EU AI Act delays high-risk deadlines but keeps existing rules

The EU AI Act regulates AI through a risk-based framework, banning unacceptable uses such as social scoring while imposing stricter requirements on high-risk applications. Systems used in healthcare, transportation and critical infrastructure face requirements covering risk mitigation, data quality, user information and human oversight. Limited-risk systems carry transparency obligations, while minimal-risk tools such as spam filters remain freely usable.

The Digital Omnibus on AI amendments entered into force on 27 July 2026, postponing major high-risk compliance deadlines because standards and national authorities were not ready. The revised dates are 2 December 2027 for standalone high-risk systems, including hiring and credit-scoring tools; 2 August 2028 for AI embedded in regulated products; and 2 August 2030 for high-risk systems used by public authorities.

Existing obligations remain enforceable. Prohibited-practice bans have applied since 2 February 2025, and general-purpose AI providers have faced obligations since August 2025. The AI Office gained enforcement powers over those providers, including fines, on 2 August 2026. Transparency rules for chatbots and deepfakes also became applicable on 2 August 2026.

National market surveillance authorities and the European AI Office oversee enforcement. Violations involving banned applications can attract fines of 35 million euros or 7% of a company’s total worldwide annual turnover, whichever is higher. Businesses must also account for overlapping European privacy and security regulations, making data governance, explainability and cybersecurity priorities despite the extended timetable.