EU AI Act Timeline After the 2026 Digital Omnibus: What Applies When

The dates

What the Omnibus changed: the high-risk obligations were originally due on 2 August 2026 (Annex III) and 2 August 2027 (Annex I). The Omnibus gives the delayed availability of standards and of national authorities as the reason for moving them (recital 40).

Are you a provider or a deployer?

Most obligations depend on your role. A deployer uses an AI system under its authority (Art. 3(4)), for example a company running a vendor's agent on its customer service. A provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name (Art. 3(3)). Putting into service includes supplying a system for own use (Art. 3(11)), so a company that builds its own agent and uses it is the provider of that system.

A deployer becomes a provider of a high-risk system if it puts its name on one, substantially modifies it, or changes the intended purpose of a system so that it becomes high-risk, for example using a general-purpose agent to screen job applicants (Art. 25(1)).

What applies to companies using AI agents today

If your agent is only answering questions or drafting text for staff, these are usually the only AI Act duties until December 2027. The GDPR applies in full in the meantime: see AI agents and GDPR.

If your agent is used for a high-risk purpose

An agent used for one of the Annex III purposes, such as recruitment and selection, decisions on promotion or termination, task allocation based on personal traits, creditworthiness and credit scoring, or life and health insurance pricing, is a high-risk use. From 2 December 2027 its deployer must, among other things (Art. 26):

• use it according to the provider's instructions, with human oversight by competent and authorised people;
• make sure input data it controls is relevant and sufficiently representative;
• monitor its operation and inform the provider and authorities of risks and serious incidents;
• keep the logs it controls for at least six months;
• inform workers and their representatives before using it at the workplace, and inform people that decisions about them are made with its help.

Deployers that are public bodies or provide public services, and deployers using credit scoring or life and health insurance pricing systems, must also carry out a fundamental rights impact assessment (Art. 27). Since the Omnibus they can reuse their GDPR DPIA by cross-reference (Art. 27(4) as amended).

Penalties

Prohibited practices can be fined up to €35 million or 7% of worldwide annual turnover, whichever is higher; most other obligations up to €15 million or 3%; supplying incorrect information up to €7.5 million or 1% (Art. 99(3) to (5)). For SMEs, including start-ups, the lower of the two amounts applies (Art. 99(6)); the Omnibus extends that to small mid-cap enterprises for the €15 million and €7.5 million tiers (Art. 99(6a)).

What to do now

1. List every AI system and agent you use or build, and note whether you are provider or deployer for each.
2. Check each against the prohibited practices (Art. 5) and the Annex III purposes.
3. Put AI literacy measures in place for the people who use them.
4. Add the Article 50 notices: an AI-interaction notice in chat interfaces and disclosure of generated content where it applies.
5. For any high-risk use, plan for 2 December 2027: oversight roles, logging, worker information and, where required, the fundamental rights impact assessment.

Start with a register. Our DPIA Helper screens an agent deployment under the GDPR, which the AI Act's impact assessment can now build on.

Sources

• Regulation (EU) 2024/1689 (AI Act), Articles 3, 4, 5, 25 to 27, 50, 99, 111, 113 and Annex III, EUR-Lex
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 24.7.2026, EUR-Lex

Related tools