The Digital Omnibus on AI (AI Omnibus) has now been published in the EU’s statute book.  This pushes back some of the application dates for the AI Act.  So, what’s applicable now and when will the rest become applicable?  This post gives an overview of key dates to be aware of and a timeline of when the obligations now become enforceable.

Note on terminology: for EU legislation, “applicable” means enforceable by a regulator.  We have avoided the term “in force”, as for EU legislation, “entry into force” often marks the start of a transition period, with the date the obligations become enforceable described as the “application” date.

Overview – transparency obligations ARE applicable from 2 August, prohibitions remain applicable

The AI Act’s transparency obligations will apply to a wide range of organisations using generative AI, and apply from 2 August 2026.

Transparency for providers (including for in-house chatbots)

The transparency obligations for providers are relevant to any organisations applying their name and trade mark to an AI system that creates content.  This includes any organisations who have developed a chatbot with their own branding.  Providers of AI systems designed to interact with individuals must tell those individuals they are interacting with an AI system, so any organisations with chatbots must ensure they are doing this clearly.

There is also an obligation on providers generating content to ensure that content is marked in a machine-readable format and detectable as AI-generated.  Again, this will apply to any organisations with in-house chatbots or any other AI tools with their branding, not just the model providers.  Most organisations will need to look to their model providers to address this, and should explore what providers are making available to allow them to comply.  There is a limited grace period to 2 December 2026 for AI systems placed on the market before 2 December 2026, for this obligation only.

Transparency for deployers

Deployers (organisations using generative AI) must also disclose deep fakes.  There is also an obligation to inform individuals of emotion recognition and biometric categorisation technologies.

The Commission has published guidelines on these obligations and providers and deployers can follow and sign up to a Code of Practice to demonstrate compliance for some of these obligations.

Prohibitions and AI literacy

The prohibitions (emotion recognition in the workplace, exploiting the vulnerable, etc..) have been applicable since 2 February 2025 and remain applicable. However, the deadlines for member states to establish market surveillance authorities is 2 August 2026. Market surveillance authorities also get their enforcement powers on 2 August 2026. So in practice, enforcement can commence when member states have set up their market surveillance authorities.

The AI literacy obligation has had some small updates but remains applicable for providers and deployers.  Providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf.

High-risk obligations pushed back

Obligations for providers and deployers of high-risk AI systems will now apply from 2 December 2027 for standalone AI systems (Annex III) and 2 August 2028 for AI systems embedded in a product (Annex I).

This will give the EU’s standardisation committee time to publish AI Act standards. The standards will set out how providers can comply with their obligations, and when published in the Official Journal, will create a presumption of conformity with the relevant AI Act obligations.

Timeline

We include an updated timeline for application dates below.

2 February 2025 – prohibitions

Prohibitions became applicable. 

2 February 2025 – AI literacy

The AI literacy obligation remains applicable for providers and deployers.

2 August 2026 – regulators

Deadline for establishing market surveillance authorities.  However, most member states are not on track to meet the deadline, so we can expect the designation process to continue over the coming months and years.

2 August 2026 – transparency obligations

See above.

2 August 2025 – general-purpose AI models (providers only)

Obligations for providers of general-purpose AI models have been applicable since 2 August 2025

2 August 2026 – end of grace period for general-purpose AI model obligations

The Commission committed to a year’s grace period on enforcement for signatories of its General-Purpose AI Code of Practice.

2 December 2026 – new application date for high-risk AI systems embedded in a product (and critical infrastructure)

Annex III high-risk obligations apply.

2 August 2026 – new application date for AI systems embedded in products

Annex I high-risk obligations apply.

Our take

Transparency obligations will become applicable on 2 August.  Businesses should ensure that they know whether these are relevant to them and put processes in place to comply.  For the provider obligations, this will mean ensuring they are informing individuals that they are interacting with a chatbot, and working with their model providers to address content marking obligations.

The AI Omnibus gives organisations more time to prepare for the AI Act’s high-risk requirements.

The AI Act’s high-risk provisions are product safety obligations, so the obligations for high-risk AI systems are very different to the compliance obligations under laws like the GDPR. Providers need to prepare detailed technical documentation to demonstrate compliance for the specific AI system, and assess and declare conformity for the AI system.  The obligations apply during the development life cycle and will be more challenging to retrofit after products are launched. 

Providers of standalone AI systems in sectors like financial services and HR tech may not have had to grapple with product safety laws before, so the extra time will provide a welcome opportunity to get up to speed. Providers should ensure they understand which of their products will be in-scope and what they have to do, decide how they will apply the new AI standards as they become available, and ensure they are on track to comply by 2 December 2027.

Deployer obligations are a more natural extension of existing obligations in the data protection and employment law spaces, with obligations addressing providing competent human oversight, informing individuals about AI use, and informing or consulting workers.  Deployers should ensure they have updated supplier onboarding, risk assessment processes, and contract templates to ensure they are ready to meet the uplifted compliance obligations for high-risk AI systems.

The additional time will be welcome to prepare for the new requirements before they take effect.