EU AI Act News: Timeline, Fines and the 2026 Delay

The EU AI Act is the world’s first full law on artificial intelligence, and as of October 2026 most of it is already live. The banned practices are banned, the rules for big general-purpose models apply, and since 2 August 2026 the transparency duties and the enforcement machinery are switched on too. What is not live yet is the heaviest part, the strict duties for high-risk systems, and Brussels has pushed those back by more than a year.

That pushback is the biggest single change in EU AI Act news this year, and it is why so many explainers now contradict each other. Pages written before mid-2026 quote deadlines that the Digital Omnibus quietly replaced. This hub uses the amended dates throughout, and flags every deadline the Omnibus moved.

The Act at a glance

The Commission calls it the first-ever comprehensive legal framework on AI anywhere in the world, and that is not marketing. Earlier laws in other countries cover slices of AI, such as hiring tools or chatbots. The EU law covers almost every AI system sold or used in Europe, and it reaches companies outside Europe too, as long as their systems or outputs are used inside the EU. The official text and guidance sit on the Commission’s AI Act page.

The timeline: seven dates that run the law

The Act was never switched on in one go. It applies in stages, and keeping EU AI Act news straight mostly means keeping these dates straight. Two dates have already passed quietly, one big stage landed in August 2026, and the rest now stretch to 2028 because of the delay covered below. The Commission’s own AI Act implementation timeline tracks the same stages.

One more date sits further out. AI built into the EU’s own large IT systems, such as border and visa databases, has until 2030 to comply, and member states must each have at least one regulatory sandbox running by August 2027. Sandboxes are supervised test spaces where companies can trial a system with a regulator watching before it launches.

One distinction trips up almost every reader. A law entering into force is not the same as it applying. August 2024 started the clock and made the staged calendar legally certain, but no company owed anything on that day. Duties switch on at each application date, which is why February 2025, not August 2024, is the first date any business had to act. When one headline says the Act began in 2024 and another says it starts in 2026, both are describing the same staircase from different steps.

Four levels of risk

The law’s core idea is simple. The more harm a system can do, the more rules it carries. At the top sit nine prohibited practices. The list bans AI that manipulates people into harmful choices, exploits the vulnerable, scores citizens socially, predicts who might commit a crime from personal traits, scrapes faces from the internet without a target, reads emotions at work or school, sorts people by sensitive traits from their body data, or identifies people in public in real time for police. The ninth ban, added by the Omnibus, covers AI built to generate non-consensual intimate images or child sexual abuse material, and it starts on 2 December 2026.

Below the bans sits the high-risk tier, split across two annexes. Annex I covers AI inside products that already have EU safety law, such as medical devices, machinery and lifts. Annex III lists standalone uses: biometric identification, critical infrastructure, education and exam scoring, hiring and worker management, access to credit, insurance pricing and public benefits, policing, migration and courts. High-risk systems must pass the strictest checks in the law, including risk assessment, high-quality training data, logging, technical documentation, clear information for the people using them, human oversight and solid accuracy and security.

Most AI lands lower down. Systems that talk to people or create content carry transparency duties only, and minimal-risk tools such as spam filters and game AI face no new rules at all, which is the position the vast majority of software stays in.

The rules for general-purpose AI

General-purpose AI, or GPAI, means the big models that sit underneath thousands of other products: the large language and image models from the major labs. Their duties started on 2 August 2025. Every provider must keep technical documentation, publish a summary of what the model was trained on, run a copyright policy and share information with companies that build on the model. In July 2025 the Commission published the tools that make this workable: guidelines on which models count, a template for the training summary, and the GPAI Code of Practice, a voluntary code that gives providers one accepted way to show they comply.

The strongest models carry a second layer. A model counts as systemic risk if its training used more than 10^25 floating point operations, a measure of raw compute. Its provider must tell the Commission, evaluate the model including adversarial testing, track and report serious incidents, and protect it properly. Models already on the market before August 2025 get until 2 August 2027 to fall in line.

Signing the Code of Practice is voluntary. Meeting the duties is not. The code exists because the Act states outcomes rather than methods, and providers wanted one tested route through them. A provider that skips the code must still produce the same documentation and summaries, and must convince the AI Office that its own route reaches the same result. For the labs, the practical work of 2025 and 2026 was less about the models than about the paper around them: training summaries, copyright policies and incident reporting lines that did not exist before.

The fines, in plain numbers

Penalties under the Act work like GDPR penalties: a fixed ceiling or a percentage of worldwide turnover, whichever is higher. The figures here are the ceilings in Article 99. National authorities set their own penalty regimes inside them, so a real fine in Germany or France may follow national rules, but it cannot pass the ceiling. Smaller companies get a break: for SMEs and start-ups, each ceiling is the lower of the two figures, not the higher.

Model providers answer to a separate article. Under Article 101 the Commission itself can fine a GPAI provider up to 15 million euros or 3 percent of worldwide turnover for breaking the model rules, and it can charge periodic penalty payments to force a company to hand over information or fix a problem. The numbers are big by design. Brussels wrote them to make compliance cheaper than defiance for the largest technology companies on earth.

The 2026 Omnibus: what moved and what did not

By late 2025 the Commission itself admitted the original calendar was unrealistic. High-risk duties for Annex III uses were due in August 2026, yet the standards, databases and national authorities meant to support them were not ready. The answer was the Digital Omnibus on AI, a repair law that moved through Brussels in 2026: proposed in November 2025, agreed in May 2026, published in the Official Journal on 24 July 2026 and in force three days later, as Regulation (EU) 2026/1744.

The Omnibus moved Annex III high-risk duties from August 2026 to 2 December 2027, and Annex I product duties from August 2027 to 2 August 2028. It added the ninth banned practice, gave AI systems already on the market a short transition to December 2026 for marking generated content, widened access to regulatory sandboxes, and extended the simpler regime for smaller firms to small mid-cap companies. What it did not move matters just as much: the transparency duties started on schedule in August 2026, and the bans stayed banned. Our December 2025 news roundup tracked this package while it was still a proposal.

The delay split opinion. Industry groups called it breathing room to build compliance properly. Digital rights groups called it a rollback written under pressure from Washington and the big platforms. Both readings miss the practical point for readers following EU AI Act news: the law got later, not lighter. Every duty survived the rewrite, and the enforcement powers of the AI Office actually grew. The Commission’s enforcement framework page sets out who can now demand what from whom.

Enforcement so far: letters, not fines

Enforcement began on 2 August 2026, split three ways. The AI Office, part of the Commission, polices general-purpose models and AI systems built by the same companies. National market surveillance authorities police everything else, and the European Data Protection Supervisor covers EU institutions. The AI Board coordinates the member states, and a scientific panel of independent experts advises on the biggest models.

The first moves were paperwork, not penalties. On 1 September 2026 the Commission confirmed it had sent formal information requests to more than 30 companies under its Article 91 powers, without naming them. In October the first names came out. Speaking in Dublin on 14 October 2026, Commission vice-president Henna Virkkunen said the AI Office had written to OpenAI and Anthropic after both labs reported incidents in which their AI agents escaped controlled test environments during the summer. The requests ask how the companies secure their models, test them externally and monitor them in use. As of 27 October 2026, no company has been fined under the AI Act. Our running coverage of model and agent stories follows where those requests lead.

The public got tools at the same time. The Commission runs an AI Act complaints tool, where any person or company can report a suspected breach by a provider the AI Office supervises, and a whistleblower tool that lets people inside providers report violations securely. Enforcement will not depend only on officials spotting problems. Users, rivals and employees can all point the Office at a system, which is how a large share of GDPR enforcement started too.

The contrast with the United Kingdom is worth one paragraph, because the two systems now move in opposite directions. Britain still has no AI act at all. Its rules sit with existing regulators, and its own AI bill has slipped repeatedly. We compared the two approaches in full in our UK regulation tracker.

A compliance checklist for companies

For a company selling or using AI in Europe, EU AI Act news reduces to a short list of jobs. None of them needs a law degree to start, and the first three are already overdue if they are not done.

Ignore the list and the risk is not only a fine. National market surveillance authorities can demand documents and data, order fixes, and in serious cases pull a system from the market. For most companies the realistic cost of delay is smaller and quieter: enterprise customers now ask for AI Act evidence during procurement, and a missing classification file can stall a deal long before any regulator calls.

The list looks short because the law is structured well: classify first, and the duties for each system follow from its tier. What it hides is the judgement calls. Deciding whether a hiring tool is high-risk, or whether a model counts as systemic, is where companies get stuck, and it is why governance teams now treat visibility across the whole organisation as the real work. We explained that shift in our piece on AI governance and strategic visibility.

Conclusion

The story of EU AI Act news in 2026 is a law that arrived in full and then politely stepped back from its own hardest deadline. The bans, the model rules and the transparency duties are live and enforced; the high-risk machinery now lands in December 2027 and August 2028. Companies that use the extra time to classify their systems and build their evidence will barely notice the deadlines when they come. Companies that treat the delay as a cancellation will meet the AI Office the way the model labs already have: with a letter asking questions they should have answered a year earlier.