EU AI Act: deadlines and the Digital Omnibus (status May 2026)

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. This article lays out the timeline that matters for companies operating in the EU, and what the May 2026 Digital Omnibus proposes to change.

The staged timeline

• 2 February 2025: Prohibited AI practices are banned, and the AI literacy obligation (Art. 4) applies. Providers and deployers must take measures, to their best extent, to ensure a sufficient level of AI literacy among their staff (a proportionate best-efforts duty).
• 2 August 2025: Rules for general-purpose AI models (GPAI) and the governance framework start to apply.
• 2 August 2026: The bulk of the obligations for high-risk AI systems (Annex III) become applicable, in the original text.
• 2 August 2027: Obligations for high-risk AI that is a safety component of regulated products (Annex I) apply.

What the Digital Omnibus changes

On 7 May 2026 the EU institutions reached a provisional political agreement on a so-called Digital Omnibus that adjusts parts of the AI Act. The key points for businesses: the application of the high-risk obligations is to be postponed, for Annex III systems to 2 December 2027, and for Annex I systems to 2 August 2028, and the requirements around AI literacy (Art. 4) are to be eased and simplified.

Important caveat: as of May 2026 this is a provisional agreement, not yet formally adopted and in force. Until it is, the original text and its dates apply. Plan against the original deadlines and treat the relief as a welcome buffer, not as a reason to wait.

The honest summary in May 2026: the prohibitions, GPAI rules and AI literacy already apply. The high-risk obligations are likely to move later, but that is not yet law.

What you should do now

• Build an inventory of your AI systems and classify them by risk (prohibited / high-risk / limited / minimal).
• Cover the AI literacy duty: proportionate, documented training for the people who work with AI.
• Check transparency obligations (Art. 50): label AI interactions and AI-generated content where required.
• If you operate high-risk AI, start the governance work now, the build-up takes longer than the remaining time often suggests.

How ISO 42001 helps

A management system built to ISO/IEC 42001 gives you exactly the structures the AI Act asks for: an AI inventory, risk and impact assessments, human oversight, transparency and life-cycle control. It is the most efficient way to turn a legal obligation into a repeatable, auditable process.