EU AI Act Deadlines: 6 Dates Every Business Must Track

The EU AI Act deadlines have moved, and if your compliance calendar still says August 2026 for everything, it is out of date.

The Digital Omnibus package reshuffled several dates. Some obligations got breathing room. Others did not move at all, and one even got tighter. Here is the thing: misreading which is which could leave you exposed to fines of up to 15 million euros or 3% of global annual turnover under Article 99.

Where the Digital Omnibus stands

Sources differ slightly on the legislative status, so check before you quote it to your board. A VerifyWise explainer describes a provisional political agreement reached on 7 May 2026. A Cloud Security Alliance research note reports that Parliament endorsed the package on 16 June and the Council gave final approval on 29 June 2026. Both agree on the dates below, and the AI Office and major law firms are treating them as the planning baseline.

For the official framework, the European Commission’s AI Act page remains the reference point.

The 6 EU AI Act deadlines that matter

Let me lay them out plainly.

2 February 2025, prohibitions and AI literacy. Unchanged. Banned practices under Article 5 and the AI literacy duty already apply.

2 August 2025, general purpose AI. Unchanged. Obligations for foundation model providers under Articles 51 to 55 have applied since then, so keep following the GPAI Code of Practice.

2 December 2026, watermarking and synthetic content. Moved from 2 August 2026. Generative features need labelling, machine-readable metadata and detection capability. One source notes the grace period for this duty was cut from six months to three, so do not treat the delay as a gift.

2 December 2026, new ban on non-consensual intimate imagery. The CSA note lists a new Article 5 prohibition on AI that generates non-consensual intimate imagery from the same date.

2 December 2027, stand-alone high-risk systems. Annex III systems, such as those used in hiring, credit scoring or education, moved from 2 August 2026.

2 August 2028, high-risk AI in regulated products. Annex I systems embedded in products like medical devices moved from 2 August 2027. Machinery gets a carve-out, with AI requirements handled through the Machinery Regulation.

Do not mistake delay for relief

Now, a quick reality check. The requirements themselves have not shrunk. Risk management, technical documentation, human oversight and post-market monitoring still apply to high-risk systems. The calendar moved, the workload did not.

And there is a practical reason to start early. Building an inventory of every AI system, classifying each against the Annex III categories and documenting your due diligence on third-party tools takes months, not weeks. Companies that start in 2027 will be rushing.

The new deadlines are also fixed calendar dates. They no longer depend on when standards bodies finish their work. That removes an excuse and adds certainty. A DLA Piper analysis covers the deferral in more legal detail if you need it.

Who gets simplified rules

Small mid-cap companies, defined in the CSA note as fewer than 750 employees with turnover of 150 million euros or less, or total assets of 129 million euros or less, get a simplified compliance framework. That is useful for growing firms that were worried about enterprise-level paperwork.

At the same time, the EU AI Office gets expanded investigation and enforcement powers, including on-site inspections. Softer calendar, sharper teeth.

What non-EU companies should do

If you are a software firm in Pakistan or the US selling into Europe, this applies to you. The Act reaches providers and deployers whose AI output is used in the EU. Many outsourcing and SaaS companies discover this only when a European customer sends a compliance questionnaire.

A sensible first quarter plan looks like this: list your AI features, tag the ones that touch hiring, credit, education or safety, check which generative features need labelling by December 2026, and assign one owner. One person with a spreadsheet beats a committee with no deadlines.

Also review your contracts. If you embed third-party models, ask providers what documentation they will give you. Your obligations as a deployer under Article 26 depend on getting that information.

Key Takeaways

• Watermarking date: Generative AI labelling and metadata duties apply from 2 December 2026, not August.
• High-risk delay: Annex III systems move to 2 December 2027 and Annex I products to 2 August 2028.
• Already live: Prohibited practices, AI literacy and general purpose AI duties are unchanged.
• Penalties stand: Fines of up to 15 million euros or 3% of global turnover remain under Article 99.
• Start the inventory now: Classification and documentation take months, whatever the calendar says.

How TecniForge Can Help

At TecniForge, we help businesses navigate these technology shifts. Whether you need custom software development, AI integration, or cloud migration, our team builds scalable solutions. Talk to our experts.

One last thing to ask yourself: could you list every AI feature in your product today, and say which risk category each one falls into?