The dates that matter
The Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024 and applies in stages. In July 2026, a package of amendments known as the AI Omnibus (Regulation (EU) 2026/1744) moved the high-risk dates back and added a ban. These are the dates as they stand now.
- The Act enters into force.
- The banned practices and the AI literacy duty apply.
- Rules for general-purpose AI models, governance and penalties apply.
- The AI Omnibus enters into force.
- Transparency duties apply: people must be told when they deal with AI, and AI-generated content must be marked.
- Marking duties reach systems already on the market before August 2, 2026. A new ban on AI-generated child sexual abuse material and non-consensual intimate imagery applies.
- General-purpose models placed on the market before August 2, 2025 must comply.
- High-risk rules apply to the uses listed in Annex III: employment, credit, education, essential services and others.
- High-risk rules apply to AI in products already regulated in the EU, such as machinery and medical devices (Annex I).
Dates as amended by Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026.
Who it applies to
The Act assigns duties by role. A provider develops an AI system or model, or has one developed, and puts it on the EU market under its own name. A deployer uses an AI system in the course of its work. Most organizations are deployers of most of their AI, and providers of whatever they build and offer to others.
Location does not settle the question. The Act applies to providers placing AI on the EU market wherever they are established, to deployers in the EU, and to providers and deployers outside the EU when the output of their AI is used in the EU. A US company that screens candidates for roles in Europe, scores customers in Europe, or monitors staff who work there can be inside its scope without an office in the EU.
Four tiers of obligation
The Act sorts AI by what it is used for, not by the technology underneath. The same model can sit in different tiers depending on the job it does.
| Tier | Examples | What it asks | Applies from |
|---|---|---|---|
| Banned | Social scoring; emotion recognition at work or in education; manipulation that causes harm | Do not use | February 2, 2025 |
| High-risk | Hiring and worker management; credit scoring; access to education; essential services; AI in regulated products | Risk management, data quality, logs, human oversight, documentation; duties for deployers too | December 2, 2027 (Annex III); August 2, 2028 (Annex I) |
| Transparency | Chatbots; AI-generated or manipulated content; emotion recognition and biometric categorization where allowed | Tell people; mark synthetic content | August 2, 2026 |
| Everything else | Spam filters, search, most internal productivity tools | No specific duties beyond AI literacy | Already |
What is banned already
Since February 2, 2025, these uses are prohibited in the EU, with narrow exceptions set out in the Act:
- Harmful manipulation, and exploiting people’s age, disability or social or economic situation to distort their behavior in ways that cause significant harm.
- Social scoring that leads to unjustified or disproportionate detrimental treatment.
- Predicting crime from profiling or personality traits alone.
- Untargeted scraping of facial images from the internet or CCTV to build facial recognition databases.
- Emotion recognition at work and in education, except for medical or safety reasons.
- Biometric categorization that infers race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation.
- Real-time remote biometric identification in publicly accessible spaces for law enforcement, outside tightly defined exceptions.
For employers, the emotion recognition ban is the one most often missed: interview and call-analysis tools that score a person’s emotional state at work fall within it. From December 2, 2026, the ban also covers AI used to generate child sexual abuse material or intimate imagery of identifiable people without their consent.
High-risk uses
Annex III lists the uses that make an AI system high-risk. For most businesses, three areas matter:
- Employment and worker management: targeted job ads, analyzing and filtering applications, evaluating candidates, decisions on promotion and termination, allocating tasks based on behavior or personal traits, and monitoring or evaluating performance.
- Access to essential services: creditworthiness and credit scoring, and risk assessment and pricing in life and health insurance.
- Education and training: admissions, evaluating learning outcomes, and proctoring.
The list also covers biometrics, critical infrastructure, public services, law enforcement, migration and the administration of justice. A system that only performs a narrow procedural task, or improves the result of work a person has already completed, can fall outside the tier; the provider has to document that view and register it.
Providers carry most of the work: risk management, data governance, technical documentation, logging, human oversight, accuracy and security, and a conformity assessment before the system goes on the market. Deployers have their own duties. They must use the system according to its instructions, assign human oversight to people with the competence and authority to exercise it, check that the input data is relevant, monitor the system and report serious incidents, and keep its logs for at least six months. Employers must inform workers and their representatives before putting a high-risk system into use at work. Public bodies, and deployers using AI for credit scoring or life and health insurance pricing, must also assess the impact on fundamental rights first.
People affected by a decision taken with a high-risk system have the right to a clear explanation of the AI’s role in it. These duties apply from December 2, 2027 for Annex III uses.
Transparency
Since August 2, 2026, providers must design AI that interacts with people so that they know they are dealing with AI, unless it is obvious, and must mark AI-generated audio, images, video and text in a machine-readable way. Deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest, unless a person has reviewed it and someone holds editorial responsibility. Deployers of emotion recognition or biometric categorization, where these are still allowed, must tell the people exposed to them.
Systems already on the market before August 2, 2026 have until December 2, 2026 to meet the marking duty.
AI literacy
Article 4 has applied since February 2, 2025. As amended in July 2026, it asks providers and deployers to take measures to support the development of a sufficient level of AI literacy among their staff and others who operate AI on their behalf, taking into account their knowledge, the context and the people the AI is used on. The Commission and member states support that work with guidance.
The amendment softened the wording; it did not remove the duty. Role-based training that is recorded, and measured by how people use AI afterwards, is the practical evidence an organization can show.
General-purpose AI models
Since August 2, 2025, providers of general-purpose models, the large models behind most generative AI products, must keep technical documentation, give downstream providers what they need to comply, have a copyright policy, and publish a summary of their training content. Models with systemic risk carry more: evaluation, adversarial testing, incident reporting and cybersecurity. A voluntary Code of Practice, published on July 10, 2025, sets out one way to meet these duties.
Most organizations are not providers of general-purpose models. They build on them, and the model provider’s documentation becomes part of their own evidence.
Penalties and enforcement
Fines reach up to 35 million euros or 7% of worldwide annual turnover, whichever is higher, for banned practices; up to 15 million euros or 3% for most other breaches; and up to 7.5 million euros or 1% for supplying incorrect or misleading information to authorities. For smaller companies, the lower of the two amounts applies. National market surveillance authorities enforce the Act in each member state; the European Commission’s AI Office supervises general-purpose models.
What to do now
Five steps put an organization in a position to know where it stands. None of them depends on the dates moving again.
- Map where your AI touches people in the EU, whether customers, applicants or staff, and note for each system whether you are its provider or its deployer.
- Check every use against the banned list now, with particular care for emotion recognition at work. The bans have applied since February 2025.
- Tell people and mark content: chatbots should say they are AI, and generated content should carry its marking.
- Prepare high-risk uses for December 2, 2027. For hiring, credit and education, plan human oversight, log retention, input data checks and worker information, and ask each provider for its instructions for use and documentation.
- Keep records of AI literacy measures for the people who use and oversee AI, by role.
Questions
Does the Act apply to a US company with no office in the EU?
It can. The Act applies to providers placing AI on the EU market wherever they are established, and to providers and deployers outside the EU when their AI’s output is used in the EU. Screening candidates for European roles, or monitoring staff who work in Europe, are common ways a US company comes into scope.
Is our hiring tool high-risk?
AI used to analyze or filter applications, evaluate candidates, decide promotions or terminations, allocate tasks, or monitor performance is on the Annex III list, with duties from December 2, 2027. Whether a particular tool falls in the tier depends on what it does; a tool that performs only a narrow procedural task may fall outside it, and the provider has to document and register that view.
Do we have to revalidate every time the model underneath changes?
In short: there is currently no broad regulatory requirement that enterprises revalidate a generative or agentic application every time an underlying model changes; certain regulated systems carry change-management or reassessment obligations, but those are use-case and jurisdiction specific.
Did the July 2026 changes remove the AI literacy duty?
No. They reworded it: providers and deployers must take measures to support a sufficient level of AI literacy among their staff, rather than ensure it. The duty has applied since February 2, 2025.
Who enforces the Act?
National market surveillance authorities in each member state, with the European Commission’s AI Office supervising general-purpose AI models.
Sources
Each link opens the regulation or the analysis used for this guide. Dates were checked on October 16, 2026.
- Regulation (EU) 2024/1689, the Artificial Intelligence ActEUR-Lex, Official Journal of the EU
- Regulation (EU) 2026/1744, the AI OmnibusEUR-Lex, Official Journal of the EU, July 24, 2026
- Regulatory framework for AIEuropean Commission
- The AI Act implementation timeline: what changes under the AI OmnibusFuture of Privacy Forum
- EU AI Omnibus enters into force, amending the AI ActWhite & Case
