EU AI Act: deadlines and the Digital Omnibus (status May 2026)

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. This article lays out the timeline that matters for companies operating in the EU — and what the May 2026 Digital Omnibus proposes to change.

The staged timeline

• 2 February 2025: Prohibited AI practices are banned — and the AI literacy obligation (Art. 4) applies. Providers and deployers must take measures, to their best extent, to ensure a sufficient level of AI literacy among their staff (a proportionate best-efforts duty).
• 2 August 2025: Rules for general-purpose AI models (GPAI) and the governance framework start to apply.
• 2 August 2026: The bulk of the obligations for high-risk AI systems (Annex III) become applicable — in the original text.
• 2 August 2027: Obligations for high-risk AI that is a safety component of regulated products (Annex I) apply.

What the Digital Omnibus changes

On 7 May 2026 the EU institutions reached a provisional political agreement on a so-called Digital Omnibus that adjusts parts of the AI Act. The key points for businesses: the application of the high-risk obligations is to be postponed — for Annex III systems to 2 December 2027, and for Annex I systems to 2 August 2028 — and the requirements around AI literacy (Art. 4) are to be eased and simplified.

Important caveat: as of May 2026 this is a provisional agreement, not yet formally adopted and in force. Until it is, the original text and its dates apply. Plan against the original deadlines and treat the relief as a welcome buffer, not as a reason to wait.

The honest summary in May 2026: the prohibitions, GPAI rules and AI literacy already apply. The high-risk obligations are likely to move later — but that is not yet law.

What you should do now

• Build an inventory of your AI systems and classify them by risk (prohibited / high-risk / limited / minimal).
• Cover the AI literacy duty: proportionate, documented training for the people who work with AI.
• Check transparency obligations (Art. 50): label AI interactions and AI-generated content where required.
• If you operate high-risk AI, start the governance work now — the build-up takes longer than the remaining time often suggests.

How ISO 42001 helps

A management system built to ISO/IEC 42001 gives you exactly the structures the AI Act asks for: an AI inventory, risk and impact assessments, human oversight, transparency and life-cycle control. It is the most efficient way to turn a legal obligation into a repeatable, auditable process.