Kevin Welter.
ENDE

October 31, 2026 · 15 min read

EU AI Act: Overview and Deadlines 2026

Graphic title card for the article “EU AI Act: Overview and Deadlines 2026” with a stylised motif: a rule sheet with ticks, next to it a traffic light.
Graphic: HumanITy

The EU AI Act, officially Regulation (EU) 2024/1689 on artificial intelligence, entered into force on 1 August 2024 and has applied in principle in full since 2 August 2026. It sorts AI by risk: some practices are banned, high-risk systems get strict obligations, chatbots and deepfakes come with transparency duties, the rest stays largely unregulated. The amending Regulation (EU) 2026/1744 postponed the high-risk obligations, to 2 December 2027 for the use cases in Annex III and to 2 August 2028 for products under Annex I. If your business only uses AI, you are a deployer, and today you mainly have two duties: AI literacy for your people and transparency for deepfakes.

I am a developer, not a lawyer, and this is not legal advice, just the operator's perspective, under EU and German law. My fourteen AI employees run on Claude Team, some also on open models or through the API. This article is based on the consolidated text of 27 July 2026, which includes the changes made by Regulation (EU) 2026/1744, as of 31 October 2026, along with Germany's implementing act, the KI-MIG. More on AI in day-to-day business is collected on my AI Basics page.

What the EU AI Act regulates

Under Article 1(1), it aims to "promote the uptake of human-centric and trustworthy artificial intelligence" while protecting health, safety and fundamental rights. As a regulation, it applies directly in every member state. Under Article 2(1) it covers mainly providers placing AI on the EU market and deployers in the EU, plus providers and deployers outside the EU where the output of their AI system is used in the EU. Purely personal, non-professional use is excluded under Article 2(10).

The four risk categories

The European Commission summarises the regulation as four levels of risk:

Level What applies Examples Where
Unacceptable risk banned manipulation, social scoring, emotion recognition in the workplace Art. 5
High risk strict obligations recruitment, education, creditworthiness, critical infrastructure; AI as a safety component in toys or lifts, for example Art. 6, Annexes I and III
Transparency risk disclosure and labelling duties chatbots, deepfakes Art. 50
Minimal risk no specific rules according to the Commission, spam filters, AI in video games

Two points are easy to miss. Article 4 on AI literacy applies to all AI systems, including minimal-risk ones. And not every Annex III system is automatically high-risk: under Article 6(3) it drops out if it poses no significant risk, for example because it only performs a narrow procedural task. If it profiles natural persons, however, it is always high-risk. General-purpose AI models have their own track, more on that below.

The roles: provider, deployer and others

Obligations depend on your role, not on the size of your business:

  • Providers (Art. 3(3)) develop an AI system or model, or have it developed, and place it on the market under their own name, such as OpenAI or Anthropic.
  • Deployers (Art. 3(4)) use an AI system under their own authority, unless it is purely personal use. If your business uses ChatGPT, Claude or an image generator, you are a deployer.
  • Authorised representatives, importers and distributors (Art. 3(5) to (7)) sit in the supply chain.

Roles can change. Under Article 25(1), a deployer becomes the provider of a high-risk system if it puts its name on it, substantially modifies it, or changes a system's purpose so that it becomes high-risk. Letting a chat assistant pre-sort job applications, for example, is something to have checked professionally.

Deadlines: what applies from when

The dates are in Articles 113 and 111, as amended by Regulation (EU) 2026/1744:

Date What applies Where
1 August 2024 entry into force, twenty days after publication on 12 July 2024 Art. 113(1)
2 February 2025 Chapters I and II: AI literacy (Art. 4) and prohibitions (Art. 5) Art. 113(3)(a)
2 August 2025 obligations for general-purpose AI models, authorities, penalty rules Art. 113(3)(b)
27 July 2026 amending Regulation (EU) 2026/1744 enters into force Art. 4 of Reg. (EU) 2026/1744
2 August 2026 general date of application, including transparency duties (Art. 50) and fines on model providers (Art. 101) Art. 113(2)
2 December 2026 new prohibitions on non-consensual intimate content and child sexual abuse material; deadline for machine-readable marking by systems already on the market Art. 113(3)(a), Art. 111(4)
2 August 2027 deadline for models placed on the market before 2 August 2025 Art. 111(3)
2 December 2027 high-risk obligations for Annex III systems Art. 113(3)(c)(i)
2 August 2028 high-risk obligations for Annex I systems (products) Art. 113(3)(c)(ii)

What the 2026 amendment postponed

Regulation (EU) 2026/1744, the Digital Omnibus Regulation on AI, was published in the Official Journal on 24 July 2026. For the timeline, these changes matter:

  • High-risk under Annex III: previously 2 August 2026, now 2 December 2027. Recital 40 gives the reason: delayed standards and the delayed establishment of national authorities.
  • High-risk under Annex I: previously 2 August 2027, now 2 August 2028.
  • New prohibitions in Article 5(1)(ba) and (bb) from 2 December 2026.
  • National AI regulatory sandboxes: previously by 2 August 2026, now by 2 August 2027 (Art. 57(1)).

Not postponed: the 2025 prohibitions, the model obligations and Article 50. Article 4 was softened but still applies. An overview naming 2 August 2026 as the start of all high-risk obligations reflects the law before July 2026.

What applies to deployers

  1. AI literacy (Art. 4), since 2 February 2025: measures to support the AI literacy of your staff and contractors. You do not have to guarantee any particular level. Details in AI Literacy Under the AI Act: Training Staff.
  2. No prohibited practices (Art. 5), since 2 February 2025: the one most relevant to businesses is the ban on inferring emotions in the workplace with AI, except for medical or safety reasons.
  3. Transparency (Art. 50(3) and (4)), since 2 August 2026: disclose deepfakes, and AI texts on matters of public interest without editorial review. Examples in AI Disclosure Rules Under the EU AI Act.
  4. High risk (Art. 26), from 2 December 2027: follow the instructions for use, assign human oversight to people "who have the necessary competence, training and authority", monitor operation, keep logs for at least six months. Employers inform workers' representatives and workers beforehand (para. 7); for Germany, see AI and the Works Council in Germany.

A fundamental rights impact assessment under Article 27 only concerns public bodies, private providers of public services, and credit scoring and pricing in life and health insurance. The law does not require an AI officer, see Do I Need an AI Officer?.

General-purpose AI models

These are models that can perform a wide range of tasks and be built into many applications (Art. 3(63)), such as the language models behind ChatGPT, Claude or Gemini. Since 2 August 2025, Article 53 requires their providers to keep technical documentation, inform downstream providers, have a copyright policy and publish a training content summary, among other things. For systemic risk, presumed above 10²⁵ floating point operations in training (Art. 51(2)), Article 55 adds model evaluations, risk mitigation, incident reporting and cybersecurity. The Commission's AI Office is in charge. As a user, you are not directly affected. What a model is, I explain in What Is an AI Model? Simply Explained. Which providers are based in Germany or the EU is covered in European AI Providers Beyond ChatGPT.

Fines and penalties

Article 99 sets maximums, each the higher of a fixed sum and a share of the previous year's worldwide turnover:

Infringement Maximum Where
prohibited practices EUR 35 million or 7 percent Art. 99(3)
obligations of providers, deployers (Art. 26) and transparency duties (Art. 50), among others EUR 15 million or 3 percent Art. 99(4)
incorrect information supplied to authorities EUR 7.5 million or 1 percent Art. 99(5)
model providers, fined by the Commission EUR 15 million or 3 percent Art. 101(1)

For SMEs, Article 99(6) applies the lower of the two amounts; since 2026, Article 99(6a) does the same for small mid-caps for the fines under paragraphs 4 and 5. These are ceilings. Under Article 99(1), member states provide penalties for any infringement; besides fines, these can include warnings and non-monetary measures. Germany adds its own administrative offences in Section 15 KI-MIG, for example around the fundamental rights impact assessment, with fines of up to EUR 50,000. This covers Articles 99 and 101 AI Act and Sections 15 to 17 KI-MIG, no other laws.

Which authorities are responsible in Germany

Germany's implementing act, the KI-Marktüberwachungs- und Innovationsförderungsgesetz (KI-MIG) of 22 July 2026, has applied since 29 July 2026:

  • Bundesnetzagentur (Federal Network Agency): the market surveillance authority by default (Section 2(1)), single point of contact (Section 6(1)) and complaints office (Section 8(1)).
  • Existing product supervisors: for AI in products under Annex I Section A (Section 2(2)).
  • BaFin: for AI in regulated financial activities of the firms it supervises (Section 2(3)).
  • Federal states: for their public bodies and for media services (Section 2(6) and (8)).

For a first orientation, the Bundesnetzagentur offers a "KI-Compliance Kompass" (in German).

Frequently asked questions

When does the EU AI Act apply?

In force since 1 August 2024, applicable in principle since 2 August 2026. Prohibitions and AI literacy since 2 February 2025, model obligations since 2 August 2025, high-risk obligations from 2 December 2027 and 2 August 2028.

Has the EU AI Act been delayed?

Partly. Regulation (EU) 2026/1744 postponed the high-risk obligations and gave systems placed on the market before 2 August 2026 until 2 December 2026 for machine-readable marking. The dates for the 2025 prohibitions, AI literacy, the model obligations and Article 50 stayed the same.

Does the AI Act apply if my team only uses ChatGPT or Claude?

Yes. Anyone using AI professionally is a deployer under Article 3(4). Mainly Articles 4 and 50 then apply. A writing assistant for emails and quotes is not a high-risk system.

Does Germany have its own AI law?

The EU regulation applies directly in Germany. The KI-MIG adds the rules on who is responsible, mainly the Bundesnetzagentur, and some national fines.

Is the AI Act the same as the "KI-Verordnung"?

Yes. Both mean Regulation (EU) 2024/1689, called KI-Verordnung or KI-Gesetz in German.

Where to go from here

First clarify your role: do you only use AI, or do you market an AI system under your own name? As a deployer, start with AI literacy and write the rules down, as in AI Usage Policy for Small Teams. If you plan to use AI for HR decisions, credit or exams, now is the time for a professional review, not the end of 2027.

How other businesses handle the rules is what we discuss in my community AI Employee Framework. Membership does not replace a legal review.

Kevin Welter

Kevin Welter

Developer, IT architect, author of technical books (Kubernetes, cloud infrastructures) and speaker. Runs his business with an AI workforce of fourteen AI employees and shows solo business owners in his community how to hire their first AI employee.

More about AI employees

Your first AI employee up and running within an hour

Join the community

$5/month founding price, first 50 members