Timeline, enforcement and the 2026 Digital Omnibus

0:00 Timeline, enforcement, Omnibus

Dates in the EU AI Act have moved, and quoting the wrong one in a client proposal is an easy way to lose credibility. In this lesson you'll get the full timeline as of September twenty twenty-six, understand what the twenty twenty-six Digital Omnibus changed, see the penalty structure, and build a dated compliance calendar for your own organization. One reminder: always confirm dates against the consolidated legal text, because this area keeps moving.

0:32 Why dates matter

Why spend a whole lesson on dates? Because they drive budgets and priorities. If you think high-risk rules apply next month, you might spend heavily on the wrong controls. If you think nothing applies until twenty twenty-seven, you might ignore chatbot disclosure, which is already live. Clients also judge your expertise by precision. Quoting the correct post-Omnibus dates in a proposal signals that you're current. Quoting outdated ones signals the opposite.

1:03 Timeline, part 1

Let's walk it. The Act entered into force on the first of August twenty twenty-four. On the second of February twenty twenty-five, the prohibitions and AI literacy started. On the second of August twenty twenty-five, general-purpose model obligations and the governance structure kicked in. The second of August twenty twenty-six is the general date of application, including the transparency duties in Article fifty, and the Commission's power to fine model providers. Remember the difference between entry into force, when the law exists, and application, when duties actually bite.

1:41 Analogy: a phased building code

An analogy for staged application: think of a new building code that phases in. On day one, the most dangerous practices are banned immediately. A year later, rules for the biggest suppliers of materials apply. Later still, general rules for every building kick in. And for complex structures like hospitals, the deadline is pushed back because the official testing standards aren't finished yet. That's the AI Act: bans first, model providers next, general rules after, and high-risk systems last, once the standards exist.

2:17 Timeline, part 2 (after the Omnibus)

Then came the Digital Omnibus on AI, Regulation twenty twenty-six slash seventeen forty-four. It was proposed in November twenty twenty-five, politically agreed on the seventh of May twenty twenty-six, adopted by the Council at the end of June, and entered into force on the twenty-seventh of July twenty twenty-six. It moved the high-risk dates: Annex three systems to the second of December twenty twenty-seven, and Annex one product systems to the second of August twenty twenty-eight. It also set the second of December twenty twenty-six as the end of the marking grace period for existing generative systems and the start of the ban on nudification tools. And legacy general-purpose models must comply by August twenty twenty-seven.

3:07 Omnibus: the big picture

Beyond the dates, the Omnibus rewrote the AI literacy duty into a more flexible form, added support for smaller companies including SMEs and small mid-caps, expanded testing and sandbox opportunities, and clarified the AI Office's role. The headline message for businesses: the direction of travel hasn't changed. High-risk rules are deferred, not canceled. Transparency duties are live. And the ban list got longer, not shorter.

3:35 Penalty caps

Now penalties. Prohibited practices carry fines up to thirty-five million euros or seven percent of worldwide annual turnover, whichever is higher. Most other obligations, including transparency, go up to fifteen million or three percent. Giving authorities incorrect or misleading information goes up to seven and a half million or one percent. The Commission can fine model providers up to fifteen million or three percent. And here's a detail that matters for smaller firms: for SMEs and start-ups, each cap is the lower of the two amounts, not the higher.

4:14 Who enforces

Who enforces what? National market surveillance authorities handle AI systems, including high-risk and transparency. Each Member State chose its own, sometimes an existing digital or data protection regulator. The AI Office handles general-purpose models. Data protection authorities keep enforcing GDPR. And sector regulators, like financial or medical device authorities, stay in charge where AI sits inside their products. If you're outside the EU, your exposure runs through whichever authority covers the market where your AI or its output is used.

4:49 SME roadmap

So what should a small business do right now? By the end of twenty twenty-six, have your inventory and classification done, your ban screen complete, AI literacy running, Article fifty disclosures live, a synthetic asset register, and vendor documentation on file. During twenty twenty-seven, mature your policy and management system, and test your incident process. And if you deploy any Annex three system, like an HR tool, be ready for deployer duties by the second of December twenty twenty-seven. The lesson text has a dated calendar template you can copy.

5:28 Example 2: fixing a proposal

A simple example of getting dates right. An agency in Dubai wrote in a September proposal that its client's AI recruitment screening would need to comply from August twenty twenty-six. After the Omnibus, that's wrong: Annex three high-risk duties now apply from the second of December twenty twenty-seven. The corrected proposal says so, adds that the client should still plan now because contracts and processes signed today will be running then, and notes that transparency duties for any candidate-facing chatbot already apply. Precise dates build credibility with clients.

6:06 Common mistakes

Three mistakes to avoid. Quoting the original high-risk date after the Omnibus changed it. Assuming postponed means canceled, when the obligations are exactly the same, just later. And confusing entry into force with application. The Act entered into force in twenty twenty-four, but most duties applied later. When a client asks is the AI Act in force, the precise answer is yes, and here's which parts apply to you, and from when.

6:37 Watch me do it: compliance calendar

Watch me do it. I open a tab called Compliance calendar with five columns: Date, Obligation, Owner, Status, Evidence link. I start with what already applies. Second of February twenty twenty-five: Article five screen of the inventory, owner AI lead, status done, evidence links to the screen column. Same date: AI literacy plan version one, done. Second of August twenty twenty-six: chatbot and voice agent disclosures live, owner marketing ops, done, evidence is the monthly disclosure test. Same date: deepfake labeling rule in the content procedure, done. Now the future dates. Second of December twenty twenty-six: confirm our generative tool vendors mark outputs, status in progress. Thirtieth of June twenty twenty-seven: readiness review for the HR screening tool. Second of December twenty twenty-seven: Annex three deployer duties apply, owner HR director. Then I export the three nearest dates to the team calendar, with reminders two months ahead. Finally, I add a note at the top: dates as of September twenty twenty-six, confirm against the consolidated text each quarter.

7:50 Recap and next step

Recap. Know the difference between entry into force and application. The key dates are February twenty twenty-five for bans and literacy, August twenty twenty-five for model rules, August twenty twenty-six for general application and transparency, December twenty twenty-six for marking and the new ban, and December twenty twenty-seven and August twenty twenty-eight for high-risk systems. Penalties scale with severity, and SMEs get the lower cap. Your next step: copy the calendar template, fill in owners and evidence links, and put the next three dates in your team calendar.