The EU AI Act is no longer a future law. As of October 2026, its bans on the most harmful AI uses have applied since February 2, 2025, rules for the general-purpose models behind chatbots like ChatGPT since August 2, 2025, and most of the remaining law since August 2, 2026. The big exception is the strict regime for "high-risk" AI such as hiring and credit-scoring tools: a 2026 amendment known as the Digital Omnibus on AI pushed it back to December 2, 2027, and to August 2, 2028 for AI built into regulated products.
For the apps you open every day, the visible changes are smaller but real: chatbots have to tell you they are AI, deepfakes have to be labeled, AI-generated images and audio have to carry machine-readable marks, and "nudify" apps that create sexual images of real people without consent are being banned. Companies outside Europe, including US ones, are covered when they offer AI in the EU.
Key takeaways
- The AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024 and has been switching on in phases.
- The Digital Omnibus on AI (Regulation (EU) 2026/1744) has been in force since July 27, 2026 and moved the high-risk deadlines to December 2, 2027 and August 2, 2028.
- Chatbot disclosure and deepfake labeling rules apply from August 2, 2026; marking of AI-generated content gets a grace period to December 2, 2026 for systems already on the market.
- A new ban on AI that generates non-consensual intimate images or child sexual abuse material takes effect in December 2026.
- Fines for banned practices can reach EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
What is the EU AI Act? It is the European Union's law that regulates artificial intelligence by risk: a short list of uses is banned, some uses are allowed only with heavy safeguards, some must be disclosed to users, and most everyday AI is left alone.
What happened to the AI Act timeline in 2026?
The original law, published on EUR-Lex as Regulation (EU) 2024/1689, set its own calendar in Article 113. Most of the Act was due to apply on August 2, 2026, with the rules for AI inside regulated products (medical devices, toys, machinery and similar) following on August 2, 2027.
On November 19, 2025, the European Commission proposed a "Digital Omnibus on AI" as part of a wider package to simplify EU digital rules. Its argument: the technical standards companies need to prove high-risk systems comply were not ready. The Parliament and Council reached a provisional agreement on May 7, 2026, and Parliament approved it in plenary on June 16, 2026 by 423 votes to 57, with 174 abstentions.
The final text is Regulation (EU) 2026/1744 of July 8, 2026. It was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026, days before the deadline it was meant to move. The delay is now law.
- August 1, 2024
AI Act enters into force. - February 2, 2025
Banned practices and AI literacy provisions apply. - August 2, 2025
Rules for general-purpose AI models and EU governance apply. - July 27, 2026
Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force. - August 2, 2026
Most of the Act applies, including chatbot and deepfake transparency; Commission enforcement powers over general-purpose AI providers begin. - December 2, 2026
Grace period for marking AI-generated content ends for systems already on the market; new ban on AI-generated non-consensual intimate imagery and CSAM takes effect. - August 2, 2027
Deadline for general-purpose AI models placed on the market before August 2, 2025. - December 2, 2027
High-risk obligations for stand-alone uses in Annex III (hiring, education, credit, biometrics and more). - August 2, 2028
High-risk obligations for AI built into regulated products such as medical devices.
How does the AI Act sort the apps you use?
The law regulates uses, not "AI" as one thing. The same model can be minimal risk in a photo filter, a transparency case in a chatbot, and high risk when an employer uses it to rank job applicants.
| Risk tier | Example apps and uses | What the law requires | When it applies |
|---|---|---|---|
| Unacceptable (banned) | Social scoring, untargeted scraping of faces from the internet or CCTV to build face databases, emotion recognition at work or school, AI "nudify" tools | Prohibited outright | February 2, 2025 (first eight bans); December 2026 (nudify/CSAM ban added in 2026) |
| High risk | CV-sorting and hiring software, exam scoring, credit scoring that can deny loans, AI safety parts in medical robots | Risk management, quality data, logging, human oversight, registration, conformity checks | December 2, 2027 (stand-alone uses); August 2, 2028 (AI in regulated products) |
| Transparency | Chatbots, voice assistants, AI image and video generators, deepfakes | Tell people they are dealing with AI; label deepfakes; mark AI-generated content in a machine-readable way | August 2, 2026; marking grace to December 2, 2026 for existing systems |
| General-purpose AI models | The large models behind ChatGPT, Gemini, Claude, Copilot and similar | Technical documentation, copyright policy, public training-data summary; extra safety duties for the most capable models | August 2, 2025 (new models); August 2, 2027 (models already on the market) |
| Minimal or no risk | Spam filters, AI in video games, most photo enhancement and recommendation features | No new obligations under the AI Act | Not applicable |
Risk tier vs example apps vs obligation vs when it applies. Sources: Regulation (EU) 2024/1689; Regulation (EU) 2026/1744; European Commission AI Act overview (accessed October 2026).
Will the AI Act change chatbots like ChatGPT?
Chatbots are touched in two ways. First, as a product you talk to, a chatbot falls under the transparency rules in Article 50: since August 2, 2026, providers must design systems so people are told they are interacting with AI, unless that is obvious from the context. If you have used ChatGPT, Gemini or Copilot, you already know it is a machine; the bigger effect is on customer-service bots, AI phone agents and companion apps that could pass as human.
Second, the model underneath counts as a "general-purpose AI model." Since August 2, 2025, providers of new models have had to keep technical documentation, publish a summary of the content used for training, and have a policy for complying with EU copyright law. Models with "systemic risk", meaning the most capable ones, also have to evaluate and mitigate risks, report serious incidents and protect their cybersecurity. Models already on the market before August 2, 2025 have until August 2, 2027.
To show how to comply, the Commission published a voluntary General-Purpose AI Code of Practice on July 10, 2025. Its signatories include OpenAI, Google, Microsoft, Anthropic, Amazon, IBM and Mistral AI; xAI signed only the safety and security chapter. Since August 2, 2026, the Commission's AI Office can request documentation, evaluate models, order corrective measures and fine providers. Legal reporting in September 2026 said its first formal information requests went to dozens of AI companies in late August; no fines had been reported as of this writing.
Expect more disclosures and published documentation rather than different answers. For background, see our explainer on generative AI and ChatGPT.
What changes for hiring, school and loan tools?
This is where the law bites hardest, and where the delay matters most. Annex III lists sensitive uses, including AI that screens CVs, ranks candidates or monitors workers; AI that decides school admissions or grades exams; AI that scores creditworthiness; and certain biometric systems. Providers of these systems will need risk management, good-quality training data, logging, human oversight, accuracy and cybersecurity measures, and registration in an EU database. Employers and other users ("deployers") get duties too, such as using the system as instructed, keeping human oversight and informing workers when they are subject to it.
Those obligations now apply from December 2, 2027, not August 2, 2026. The amendment also says that systems already in use before the new dates are covered only if they are significantly changed afterwards. One part that did not move: emotion recognition in workplaces and schools has been banned since February 2, 2025, so an interview tool that claims to read candidates' emotions from their face is already off-limits in the EU, with narrow medical and safety exceptions.
What changes for photo, video and voice apps?
Generative image, video and audio apps fall mainly under transparency. Providers must mark synthetic output in a machine-readable way so it can be detected as AI-made, for example with watermarks or metadata. Systems already on the market before August 2, 2026 have until December 2, 2026 to comply; new ones had to comply from the start. Separately, anyone who uses AI to create a deepfake (realistic fake images, audio or video of real people, places or events) has to disclose that it is artificial, with lighter treatment for obviously artistic or satirical work.
The 2026 amendment added a new ban aimed squarely at photo apps: AI systems that generate non-consensual sexually explicit images of identifiable people, or child sexual abuse material, are prohibited. The Commission lists this ban as taking effect in December 2026. Ordinary features like background blur or auto-enhance are not affected.
AI built into regulated physical products, like medical devices or toys, is on the slowest track: August 2, 2028. AI in machinery is being moved under the EU Machinery Regulation instead of the AI Act's direct high-risk regime.
Does the EU AI Act apply to companies and people outside Europe?
Yes, for companies. Under Article 2, the Act covers providers that put AI systems or models on the EU market whether or not they are based in the EU, and providers or deployers in other countries when the AI's output is used in the EU. A US app with European users is in scope. Individuals using AI for purely personal, non-professional purposes do not take on deployer obligations, and AI used only for military, defense or national security is excluded.
For US readers, the law gives no direct rights, but global apps often ship one design everywhere, so disclosure labels and content credentials built for Europe may show up at home as well. That is a company choice, not a legal requirement. Penalties are steep: up to EUR 35 million or 7% of worldwide annual turnover for banned practices, and up to EUR 15 million or 3% for most other breaches, whichever is higher, with lower caps for small companies.
What should you do now?
- Look for the disclosure. If a support chat or phone agent serving EU customers does not say it is AI and it is not obvious, that is now a compliance question for the company. Ask directly.
- Check content credentials before sharing. On viral images and clips, look for an "AI-generated" label or content credentials in the app. From December 2, 2026, EU rules expect AI tools to mark their output, but a missing label does not prove an image is real.
- Report nudify apps and abusive deepfakes. Use the app store's report option and the platform's abuse tools. In the EU, the national market surveillance authority for the AI Act is the regulator for prohibited practices.
- Small businesses: list the AI you use. Note which tools touch hiring, staff monitoring, credit or customer decisions. Those may become high-risk uses on December 2, 2027, and you will need the vendor's documentation and a person who can oversee the output.
- Train your team. The AI literacy provision in Article 4 has applied since February 2, 2025 (the 2026 amendment revised its wording). Basic training on what your tools can and cannot do is sensible either way.
Where the AI Act stops: limits and caveats
- It is not a privacy law. Personal data used by AI is still governed by the GDPR. If you want to see how that law works in practice, read our GDPR in practice piece on WHOIS redaction.
- Most AI is untouched. Recommendation feeds, spam filters and photo filters carry no new AI Act duties. Other EU laws, such as the Digital Services Act, may still apply.
- Labels are not proof. Watermarks and metadata can be stripped, and tools outside the EU market may not add them. Keep verifying anything important.
- Enforcement is split. The AI Office handles general-purpose models; national authorities handle most other rules, so how quickly cases appear will vary by country.
- This is a summary, not legal advice. Companies with EU exposure should read the consolidated text on EUR-Lex and the Commission's guidelines.
For your own accounts, the basics still matter most: privacy settings, cautious app permissions and skepticism about what you see.
What happens next?
The next fixed dates are December 2, 2026 for content marking on existing systems and the nudify ban, August 2, 2027 for older general-purpose models, December 2, 2027 for high-risk uses such as hiring and credit, and August 2, 2028 for AI in regulated products. Moving these dates again would require new EU legislation, so treat them as the working calendar.
Frequently asked questions
Does the EU AI Act apply to US companies?
Yes, when they offer AI systems or models in the EU, or when their AI's output is used in the EU, even with no European office. A US app with EU users has to follow the rules for those users. US residents get no direct rights from the law, though companies may choose to apply the same features globally.
What AI uses are banned in the EU?
Since February 2, 2025, the Act has banned manipulative or exploitative AI that causes significant harm, social scoring, predicting crime from profiling alone, untargeted scraping of facial images, emotion recognition at work and school, biometric categorization to infer sensitive traits, and most real-time facial recognition by police in public spaces. The 2026 amendment adds AI that generates non-consensual intimate images or child sexual abuse material, from December 2026.
Will the AI Act change ChatGPT?
Mostly behind the scenes. The model provider has documentation, copyright and training-data summary duties, plus safety duties for the most capable models. Users may notice more disclosures and published model information rather than different answers.
Did the EU delay the AI Act?
Partly. Regulation (EU) 2026/1744 moved the high-risk rules to December 2, 2027 and August 2, 2028 and gave existing generators until December 2, 2026 to mark AI content. The bans, the general-purpose AI rules and most transparency duties were not delayed.
Who enforces the AI Act?
The European Commission's AI Office supervises general-purpose AI models and can fine their providers from August 2, 2026. National authorities in each EU country enforce most other rules.
Sources
- EUR-Lex: Regulation (EU) 2024/1689 (Artificial Intelligence Act) (accessed October 2026)
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI) (accessed October 2026)
- European Commission: AI Act, regulatory framework and application timeline (accessed October 2026)
- European Commission: The General-Purpose AI Code of Practice (accessed October 2026)
- European Parliament Legislative Train: Digital Omnibus on AI (accessed October 2026)
- AI Act text, Article 2 (scope) and Article 99 (penalties), artificialintelligenceact.eu (accessed October 2026)
- Matheson: The European Commission's first use of AI Act enforcement powers (accessed October 2026)
Top image: "Berlaymont building in Brussels" by almathias, CC0 1.0, via Wikimedia Commons (resized). Charts and tables by Thank You Robot.
0 Comments