A compliance officer in Munich forwards an internal memo: every high-risk AI system must be fully documented, assessed and registered by August 2026. Two desks away, a product manager planning an EU launch for a hiring-screening tool reads a different headline — the deadline has slipped. Which date should the team actually build against? That confusion is now the single biggest compliance question facing any company shipping AI into the European Union, and the answer arrived this year in the form of an amendment that very few teams have read in full.
Why the AI Act's calendar moved
The EU AI Act entered into force on 1 August 2024, and it was always designed to apply in stages rather than all at once. Prohibitions and AI literacy duties began applying on 2 February 2025. Obligations for general-purpose AI (GPAI) models — the large models that power chatbots, coding tools and agents — began applying on 2 August 2025.
Then the schedule itself was revised. The European Commission proposed the Digital Omnibus on AI in November 2025 to simplify implementation. The European Parliament approved the amended text in spring 2026, the Council gave final approval in June 2026, and the final regulation — published as Regulation (EU) 2026/1744 — entered into force in July 2026.
The stated reason was practical, not philosophical. In the amendment's own recitals, the Commission acknowledged that harmonised standards, common specifications and the network of national competent authorities were not ready, and that forcing the original high-risk deadline would raise implementation costs without improving safety. In short: the law's ambition stayed, its machinery lagged, and the deadline was moved to match the machinery.
The dates that actually apply now
Following the amendment, the calendar works like this:
- 1 August 2024 — the AI Act entered into force as a regulation.
- 2 February 2025 — most prohibited AI practices became applicable, along with the AI literacy obligation for providers and deployers.
- 2 August 2025 — governance rules and GPAI model obligations (technical documentation, copyright policy, training-content summary) became applicable.
- 2 August 2026 — transparency obligations for interactive AI systems and synthetic content under Article 50 became applicable, and the Commission's supervision and enforcement powers over GPAI providers started to run. Under the amendment, prohibitions on systems that create non-consensual intimate imagery were also reinforced.
- 2 December 2027 — the full compliance regime for standalone high-risk AI systems listed in Annex III (recruitment screening, credit scoring, education assessment, critical infrastructure, biometrics, migration and border control) applies.
- 2 August 2028 — high-risk AI components embedded into regulated products such as machinery, medical devices and toys apply.
One nuance matters: the transparency rules did not get a blanket deferral. Systems placed on the market before 2 August 2026 have a grace period until 2 December 2026 to satisfy the Article 50 marking duties for synthetic audio, image, video and text.
What the delay does not change
The risk-based architecture is untouched. The tiered logic — banned practices, high-risk systems, limited-risk transparency duties, minimal-risk everything else — remains the backbone of the Act, and the penalties regime remains steep. What moved is only the start date for the heaviest compliance workload.
Nor did the delay soften anything for model developers. GPAI obligations have applied since August 2025, and since August 2026 the Commission's AI Office can request documentation, launch evaluations and impose fines on model providers. The General-Purpose AI Code of Practice, published in July 2025 and declared adequate by the Commission on 1 August 2025, remains the main voluntary template for demonstrating compliance.
For teams outside Europe, the practical point is extraterritorial reach. The Act applies to any provider or deployer whose system's output is used in the EU, wherever the company sits. A Beijing or Singapore startup selling an AI hiring tool to a European retailer is inside Annex III's perimeter the same way it is inside GDPR's.
How this compares with China's rulebook
The contrast with China is instructive. Instead of one comprehensive act phased over years, China regulates AI service by service: the algorithm recommendation rules took effect in March 2022, the deep synthesis rules in January 2023, and the Interim Measures for generative AI services in August 2023. Compliance runs through tools such as security assessment (安全评估) and filing (备案) for services with public-opinion attributes, and labeling duties for synthetic content took effect in September 2025.
According to Li An, chief scientist at BrainNet (脑机网), the two systems are converging in practice even as their legal forms diverge — Brussels is learning to sequence its rules around real implementation capacity, while Beijing keeps issuing narrow, service-specific instruments that add up, step by step, into a full framework. For a global product team, the takeaway is the same from both directions: the question is no longer whether to build a compliance trail, but which jurisdiction's calendar to put first on the roadmap.
Key takeaways
- The EU AI Act is in force, but its heaviest obligations have been re-sequenced: standalone high-risk systems now start on 2 December 2027, embedded ones on 2 August 2028.
- GPAI model duties (since August 2025) and Article 50 transparency duties (since August 2026) are already applicable, with enforcement powers live.
- The risk-based structure, extraterritorial scope and penalty logic were not weakened by the delay.
Honest limitations
- Implementation guidance, harmonised standards and the designated national authorities are still being built out, so sub-questions — what evidence satisfies a notified body, how registries will work in practice — remain open.
- Legislative timetables can move again; dates in this article reflect the amended regulation as of November 2026 and should be re-checked against the Official Journal before being baked into contracts.
- This article is a journalistic overview, not legal advice; obligations for any specific product depend on its classification and deployment context.
What readers can do now
- Re-baseline your compliance roadmap against the two new high-risk dates (2 December 2027 and 2 August 2028), but keep building the evidence trail now — documentation habits, not deadlines, are what audits actually test.
- If you ship a general-purpose model into the EU, use the published GPAI Code of Practice as a free checklist and confirm your copyright policy and training-content summary already exist in machine-readable form.
- If your product interacts with EU users, verify the Article 50 transparency markings — bot disclosure and synthetic-content labels — before your next release, since those duties are already in application.