The EU AI Act, decoded for builders and deployers.

Status as of 5 October 2026

Applies now

• The original eight Article 5 prohibitions and the Article 4 AI literacy duty, since 2 February 2025. The Omnibus reframed AI literacy as a duty to take supporting measures; it "does not require providers or deployers to guarantee any specific level of AI literacy of any individual" (Article 4(1)).
• GPAI model obligations (Articles 53 and 55), since 2 August 2025. Commission enforcement powers over GPAI providers, including fines, since 2 August 2026.
• Article 50 transparency obligations, since 2 August 2026.
• Enforcement at national and EU level of the prohibitions, AI literacy, transparency and GPAI rules, since 2 August 2026.

From 2 December 2026

• Two new Article 5 prohibitions: AI systems that generate non-consensual intimate or sexually explicit imagery of an identifiable person (Article 5(1)(ba)), and AI systems that generate child sexual abuse material (Article 5(1)(bb)). Placing such a system on the market is banned only where that generation is its intended purpose, or where it is a reasonably foreseeable and reproducible outcome and the system lacks reasonable and adequate safeguards; use is banned only where the deployer uses the system for that purpose (Article 5(1a)).
• The Article 50(2) marking deadline for generative systems placed on the market before 2 August 2026 (Article 111(4)).

Deferred to 2027 and 2028

• 2 August 2027: GPAI models placed on the market before 2 August 2025 must comply (Article 111(3)), and each Member State should have at least one AI regulatory sandbox operational.
• 2 December 2027: high-risk obligations for Annex III use cases: biometrics, critical infrastructure, education, employment, essential services (including credit scoring and life and health insurance pricing), law enforcement, migration and justice (Article 113(c)(i)).
• 2 August 2028: high-risk obligations for AI in products covered by Annex I, such as machinery, toys, lifts and medical devices (Article 113(c)(ii)).

Who's in scope

The Regulation applies beyond the EU. A provider established outside the EU is in scope if its AI system or model is placed on the Union market or used inside the Union. The Act regulates five roles: provider, deployer, importer, distributor and authorised representative. Each role carries its own obligations, and one firm often holds several roles for the same system over its lifecycle.

Deployers in financial services, insurance, hiring, education and law enforcement have obligations even if they did not build the model. If you substantially modify a system or put your name on it, you generally take on provider duties for that version.

The four risk tiers

1. Unacceptable risk (Article 5). Eight practices have been prohibited since 2 February 2025: harmful manipulation or deception; exploiting vulnerabilities; social scoring; predicting criminal offences based solely on profiling or personality traits; untargeted scraping to build facial-recognition databases; emotion recognition in workplaces and education, except for medical or safety reasons; biometric categorisation that infers sensitive characteristics such as race or sexual orientation, which does not cover labelling or filtering lawfully acquired datasets; and real-time remote biometric identification in publicly accessible spaces for law enforcement, unless strictly necessary for narrowly defined objectives such as searching for specific victims, preventing an imminent threat to life or a terrorist attack, or locating suspects of serious offences, and then only with prior authorisation and safeguards. Each prohibition has a defined scope, so check the article text before treating a use case as banned. The Omnibus adds two more from 2 December 2026: AI systems for generating non-consensual intimate imagery of an identifiable person, and for generating child sexual abuse material. Placing such a system on the market is banned only where that generation is its intended purpose, or where it is a reasonably foreseeable and reproducible outcome and the system lacks reasonable and adequate safeguards; use is banned only where the deployer uses the system for that purpose (Article 5(1a)).
2. High risk (Article 6, Annex III, Annex I). Eight Annex III areas (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice), plus AI that is a safety component of a product covered by the sectoral laws in Annex I. Under Article 6(3), an Annex III system is not high-risk if it does not pose a significant risk of harm, for example because it only performs a narrow procedural task or improves the result of a previously completed human activity. That exception never applies to profiling of natural persons. Application: 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
3. Limited risk and transparency (Article 50). Duties cover AI interactions such as chatbots, machine-readable marking of synthetic content, emotion recognition, biometric categorisation, deepfakes and AI-generated text on matters of public interest. Applies since 2 August 2026. Generative systems placed on the market before then have until 2 December 2026 to meet the Article 50(2) marking duty.
4. Minimal risk. Everything else. The AI Act sets no system-specific obligations, but the AI literacy duty and other EU law still apply.

For chatbot notices and AI-generated content, use the Article 50 transparency guide to connect each use case to the disclosure, the responsible role and the evidence to retain.

High-risk obligations (Articles 8 to 17)

These apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.

• A risk management system maintained across the lifecycle.
• Data and data governance: training, validation and testing data must meet quality criteria.
• Technical documentation aligned with Annex IV.
• Record-keeping, with logs generated automatically where appropriate.
• Transparency to deployers, including instructions for use.
• Human oversight measures built into the system.
• Accuracy, robustness and cybersecurity.
• A quality management system (Article 17), conformity assessment (Article 43), CE marking, registration in the EU database (Article 49), post-market monitoring (Article 72) and serious-incident reporting.

High-risk systems placed on the market before the relevant date are caught only if their design changes significantly after that date. Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 in any case (Article 111(2)).

The GPAI track

Articles 51 to 55 set up a separate regime for general-purpose AI models, in two tiers. Standard GPAI (Article 53) requires technical documentation, a public summary of training content and an EU copyright policy. GPAI with systemic risk (Article 55) applies above the 10²⁵ FLOP training-compute threshold or where the Commission designates a model, and adds model evaluation, adversarial testing, serious-incident reporting and cybersecurity protection.

The obligations have applied since 2 August 2025. Since 2 August 2026, the AI Office can request technical documentation, evaluate models, require corrective measures and impose fines. On 29 August 2026, Executive Vice-President Henna Virkkunen stated that, "as a first step in enforcing the AI Act", the AI Office had sent formal requests for information to a number of GPAI providers concerning "model security, independent external evaluations, and the monitoring of models once they are available on the market". Separate requests went to providers that had not published training-content summaries. Models placed on the market before 2 August 2025 must comply by 2 August 2027.

The GPAI Code of Practice and the Commission's guidelines for GPAI providers are the practical reference most providers follow until harmonised standards are available.

What the Omnibus changed, and what it did not

Changed

• High-risk dates moved. Annex III rules apply from 2 December 2027 instead of 2 August 2026. Annex I rules apply from 2 August 2028 instead of 2 August 2027.
• Two new prohibitions from 2 December 2026, covering AI systems for generating non-consensual intimate imagery and child sexual abuse material, subject to the intended-purpose and safeguards conditions in Article 5(1a).
• Article 50(2) transition. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to apply machine-readable marking.
• AI literacy simplified. Providers and deployers must take measures to support AI literacy, with no specific level required, and the Commission and Member States take a stronger role in promoting it.
• Extended AI Office oversight of certain AI systems, including those built on general-purpose models and those embedded in large online platforms and search engines.
• Proportionality for more firms. Some simplified requirements for SMEs, including simplified technical documentation, now extend to small mid-cap companies. Access to regulatory sandboxes is wider, including an EU-level sandbox.

Did not change

• The risk-based structure and the Annex III areas.
• The original eight prohibitions, in force since 2 February 2025.
• GPAI obligations, and the start of Commission enforcement on 2 August 2026.
• The 2 August 2026 application date for Article 50 transparency for new systems.

What to do now

Providers of AI systems

• Ship Article 50 interaction notices and machine-readable marking now. If a generative system was on the market before 2 August 2026, close the marking gap before 2 December 2026. See the Article 50 guide.
• Before 2 December 2026, check each generative system against the two new prohibitions: is such content an intended purpose, or a reasonably foreseeable and reproducible outcome? If so, confirm that reasonable and adequate safeguards prevent it and correct reported misuse, and keep evidence of them.
• Use the time before December 2027 to classify systems and build the risk-management, data-governance, Annex IV documentation and quality-management evidence. The high-risk decision tree is a starting point.

Deployers

• Keep records showing your AI literacy measures are in place.
• Apply Article 50 deployer duties now: notices for emotion recognition and biometric categorisation, and labels for deepfakes and for public-interest text that has not been editorially reviewed.
• Inventory Annex III use cases and prepare for the Article 26 deployer obligations (human oversight, log retention, monitoring) and, where relevant, Article 27 fundamental rights impact assessments, before 2 December 2027.

GPAI model providers

• Assume a request for information can arrive at any time. Keep technical documentation, training-content summaries, the copyright policy and, for systemic-risk models, evaluation and security evidence ready to produce.
• Bring models placed on the market before 2 August 2025 into compliance by 2 August 2027.

Banks and insurers as deployers

• Credit scoring of natural persons, and risk assessment and pricing for life and health insurance, are Annex III high-risk uses. The obligations apply from 2 December 2027, not August 2026.
• Customer-facing chatbots and AI-generated customer communications fall under Article 50 now.
• Map AI Act obligations alongside existing model-risk, outsourcing and DORA controls so overlaps are visible. See EU AI Act for banks.

Where Sia RegAI fits

RegReview monitors the AI Act, the Omnibus, Commission guidelines, codes of practice and the national supervisory sources you choose. It keeps versions and routes changes, such as the date shifts above, to the owner of each affected system.

RegMatcher maps the applicable obligations to your AI inventory, policies and controls. It scores coverage gaps and drafts remediation, with a source trail back to the article and paragraph. Classification, legal interpretation and sign-off stay with your qualified reviewers.

The timeline you can't miss

Sources

• AI Act Service Desk, consolidated text of the AI Act as at 27 July 2026: Article 113, Article 111, Article 5, Article 4 and Article 50.
• EUR-Lex, consolidated version of Regulation (EU) 2024/1689 as at 27 July 2026.
• Regulation (EU) 2024/1689 (the AI Act), Official Journal.
• Regulation (EU) 2026/1744 (the AI Omnibus), Official Journal.
• European Commission, AI Act (Shaping Europe's digital future), and AI Omnibus enters into force, July 2026.
• AI Act Service Desk, Timeline for the implementation of the EU AI Act.
• European Commission, AI literacy: questions and answers.
• Executive Vice-President Henna Virkkunen, statement on the AI Office's requests for information, 29 August 2026.

This page is general information, not legal advice. Confirm the consolidated legal text, applicable guidance and the facts of your system before making a compliance decision.