Quick answer — the deadlines that matter right now: Chatbot/AI-content disclosure rules are already in effect. High-risk standalone systems (hiring, credit scoring): now December 2027. High-risk systems in regulated products (medical, industrial, automotive): August 2028. Full breakdown below.
What the EU AI Act actually is
The EU AI Act sorts AI systems into risk categories and attaches different rules to each one — the riskier the use, the stricter the requirements. It applies based on where an AI system is used, not where the company that built it is based, so a US or Indian company serving European users can fall under it even without a European office.
The four risk tiers
- Unacceptable risk — banned outright. Things like government social scoring, manipulative AI designed to override someone's free will, and real-time biometric surveillance in public spaces for law enforcement. These have already been prohibited since early 2025.
- High risk — heavily regulated. AI used in hiring, credit scoring, education, critical infrastructure, and law enforcement. These require risk assessments, human oversight, and detailed documentation before deployment.
- Limited risk — transparency required. This covers chatbots and AI-generated content. People need to be told they're talking to AI, and AI-generated images, audio, or video generally need to be labeled as such.
- Minimal risk — mostly unregulated. Things like AI-powered spam filters or video game AI, where the law imposes essentially no extra burden.
The part most people underestimate: the transparency rules for limited-risk AI (chatbot disclosure, labeling AI-generated content) carry fines of up to €15 million or a percentage of global revenue, and they're not part of the deadlines that got delayed — see the timeline below.
The 2026 timeline, as it actually stands
The Act rolled out in phases starting in 2025, but in mid-2026 the EU significantly reworked the schedule for high-risk systems through what's called the "Digital Omnibus on AI." As of this writing, here's where things stand:
- Already in effect (since 2025): the outright bans on unacceptable-risk AI, and obligations for general-purpose AI models released after August 2025.
- Transparency rules for chatbots and AI-generated content: these were not pushed back and carry real penalties — this is the one most businesses still need to act on now.
- High-risk standalone systems (hiring, credit scoring, etc.): originally due August 2026, now delayed to December 2, 2027. The Digital Omnibus on AI formally entered into force on July 27, 2026, so this is confirmed law, not just a proposal.
- High-risk systems embedded in regulated products (medical devices, industrial machinery, automotive safety systems): pushed to August 2028.
One important detail: the Act generally isn't retroactive for systems already on the market before a given deadline, so exactly which rules apply to you can depend on when your specific system launched — this is genuinely one of the more complex parts of the law, and worth a real compliance review rather than guesswork if it applies to your business.
What this means if you're not a lawyer
- Using ChatGPT, Claude, or Gemini casually? This law isn't really about you — it targets the companies building and deploying AI systems, not individual users of consumer AI tools.
- Running a business that serves EU customers? If you use AI chatbots on your site or publish AI-generated marketing content to European users, the disclosure requirements likely already apply to you, regardless of where your business is based.
- Building or deploying AI in hiring, lending, or education? You now have more runway than originally planned — into 2027 or 2028 depending on the category — but the requirements themselves haven't gone away, just the deadline.
Frequently asked questions
Sources and further reading
Start with the legal text, then read the Commission’s own guidance. Dates have moved in 2026, so confirm against official pages.
Does the EU AI Act apply to companies outside Europe?
Yes, if your AI system is used by people in the EU. The law is based on where the AI is used, not where the company is headquartered — similar in spirit to how GDPR applies to non-EU companies handling EU residents' data.
Do I have to label AI-generated content?
For content aimed at EU audiences, generally yes — this transparency requirement is one of the parts of the Act that was not delayed, so it's worth checking now rather than waiting.
Has the EU AI Act been cancelled or watered down?
No — it's been rescheduled, not repealed. The core structure (risk tiers, bans, transparency rules) is unchanged; only the compliance deadlines for high-risk systems were pushed later, following pressure from businesses and governments over the original timeline.
What counts as a "high-risk" AI system under the Act?
Broadly, systems used in hiring, credit scoring, law enforcement, education access, and critical infrastructure — areas where a wrong AI decision has serious consequences for a person's rights or safety.
What happens if a company doesn't comply?
Penalties scale with severity and company size, with the highest tier reserved for banned-practice violations — figures are substantial enough that most affected businesses treat compliance planning as a real priority, not an afterthought.
Do small businesses get any exemptions?
Some obligations scale with risk and company size, and there's ongoing discussion about support for smaller businesses navigating compliance — but the core transparency rules apply broadly regardless of company size.
Quick Compliance Self-Check
Not a legal assessment — just a starting point to see if this likely applies to you.