The EU AI Act: Risk Tiers, Key Dates and the 2026 Omnibus Changes

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, is the first broad law regulating AI systems by the risk they pose. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. Its obligations apply in stages, and one of those stages was moved in 2026.

Four levels of risk

The Act sorts AI systems by what they are used for, not by the technology inside them:

• Unacceptable risk - prohibited. Practices banned outright, such as social scoring and AI that manipulates people in ways that cause significant harm.
• High risk - strict obligations. Systems used in areas listed in the Act, including employment, education, access to credit, law enforcement and critical infrastructure, and AI that is a safety component of regulated products such as medical devices or machinery. Providers must carry out risk management, keep documentation and logs, ensure human oversight, and meet accuracy and cybersecurity requirements.
• Limited risk - transparency. People must be told when they are interacting with an AI system, and AI-generated content must be marked as such.
• Minimal risk - no new obligations. Most AI applications, such as spam filters.

General-purpose AI models - the large models listed on this site's models page - have their own chapter, with extra obligations for models the Act classes as posing systemic risk. A model trained with more than 10^25 floating-point operations is presumed to fall in that class.

The heaviest fines, for prohibited practices, reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher.

What already applies

According to the implementation timeline maintained by the Future of Life Institute:

Date	What applies
2 February 2025	Prohibitions and AI literacy requirements
2 August 2025	General-purpose AI model obligations, governance, penalties
2 August 2026	The remainder of the Act, unless specified otherwise

General-purpose models already on the market before 2 August 2025 have until 2 August 2027 to comply.

The 2026 AI Omnibus

In 2026 the EU amended the Act through Regulation (EU) 2026/1744, known as the AI Omnibus. Reporting on its entry into force gives the key details: it was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The main changes:

• High-risk deadlines postponed. Stand-alone high-risk systems in the listed areas (Annex III) move from 2 August 2026 to 2 December 2027. AI in regulated products such as medical devices, machinery and toys moves to 2 August 2028.
• New prohibitions. AI systems built to create realistic non-consensual intimate imagery or child sexual abuse material are banned from 2 December 2026.
• Grace period for marking. Generative AI systems already on the market before 2 August 2026 get until 2 December 2026 to meet the machine-readable marking requirement for AI-generated content.

Later dates

The timeline continues beyond 2028. Each Member State must have at least one AI regulatory sandbox running by 2 August 2027, and high-risk systems used by public authorities must comply by 2 August 2030.

For the broader questions the Act is responding to - bias, accountability and safety - see AI Ethics: Understanding Bias, Safety and Responsible AI. For the main US counterpart, a voluntary framework rather than a law, see the NIST AI Risk Management Framework.