The Artificial Intelligence Regulation (2024/1689) did not start applying on a single day - it comes into force in stages spread over 2025-2028. That is good news and bad news at the same time: some obligations already apply to you (since 2 August 2026 that includes the transparency obligations under Art. 50), and Regulation 2026/1744 - the Digital Omnibus on AI - pushed high-risk systems back to 2 December 2027 and 2 August 2028.
- The AI Act (Regulation 2024/1689) comes into force in stages spread over 2025-2028, not on a single day.
- The transparency obligations under Art. 50 - including informing people they are dealing with AI and labelling synthetic content - have applied since 2 August 2026.
- The Digital Omnibus (Regulation 2026/1744) postponed the high-risk obligations: Annex III to 2 December 2027, Annex I to 2 August 2028.
- The AI literacy obligation under Art. 4 has applied since 2 February 2025 and was not postponed by the Digital Omnibus.
- Prohibited practices under Art. 5 carry fines of up to EUR 35 million or 7% of worldwide turnover.
Why this timeline?
The AI Act entered into force on 1 August 2024, but the EU legislator staggered the application of its individual chapters over time. The logic is simple: first the most dangerous things (prohibited practices), then the foundations (general-purpose models, supervision), and last the most operationally demanding package - high-risk systems.
What already applies under the AI Act? (as of September 2026)
From 2 February 2025: prohibited practices and AI literacy
- Prohibited AI practices (Art. 5) - among others, manipulative subliminal techniques, exploiting people's vulnerabilities, social scoring, untargeted scraping of facial images to build facial recognition databases, emotion recognition in the workplace and in education (with narrow exceptions). If any of your systems comes close to these categories - it is not a risk to be managed, it is a practice to be switched off.
- AI literacy (Art. 4) - providers and deployers of AI systems are obliged to support the development of AI literacy among the staff who use those systems, taking into account their knowledge, experience and the context of use. The Digital Omnibus softened the wording of the provision - it previously required ensuring a “sufficient level” of AI literacy - but did not repeal the obligation. Yes, this also applies to a company that “only uses” AI tools. Training in prompting is not enough - the point is understanding the risks, limitations and context of use.
From 2 August 2025: GPAI models and the supervisory architecture
- Obligations of providers of general-purpose AI (GPAI) models - technical documentation, information for integrators, a copyright compliance policy, a summary of the training data. For models posing systemic risk - additional obligations (evaluations, testing, incident reporting).
- Provisions on supervisory authorities and penalties - Member States set up national supervision (in Poland: KRiBSI, which inspects and fines from 28 October 2026), and the fine ranges become real: up to EUR 35 million or 7% of worldwide turnover for prohibited practices.
2 August 2026: transparency obligations (Art. 50) and most of the Regulation
From that date the bulk of the Regulation's remaining provisions applies - with one important exception: the package for high-risk systems under Annex III (including AI in recruitment and workforce management, creditworthiness assessment, education, access to public services) was postponed by Regulation 2026/1744 to 2 December 2027. The list of obligations has not changed, only the deadline has.
If your system falls into this category, the list of obligations is long:
- a risk management system throughout the system's life cycle,
- data governance and the quality of training data,
- technical documentation and record-keeping (logs),
- transparency and instructions for deployers,
- human oversight of the system's operation,
- accuracy, robustness and cybersecurity,
- conformity assessment and registration in the EU database (for providers).
Important: it is not only providers who have obligations. Deployers of high-risk systems are responsible, among other things, for using the system in accordance with its instructions, human oversight and monitoring its operation - and in some cases for a fundamental rights impact assessment (FRIA).
What does apply from 2 August 2026 without any postponement: the transparency obligations under Art. 50 - including informing users that they are interacting with AI, and labelling generated content and deepfakes. For systems placed on the market before that date, the transitional period for marking synthetic content (Art. 50(2)) ends on 2 December 2026.
What did the Digital Omnibus change in the AI Act timeline? (2 December 2027 and 2 August 2028)
The Digital Omnibus on AI (Regulation 2026/1744, in force since 27 July 2026) split the high-risk package across two deadlines. 2 December 2027 - stand-alone systems under Annex III. 2 August 2028 - AI systems that are a product, or a safety component of a product, covered by the EU harmonisation legislation listed in Annex I (Art. 6(1)): medical devices, machinery, toys, aviation. The latter go through the conformity assessment routes specific to their sectors, hence the longest transitional period. The postponement is not an amnesty: documentation, risk management and conformity assessment still take months.
The timeline in a nutshell
- 2 February 2025 - prohibited practices + AI literacy - in force
- 2 August 2025 - GPAI models, supervision, penalties - in force
- 2 August 2026 - the bulk of the Regulation, including the transparency obligations under Art. 50 - in force
- 2 December 2026 - end of the transitional period for marking synthetic content (Art. 50(2)) for systems placed on the market before 2 August 2026
- 2 December 2027 - high-risk systems under Annex III (HR, scoring, education, infrastructure) - postponed by Regulation 2026/1744
- 2 August 2028 - high-risk systems embedded in regulated products (Annex I, Art. 6(1)) - postponed by Regulation 2026/1744
What to do now - the minimum plan
- Take an inventory of your AI systems - including those bought as SaaS and those employees use “on the quiet” (we write about Shadow AI separately).
- Classify the risk - prohibited / high / limited (transparency) / minimal. You can start with our AI Act Check quiz.
- Establish your role - provider, deployer, importer, distributor. The scope of your obligations depends on your role. Watch out: by modifying someone else's system or branding it as your own, you can get “promoted” to provider.
- Close the AI literacy gap - documented training and rules of use for staff working with AI. What "supporting competence" means after the Omnibus is covered in the article on Art. 4.
- For high-risk systems - start yesterday - documentation, risk management and conformity assessment are months of work, not weeks.
This article is for information purposes only and does not constitute legal advice.