Victor Grösser

The EU AI Act, April–October 2026: Delays, Transparency Rules and What Applies Now

⚖️ Legal AI · 📅 · ✍️ · ⏱️ 7 min read

🏷️ Tags

Period covered: April–October 2026. Written on 20 October 2026.

If you build or deploy AI in Europe, the last six months changed the calendar you were planning against. The AI Act did not get repealed or radically rewritten, but its timeline moved, some obligations were softened, and a first big block of rules actually became enforceable on 2 August 2026. This is my attempt to put it in one place, with links to the primary sources at the bottom. It is a summary for builders, not legal advice.

The starting point

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. Bans on prohibited practices and the AI literacy duty came first, the obligations for general-purpose AI (GPAI) model providers started on 2 August 2025, and 2 August 2026 was the general date of application, including most rules for high-risk systems.

By spring 2026 it was clear that this last step was in trouble. The Omnibus regulation itself says why: harmonised standards were late, and many Member States had not yet set up their national competent authorities and conformity assessment structures. Companies were being asked to comply with high-risk requirements without the technical standards that are supposed to tell them how.

May: the Digital Omnibus deal

The Commission had proposed the "Digital Omnibus on AI" in late 2025 as part of its simplification agenda. On 7 May 2026 the European Parliament and the Council reached a provisional political agreement after nine hours of negotiations, as Reuters reported. Reuters framed it as "watered-down" rules; the Commission framed it as simpler, innovation-friendly implementation. Both descriptions are partly true, which is why the details matter.

The headline change is the high-risk timeline:

  • Annex III high-risk systems (stand-alone use cases such as biometrics, critical infrastructure, education, employment, migration, asylum and border control) now apply from 2 December 2027.
  • Annex I high-risk systems (AI built into products under EU product legislation, such as lifts or toys) now apply from 2 August 2028.

The agreement also added something new rather than removing it: a ban on AI systems that generate non-consensual intimate imagery and child sexual abuse material, the "nudification" apps. The Commission's enforcement page lists that prohibition as applying from 2 December 2026.

July: it becomes law

The deal was formally adopted as Regulation (EU) 2026/1744, published in the Official Journal and in force from 27 July 2026. EUR-Lex now has a consolidated version of the AI Act dated 27 July 2026, and the Commission's AI Act Service Desk marks Omnibus changes as "NEW" or "AMENDED" in its article-by-article text. That consolidated text is now the one to read; older summaries from 2024 and 2025 are outdated on dates.

A few changes in the Omnibus that I think are under-discussed:

  • AI literacy (Article 4) was rewritten. Providers and deployers still have to take measures to ensure sufficient AI literacy of their staff, but the new text explicitly says this does not require them to guarantee any specific level of AI literacy of any individual. The Commission, Member States and the AI Board get a stronger role in promoting literacy.
  • Small mid-caps (SMCs) get several of the reliefs that were previously reserved for SMEs, such as a simplified technical documentation form and priority access to sandboxes.
  • A new Article 4a sets conditions for processing special categories of personal data where strictly necessary for bias detection and correction.
  • Sandboxes: each Member State must have at least one national AI regulatory sandbox operational by 2 August 2027, and the AI Office may run a Union-level sandbox. Real-world testing outside sandboxes is extended to more high-risk categories.
  • Grace period clarified: under Article 111(2), if at least one unit of a type and model of high-risk system was lawfully on the market before the relevant date, other units of the same type and model fall under the same grace period.

August: what actually became enforceable

2 August 2026 still mattered, just for different things than originally planned. According to the Commission's enforcement framework page and the AI Act Service Desk FAQ, from that date the enforcement powers of the AI Office and national authorities apply to:

  1. Prohibited AI practices (manipulation, exploitation of vulnerabilities, certain social scoring and predictive policing based solely on profiling, and so on).
  2. Obligations for GPAI model providers, including transparency towards downstream providers, copyright policies, and the safety and security duties for models with systemic risk. The Commission can now fine GPAI providers up to 3% of worldwide annual turnover or €15 million, whichever is higher (Article 101). It can also request information, demand access for model evaluations, and in serious cases ask for a model to be restricted.
  3. Transparency obligations under Article 50.

The Article 50 rules are the ones most developers will feel first. Providers must design systems so people know when they are interacting with an AI system (chatbots, agents, avatars), and must add machine-readable marks to AI-generated or manipulated content. Deployers must disclose deepfakes, emotion recognition and biometric categorisation, and AI-generated text published to inform the public on matters of public interest when there was no human review or editorial control. The Commission lists fines of up to €15 million or 3% of turnover for companies.

There is one transitional detail worth noting: systems already on the market before 2 August 2026 have until 2 December 2026 to comply with the marking and detection duty in Article 50(2).

The Code of Practice on AI-generated content

To make Article 50 workable, the AI Office facilitated a Code of Practice on Transparency of AI-generated Content, drafted by independent experts. It has two sections: rules for providers on marking and detection, and rules for deployers on labelling deepfakes and AI-generated text. The EU also published a set of icons for labelling.

The Commission and the AI Board confirmed the code as an adequate voluntary tool to demonstrate compliance. Signing is voluntary, but the obligations are not: if you don't sign, you have to show that your own measures are equally adequate, assessed by each market surveillance authority. The Commission's page says about 190 companies and organisations had signed by the end of July 2026. Alongside the code, the Commission published guidelines on the scope of Article 50, including what counts as a directly interactive system, a deepfake, or standard editing that falls outside the rules.

What I take from it

Three practical points for anyone building AI products or agents in Europe:

  • Transparency is now, not 2027. If your product talks to people, label it. If it generates images, audio or video, plan for machine-readable marking. This applies to agents too: the Commission explicitly names AI agents and avatars.
  • The high-risk delay is not a holiday. Education and employment, two areas I care about for education tools, are Annex III. December 2027 is roughly fourteen months away, and standards still have to land. Documentation, logging and human-oversight design are much cheaper to build in than to retrofit.
  • Read the consolidated text. Many blog posts and slide decks still quote 2 August 2026 for high-risk rules. That date is gone.

On the bigger question, whether the Omnibus weakens protection or just makes the law workable, I don't think we'll know until the first enforcement decisions under Article 50 and the GPAI rules appear. The useful thing for builders is that the timeline is now fixed in law instead of in rumours.

For the wider context of what models shipped in the same period, see my AI models recap for April–June 2026 and July–October 2026, the open-weight models recap, and my curated links & repos.

Sources

More: all Legal AI posts · links & repos · RSS for Legal AI