not legal advice; check the Official Journal text and take legal advice for your situation.
Alessandro Ecclesie AgazziWritten by Alessandro Ecclesie Agazzi, analytics engineer in London. Updated 21 October 2026. About me