The EU AI Act entered into force on 1st August 2024. Prohibited practices and the AI literacy duty applied from 2nd February 2025. The first rules for general-purpose AI models began applying from 2nd August 2025, with transitional arrangements for models already on the market. Most of the Act becomes applicable on 2nd August 2026, including important transparency obligations. The most demanding rules, for high-risk AI, were due in 2026 and 2027, but those dates have just been amended, with the change taking effect shortly.
That last part matters more than it looks, and I’ll come back to it.
Five dates explain the main implementation sequence. Most leadership teams I speak to know one of them.
That’s the problem. The Act gets discussed as if 2nd August 2026 is a single line to cross, a switch that flips. It isn’t. Three of those dates have already passed, two of them carrying obligations that began applying while nobody was watching. If you run a business using AI in any form, some of this already applies to you, and has done for over a year.
The layered structure is not hidden. It’s published, it’s on the Commission’s own timeline, anyone can read it. But it doesn’t travel well. “There’s a deadline in August” is easy to repeat. “There’s a staged set of obligations, two of which already bind you, and a timetable that keeps shifting” is not. So the simple version wins, and the simple version is wrong.
One caveat before we go further. In May 2026 the European Parliament and Council agreed a set of amendments to the Act, adopted through June and entering into force shortly after via publication in the Official Journal. So some of the dates below are the amended ones. This area moves, so treat any single date as current best knowledge and check before you act on it.
The two application dates most firms missed
Start with the one most people haven’t clocked: the AI literacy duty. Since 2nd February 2025, if your organisation puts AI systems into use, you carry a legal obligation to take measures, to your best extent, to ensure a sufficient level of AI literacy among the people operating them. Not your vendor. You. It applies to staff and to anyone acting on your behalf.
Most firms have no idea this is live. They bought a tool, someone in operations started using it, and nobody asked whether that person understood what it does, where it fails, or what they’re accountable for. The duty doesn’t require a training empire. In practice, you should be able to demonstrate that the people using AI in your business have an appropriate level of understanding for the systems and contexts they’re working with. Right now, most can’t.
The same date switched on the prohibited practices. A defined set of uses the Act prohibits, including certain forms of manipulative AI, social scoring and biometric categorisation. Most mid-market firms aren’t doing these things deliberately. The risk is enabling or using prohibited functionality without recognising what it is, folded into a product you didn’t properly scrutinise and sold as just another feature.
Then 2nd August 2025: the first rules for general-purpose AI. Providers of general-purpose AI models are now entering their own compliance regime, subject to transitional arrangements for models already on the market. That matters to downstream organisations because the AI capability you depend on may sit one layer down, inside a supplier’s product, built on a model you didn’t choose and may have limited visibility of.
None of this arrives with a letter. There’s no switch-on event, no regulator at the door on day one. The obligations just start applying, quietly, while the whole conversation stays fixed on the August deadline. That’s why it bites. Not because it’s aggressive, but because it’s already running and nobody’s looking at it.
Why staged changes the shape of the work
A cliff edge is a project. You staff it, you hit the date, you close it out, you move on. That’s how most firms are treating August 2026, and it’s why they’ll get it wrong. A staged timetable isn’t a project. It’s an operating model, because the obligations keep arriving and the ones already here don’t switch off once you’ve dealt with them.
Think about what the literacy duty actually asks. It’s not “run a training session in 2025.” It’s “the people using AI in your business understand it.” That’s not a task you complete. It’s a state you maintain, through staff turnover, through new tools, through the next model your supplier swaps in without telling you. The moment you treat it as a one-off, it’s already stale.
Here’s what makes the point better than any argument I could construct. The high-risk rules, the most demanding part of the Act, were due to bite on 2nd August 2026. They’ve now been pushed back: stand-alone high-risk systems to December 2027, and high-risk AI built into regulated products to August 2028. If you’d set up a compliance project aimed at the original date, staffed it, scoped it, pinned your plan to it, you’re now holding a plan built around a deadline that no longer applies. The work didn’t change. The date under it did.
But read what actually moved, because this is the part that catches people out. The high-risk tier was deferred. Almost nothing else was. The transparency obligations, the general-purpose AI rules, the powers for authorities to investigate and act, all of that still lands on 2nd August 2026. The amendment also added a new prohibition to the banned list. So if you heard “the EU delayed the AI Act” and eased off, you eased off a date that only moved for one slice of the Act, and not the slice that applies to most businesses.
That’s the whole case for treating this as an operating model rather than a project, made for me by the legislation itself. Dates move for some things and hold for others. Obligations get added. If your response to the Act is a fixed plan aimed at a fixed date, a change like this doesn’t just move your deadline, it hides the parts that didn’t move. If your response is a way of working, you already know which obligations apply to you and when, so a reshuffle is just another normal day.
This is the part leaders find hardest, because it doesn’t resolve. There’s no certificate at the end, no moment where someone says it’s done. What you’re building instead is the ability to answer a plain question at any time: who is using AI here, do they understand it, and can we show that. If you can answer that this month, the moving dates stop mattering to you. If you can’t, no amount of preparation aimed at a single date will fix it, because a single date was never what this needed.
So the question isn’t whether you’re ready for August 2026. It’s narrower and more useful than that. Which of the obligations already in force apply to you, and could you show it if someone asked this week.
Start there. Not with the August deadline, but with the two dates that passed while the conversation was looking the other way. Find out who in your business is using AI, in what, and whether they understand it well enough to be accountable for it. That’s not a compliance exercise. It’s just knowing how your own organisation works, which tbh you should want to know regardless of what any Act says.
August will come. The firms that handle it well won’t be the ones who treated it as a finish line. They’ll be the ones who were already working this way, because they started with what was true in front of them instead of what was written on a date.
If you do one thing this month, make it that first question. Who is using AI here, and can we show they understand it. Everything else follows from the answer.
Primary sources
- Regulation (EU) 2024/1689 (the AI Act) — Official Journal of the European Union, official text of 13 June 2024. The canonical source. EUR-Lex.
- Article 4, AI literacy — European Commission AI Act Service Desk:
https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4 - Article 5, Prohibited AI practices — European Commission AI Act Service Desk:
https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-5 - AI Literacy: Questions & Answers — European Commission, Shaping Europe’s Digital Future:
https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers. Confirms the AI Office will not impose strict requirements on what counts as a sufficient level. - Digital Omnibus on AI, COM(2025) 836 — European Commission proposal of 19 November 2025, EUR-Lex:
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52025PC0836 - Digital Omnibus on AI, Legislative Train Schedule — European Parliament:
https://www.europarl.europa.eu/legislative-train/package-digital-package/file-digital-omnibus-on-ai
On the Omnibus and the amended timetable
- Gibson Dunn, “EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines and Other Key Changes.” Confirms Annex III deferral to 2 December 2027 and Annex I to 2 August 2028; the new Article 5 prohibition; and that 2 August 2026 remains an active compliance date with Article 50 transparency largely unaffected.
- Sidley, Data Matters, “EU Lawmakers Reach Provisional Agreement to Delay Key EU AI Act Obligations.” Timeline detail: provisional agreement 7 May 2026, Parliament vote 16 June 2026; new prohibition applies from 2 December 2026.
- Stibbe, “AI Act reloaded? What the latest AI Act changes mean in practice.” The clearest source on the Article 4 realignment as an obligation of effort, not result.
- Center for Democracy and Technology, “Final AI Omnibus Text Dilutes Fundamental Rights Protections.” Confirms the literacy obligation was retained rather than displaced, and gives a critical counterweight perspective.
- NicFab, “Digital Omnibus on AI: the Council’s Final Green Light.” Records Council adoption on 29 June 2026, and is precise on the distinction between adoption and entry into force.
- Matheson, “EU AI Digital Omnibus Proposal: Where are we now?” Useful on the Parliament/Council divergence over Article 4 and the Article 50(2) transitional period.