Home › Guides · Updated 21 October 2026

The EU AI Act after the AI Omnibus: the new timeline explained

What the EU AI Act regulates, how the 2026 AI Omnibus changed its deadlines, the key dates from 2025 to 2028, and why it matters for UK businesses and users even after Brexit.

The EU's Artificial Intelligence Act is the world's first broad law regulating AI, and its timetable has just changed. In July 2026 an amending law, known as the AI Omnibus, came into force and moved several deadlines. If you follow AI news, the dates being quoted can now be out of date. This explainer sets out what the Act does, what changed and what it means if you're in the UK.

What the AI Act does

The AI Act (Regulation (EU) 2024/1689) takes a risk-based approach. Rather than regulating AI as one thing, the European Commission's overview of the framework describes rules that scale with the risk an AI system poses:

Unacceptable risk: banned. A short list of practices is prohibited outright, such as certain manipulative techniques and social scoring.
High risk: strict obligations. AI used in sensitive areas, such as recruitment, credit decisions, education or critical infrastructure, and AI built into regulated products like machinery or medical devices, must meet requirements on risk management, data quality, documentation, human oversight and accuracy.
Transparency risk: disclosure duties. People must be told when they're interacting with a chatbot, and certain AI-generated content must be labelled or marked.
Minimal risk: no new obligations. Most everyday AI, such as spam filters, falls here.

Separate rules cover general-purpose AI models, the large models behind many chatbots and image tools, with extra duties for the most capable ones.

What the AI Omnibus changed

The European Commission proposed the AI Omnibus on 19 November 2025 as part of a wider "digital omnibus" package. It was published as Regulation (EU) 2026/1744 and, according to the Commission, entered into force on 27 July 2026. The Commission presents it as simplification that keeps safeguards in place. The main changes are:

Later high-risk deadlines. Rules for high-risk systems listed in Annex III now apply from 2 December 2027, and rules for high-risk AI embedded in physical products covered by Annex I (machinery, toys, lifts and so on) from 2 August 2028.
Lighter rules for more companies. Some simplified obligations previously reserved for small and medium-sized enterprises are extended to small mid-cap companies.
A simplified AI literacy duty, with the Commission and member states taking a stronger role in promoting AI literacy.
A new ban on AI systems that generate non-consensual sexually explicit or intimate content, or child sexual abuse material.
Bias detection: providers may process special categories of personal data to detect and correct bias.
More sandboxes, including an EU-level regulatory sandbox, and wider oversight powers for the EU AI Office over certain systems built on general-purpose models.

All of these points are summarised in the Commission's announcement.

The timeline as it stands

Updated for the Omnibus, the Commission's AI Act Service Desk timeline gives these milestones:

Date	What applies
1 August 2024	The Act enters into force
2 February 2025	General provisions, including definitions and AI literacy, and the prohibitions
2 August 2025	Rules for general-purpose AI models; national authorities and EU governance bodies must be in place
2 August 2026	Most rules apply, including transparency rules in Article 50; enforcement starts for general-purpose AI, prohibitions, transparency and AI literacy
2 December 2026	New prohibitions on AI generating non-consensual sexual deepfakes and child sexual abuse material; transition deadline for some existing generators of synthetic content to meet Article 50(2)
2 August 2027	Each member state should have at least one AI regulatory sandbox running
2 December 2027	Rules for high-risk AI systems in Annex III
2 August 2028	Rules for high-risk AI embedded in products covered by Annex I

So, as of autumn 2026, the bans, the general-purpose AI rules and the transparency rules are already being enforced, while the heaviest high-risk obligations are still more than a year away.

Why it matters in the UK

The UK left the EU before the AI Act was agreed, so it isn't UK law. It can still reach UK organisations. The Act applies to providers that place AI systems on the EU market or put them into service in the EU, wherever they are based, and to providers and deployers outside the EU where the output of the system is used in the EU, as set out in Article 2 of the Regulation. A UK software company selling an AI recruitment tool to EU employers, for example, would need to look closely at the high-risk rules before December 2027.

For UK users, the effects are mostly indirect. Large AI companies often build one product for many markets, so EU transparency rules, such as chatbot disclosure and labelling of AI-generated content, may show up in the services you use here too. Whether they do is a business decision for each company.

The UK has so far taken a different route, relying on existing regulators and laws rather than one AI-specific act. Data protection law is one of the most important of those; our explainer on AI tools and your privacy covers settings you can change today.

Reading AI Act headlines carefully

Check the date of the article. Anything written before July 2026 may quote the old August 2026 date for high-risk rules.
"Delayed" isn't "scrapped". The Omnibus moved deadlines and simplified some duties; the core structure of the Act remains.
Look for the risk category. Most AI products are not high risk, so a headline about strict new rules may not affect a given tool at all.
Go to the source. The Commission's Service Desk timeline is kept up to date and is clearer than many summaries. For more on judging AI coverage, see our ten tips for following AI news without the hype.

This is a general explainer, not legal advice. If your organisation may be in scope, take specialist advice.

Frequently asked questions

When did the EU AI Act come into force?

It entered into force on 1 August 2024 and applies in stages through to 2 August 2028.

What is the AI Omnibus?

An amending regulation, Regulation (EU) 2026/1744, proposed in November 2025 and in force since 27 July 2026. It extends some deadlines, simplifies obligations for smaller companies and adds a new ban on AI that generates non-consensual intimate content or child sexual abuse material.

When do the high-risk AI rules apply now?

From 2 December 2027 for high-risk systems listed in Annex III, and from 2 August 2028 for high-risk AI embedded in products covered by Annex I.

Does the EU AI Act apply to UK companies?

It can. It applies to providers placing AI systems on the EU market, and to providers and deployers outside the EU where the system's output is used in the EU.

Which AI Act rules already apply?

The prohibitions and AI literacy provisions from February 2025, general-purpose AI rules from August 2025, and most remaining rules, including transparency duties, from 2 August 2026.

Sources and further reading

Facts and links checked on 21 October 2026. Spotted an error? Tell us and we will correct it.