This is a practical engineering summary, not legal advice. Confirm the dates against the amended regulation as published in the Official Journal of the EU, and involve counsel for your specific use case.
The EU AI Act applies in phases. In 2026 the EU agreed a "Digital Omnibus" package that postpones the obligations for high-risk AI systems, which many companies had been racing to meet by August 2026. Lawmakers reached a provisional agreement on 7 May 2026, Parliament voted to adopt it on 16 June 2026, and law-firm reports say the Council gave final approval at the end of June.
The EU AI Act timeline after the Digital Omnibus
| Obligation | Applies from | Changed? |
|---|---|---|
| Prohibited AI practices (social scoring, manipulative AI, most real-time remote biometric ID, emotion recognition at work and school) | 2 February 2025 | No |
| AI literacy duty for providers and deployers | 2 February 2025 | No |
| General-purpose AI (GPAI) model obligations | 2 August 2025 | No |
| Transparency duties (Article 50): tell people they are talking to AI, label deepfakes, mark AI-generated content | Largely 2 August 2026, with a short grace period reported for marking content from systems already on the market | Mostly no |
| Stand-alone high-risk systems (Annex III: hiring, credit scoring, education, essential services…) | 2 December 2027 | Yes, postponed |
| High-risk AI embedded in regulated products (Annex I: medical devices, machinery, toys…) | 2 August 2028 | Yes, postponed |
What this means if you build or sell AI software
If you ship a chatbot, voice agent or AI assistant
You are most likely limited-risk, and Article 50 is what applies to you, on roughly the original schedule. In practice:
- Tell users they are interacting with an AI system unless it is obvious from context. For voice agents, say it at the start of the call.
- Mark synthetic audio, images, video and text in a machine-readable way where your system generates them (watermarks or metadata such as C2PA content credentials).
- Label deepfakes and AI-generated text published to inform the public on matters of public interest.
Our ZetVoice AI agent and ZetDesk AI receptionist announce themselves as AI by default for exactly this reason.
If your AI makes decisions about people
Hiring, credit, insurance pricing, education access and benefits eligibility are Annex III use cases. You have until December 2027, but the work is substantial: a risk-management system, data governance, technical documentation, logging, human oversight, accuracy and robustness testing, a quality-management system, and registration in the EU database. Teams that start in 2027 will not finish in time.
If you fine-tune or build on a foundation model
GPAI obligations already apply to model providers. If you substantially modify a model and place it on the market under your own name, you may take on provider duties for that modification. Keep records of training data sources, compute and evaluation.
A 90-day plan that is useful whatever the final dates
- Inventory: list every AI feature, the model and vendor behind it, what data it uses, and who it affects.
- Classify: prohibited, high-risk (Annex I or III), limited-risk (Article 50) or minimal. Write down the reasoning.
- Close the transparency gaps now: AI disclosures in the UI, content marking and updated privacy notices. Our free AI disclaimer generator drafts the statement.
- Log and monitor: keep inputs, outputs, model versions and human overrides for high-impact decisions. This is also what GDPR Article 22 reviews will ask for.
- Secure the system: the Act's robustness and cybersecurity requirements overlap heavily with the OWASP Top 10 and basic hardening. Start with a website security audit of every public endpoint.
How the AI Act interacts with GDPR
The AI Act does not replace GDPR. If your AI system processes personal data you still need a lawful basis, a DPIA for high-risk processing, data-subject rights and processor agreements with AI vendors. Our GDPR-compliant AI development checklist covers that side.
ZetsApp designs AI products with compliance built in, including logging, human-in-the-loop review and EU-region hosting. See our AI development services or talk to an engineer.
Frequently asked questions
Has the EU AI Act been delayed?
Partly. The Digital Omnibus postpones high-risk obligations: stand-alone Annex III systems to 2 December 2027 and AI in regulated products (Annex I) to 2 August 2028. Prohibitions, AI literacy and general-purpose AI model duties already apply and were not delayed.
Do chatbots need to comply with the EU AI Act in 2026?
Yes, through the Article 50 transparency duties, which largely keep their original schedule: users must be told they are interacting with AI, and AI-generated content must be marked where applicable.
What counts as a high-risk AI system?
Systems listed in Annex III, such as AI used in hiring, credit scoring, education, essential public and private services, law enforcement and migration, plus AI that is a safety component of products covered by EU product law (Annex I).
What are the fines under the EU AI Act?
Up to €35 million or 7% of global annual turnover for prohibited practices, and lower tiers for other breaches. The Omnibus also eases some requirements for smaller companies, so check the final text.
