EU delays high-risk AI Act deadlines to December 2027 and August 2028, adds December bans

The European Parliament approved the Digital Omnibus on AI on 16 June 2026 by 423 votes to 57, with 174 abstentions, according to the Parliament's own press release. The amendment changes the timetable of the EU's AI Act, the bloc's main law on artificial intelligence, and adds prohibitions that start in December. The Commission page says a political agreement on the text followed on 7 May 2026.

The amendment is now in force. Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, according to the European Commission's AI policy page and a Cooley analysis. Cooley dates the Commission's proposal to 19 November 2025 and says the final text was adopted on 29 June 2026. Some original dates have moved, while other obligations started on schedule.

What moved and what stayed on schedule

Several parts of the AI Act's original timetable were not changed. Prohibited practices and AI literacy duties began on 2 February 2025, and obligations for general-purpose AI models began on 2 August 2025, according to the Commission page. Cooley reports that the omnibus does not affect either set of obligations. The Commission page says the prohibitions cover nine practices, including harmful manipulation, social scoring and emotion recognition in workplaces and education.

The general application date of 2 August 2026 did arrive. The Commission page says the AI Act became applicable on that date with some exceptions, and that the AI Office and national authorities began supervising and enforcing it. Cooley adds that the Article 50 transparency duties for new systems, including chatbot disclosure and deepfake labelling, also apply from that date.

Other dates moved within the same package. Cooley lists high-risk systems used by public authorities as moving from 2 August 2026 to 2 August 2030, and member-state AI regulatory sandboxes as moving from 2 August 2026 to 2 August 2027. The Commission page says the package also simplifies requirements for small and mid-cap companies.

New high-risk deadlines for stand-alone and product-embedded AI

Stand-alone high-risk systems listed in Annex III now face obligations from 2 December 2027. The stand-alone high-risk deadline moved about sixteen months, from 2 August 2026 to 2 December 2027. Cooley describes the change as a 16-month deferral. The Commission page lists biometrics, critical infrastructure, education, employment, essential public and private services, law enforcement, migration and border control, and the administration of justice and democratic processes as Annex III areas.

AI embedded as safety components in products covered by EU sector safety law, listed in Annex I, moves to 2 August 2028. Cooley gives the earlier date as 2 August 2027, which makes the deferral 12 months. The Parliament release gives the same two dates without naming the annexes. Cooley's examples of Annex I products are toys, medical devices and machinery, while the Commission page cites lifts and toys.

Parliament says machinery products need only comply with sectoral safety rules while still ensuring an equivalent level of health and safety, which removes overlapping AI requirements. Cooley adds that products with AI functions that only assist users or optimize performance will not automatically face high-risk obligations if their failure or malfunction does not pose health or safety risks.

The Commission page lists the obligations for high-risk systems as covering risk management, data quality, logging, documentation, human oversight, and robustness and cybersecurity.

Cooley describes a grace period at the level of type and model. If one unit of a system was lawfully placed on the market before the compliance date, other units of the same type and model may keep being sold if the design remains materially unchanged. Cooley says a significant design change after the compliance date triggers full compliance obligations for the changed system.

Bans that take effect on 2 December 2026

Cooley reports that the new Article 5 prohibitions apply from 2 December 2026. The Commission page calls the ban Prohibition 9, says it was added by the AI Omnibus, and describes it as covering AI systems that generate non-consensual sexual content or child sexual abuse material, naming nudification apps specifically.

The Parliament's release describes systems that create images, videos or audio showing an identifiable person's intimate parts or sexually explicit activities without consent, as well as systems that generate child sexual abuse material. Providers may not place such systems on the EU market unless they include adequate technical safeguards against creating such material. Co-rapporteur Michael McNamara said the ban will enter into force before the end of 2026.

Cooley describes the rules differently for each group. For providers, the ban applies where generating such material is the intended purpose, or is a reasonably foreseeable and reproducible outcome that lacks reasonable safeguards. For deployers, it applies only where the deployer uses the system to generate or manipulate such material. Cooley says there is no exemption for systems already on the market.

The Parliament's release says companies have until 2 December 2026 to bring their systems in line. The Commission page, by contrast, says the ban takes effect in December 2026. The two descriptions point to the same month but read differently on whether the date is a start or a compliance deadline.

A separate watermarking deadline also falls on 2 December 2026. For AI-generated content from systems placed on the market before 2 August 2026, the Article 50(2) labelling duty is delayed to that date. The Parliament release says such content must then be labelled in a machine-readable way.

What providers and deployers still must meet

The sources describe duties for providers, which place AI systems on the EU market, and for deployers, which use them. The Commission page says the AI Office has direct powers over general-purpose AI models. It can request technical documentation, evaluate models, require corrective measures and issue fines.

Several obligations continue regardless of the omnibus. These include the prohibited-practice and AI literacy duties from February 2025, the general-purpose model obligations from August 2025, and the Article 50 transparency duties and AI Office powers from August 2026, according to Cooley and the Commission page.

The Commission page describes the transparency duties as telling people when they are interacting with a machine, making AI-generated content identifiable, and labelling deepfakes and certain public-interest text.

Cooley says the AI Act applies globally to providers, deployers, importers and distributors of AI systems that place AI on the EU market or whose AI outputs are used within the European Union.

A US state comparison: Colorado's dates

Colorado's Consumer Protections for Artificial Intelligence law, SB24-205, was approved by the governor on 17 May 2024, according to the state legislature's bill page, which lists it as effective the same day. The page says developer and deployer duties for high-risk systems apply on and after 1 February 2026.

The page lists no delay beyond that date. It also lists ten amendments, numbered L.001 through L.014 plus H.001 and dated 24 April 2024 to 8 May 2024, but does not describe their content.

Set side by side, Colorado's high-risk duties start on 1 February 2026, a date that had passed by 12 October 2026, while the EU's stand-alone high-risk obligations begin on 2 December 2027. The two regimes are not identical, so the dates are compared here only as listed.

Where the sources disagree

Cooley is the only cited source that gives a Council adoption date. It says the final text was adopted on 29 June 2026 after trilogue negotiations, without naming the adopting body. The Parliament's release, dated 16 June 2026, says the law still needed formal adoption by the Council. The Commission page gives 27 July 2026 as the entry-into-force date, which matches Cooley.

The Parliament and Commission descriptions of the December 2026 ban also differ in wording, as noted above. Cooley says the AI literacy duty was reworded, while both Cooley and the Commission page list it as in force since 2 February 2025.

The exact legal start and compliance dates are the points to check against the published text of Regulation (EU) 2026/1744.

Related coverage: What's Stalling Congress's Dozen Spending Bills Before December 11; When Congress Misses September 30, the Antideficiency Act Shuts the Government Down; How the end of duty-free de minimis shipping is reshaping online imports.