EU AI Act: What Applies Now and What Comes in 2027 and 2028

Europe's AI law is no longer a future concern. According to the European Commission, the AI Act entered into force on August 1, 2024 and became applicable on August 2, 2026, with several exceptions. A simplification package known as the AI Omnibus then moved some of the most demanding rules to later dates. If your company sells or deploys AI in the EU, the dates now differ by type of system.

The timeline at a glance

• February 2, 2025: prohibited AI practices and AI literacy obligations started to apply.
• August 2, 2025: governance rules and obligations for general-purpose AI (GPAI) models became applicable.
• August 2, 2026: the Act became applicable more broadly. The Commission says its transparency rules take effect in August 2026, and the AI Office and national authorities are responsible for enforcement from that date.
• December 2026: a ninth prohibition, covering AI systems that generate non-consensual sexually explicit content or child sexual abuse material (such as so-called nudification apps), comes into effect. It was added by the AI Omnibus.
• December 2, 2027: rules for high-risk uses in sensitive areas listed in Annex III, including biometrics, critical infrastructure, education, employment, migration and border control.
• August 2, 2028: rules for high-risk AI built into regulated products listed in Annex I, such as lifts or toys.

What changed with the AI Omnibus

The Commission adopted the AI Omnibus proposal on November 19, 2025. A political agreement followed on May 7, 2026, and the changes entered into force on July 27, 2026. Besides the later high-risk dates and the new prohibition, the package strengthens the AI Office's oversight of systems built on GPAI models, extends some simplified requirements from SMEs to small mid-cap companies, and widens access to regulatory sandboxes.

The four risk levels

Unacceptable risk

Banned outright. Examples include social scoring, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools.

High risk

Allowed, but subject to obligations such as risk management, data quality, activity logging, documentation, human oversight, and robustness and cybersecurity requirements. CV-sorting software and credit scoring are among the Commission's examples.

Transparency risk

People must be told when they are talking to a chatbot. Providers of generative AI must make AI-generated content identifiable, and deepfakes and certain AI-written public-interest text must be clearly labeled.

Minimal risk

No new rules. The Commission says most AI systems in use in the EU, such as spam filters, fall here.

What it means for US companies

The Commission's AI Pact invites AI providers and deployers "from Europe and beyond" to prepare for the Act's key obligations, so US companies with EU users should check whether their products are in scope. Our reading of the timeline is that the priority for most US software teams in 2026 is transparency. Chatbot disclosures and labels on AI-generated content apply now, while full high-risk compliance programs have until late 2027 or 2028. Companies that offer GPAI models have had obligations since August 2025.

What to do now

• List every AI feature you offer in the EU and map it to a risk level.
• Check chatbot and AI-generated content disclosures against the transparency rules.
• If anything could be high-risk, start documentation and human-oversight work now; the 2027 deadline is about a year away.
• Follow the Commission's AI Act Service Desk for guidance updates.

More: latest IntechPulse coverage and our Editorial Policy.