A compliance quick-reference as of October 25, 2026. For context, background, and the "why" behind each obligation, read our longer EU AI Act practical guide.
Based on Regulation (EU) 2024/1689 as amended by the Digital Omnibus — Regulation (EU) 2026/1744 — in force since 27 July 2026.
| Obligation | Effective since | Who's affected | What to do |
|---|---|---|---|
| Article 5 prohibitions — social scoring, exploitative behavior manipulation, untargeted facial-recognition scraping, biometric categorization by sensitive attributes | 2 Feb 2025 In force | Any provider or deployer with EU users | Audit systems against the prohibited list; stop any matches immediately. |
| AI literacy requirement (Art. 4) | 2 Feb 2025 In force | Any organisation deploying AI systems | Ensure staff interacting with AI have "sufficient level of AI literacy". Document training. |
| GPAI model obligations — technical docs, copyright policy, training-content summary | 2 Aug 2025 In force | Providers of General-Purpose AI models (foundation models) placed on the EU market | Publish technical documentation, provide downstream integrators with disclosures, respect EU TDM opt-outs. |
| Systemic-risk GPAI — model evaluations, incident reporting, cybersecurity | 2 Aug 2025 In force | Providers of models with ≥10²⁵ FLOP training compute (GPT-6, Opus 5, Gemini 4 class) | Run adversarial evals, report serious incidents to the AI Office within 15 days, apply state-of-the-art cybersecurity. |
| GPAI enforcement & fines | 2 Aug 2026 In force | GPAI providers from above | AI Office can now issue fines up to 3% of global turnover (or €15m) for GPAI breaches. |
| Article 50 transparency — label AI-generated content, deepfake disclosure, chatbot disclosure | 2 Aug 2026 In force | Any provider or deployer serving EU users | Chatbots must say they're AI. AI-generated content must be machine-detectable (C2PA / SynthID). Deepfakes must be labeled visibly. |
| Digital Omnibus simplifications — redundant reporting removed, SME thresholds raised | 27 Jul 2026 In force | All AI Act subjects (not just SMEs) | Review your 2025-planned compliance program against the simplified text — some paperwork is gone. |
| Obligation | Effective | Who | What to do now |
|---|---|---|---|
| Article 5 extension — "nudifier" apps prohibited | 2 Dec 2026 Upcoming | Any provider of AI systems that generate non-consensual intimate imagery | Remove from EU market before Dec 2. Post-ban, listing or distributing one triggers Article 5 fines up to €35m / 7% turnover. |
| GPAI training-data transparency — Phase 2 (per-dataset breakdowns, not just summaries) | 2 Dec 2026 Upcoming | GPAI providers that initially filed under Phase 1 (Aug 2025) | Update your training-data card with per-source URL list, licensing status, and TDM-opt-out compliance notes. |
| Obligation | Effective | Who | Notes |
|---|---|---|---|
| Annex III high-risk AI systems — conformity assessment, risk management, data governance | 2 Aug 2027 Future | Providers of high-risk AI (biometric ID, education, employment, essential services, migration, justice, democratic processes) | Digital Omnibus postponed this from Aug 2026 to Aug 2027 — gives providers extra time for CE marking. |
| Annex I high-risk product safety — AI as safety component in regulated products | 2 Aug 2027 Future | Providers of AI inside medical devices, machinery, toys, radio equipment, etc. | Aligns with the product's own regulatory conformity cycle. |
| Full enforcement for pre-existing GPAI (models placed on EU market before 2 Aug 2025) | 2 Aug 2027 Future | Legacy foundation models still in EU use | Grace period ends — must be fully compliant with current GPAI obligations. |
This page is informational, not legal advice. For EU AI Act compliance questions tied to your specific product or market, consult a qualified lawyer.