Implementation Timeline for the EU AI Act: Current Requirements and Changes Under the Digital Omnibus
Análisis práctico del Reglamento (UE) 2024/1689, sus obligaciones escalonadas y los aplazamientos del Reglamento (UE) 2026/1744 (Digital Omnibus), aprobado por el Consejo el 29 de junio de 2026 y publicado en el DOUE el 24 de julio de 2026.
Key Findings
- The AI Act has been in effect since August 2024, but its implementation is phased: not all provisions take effect at the same time.
- August 2, 2026, is the general effective date of the Regulation for provisions that do not have a specific timeline, including Article 50 (transparency and labeling of synthetic content).
- The Digital Omnibus has postponed the high-risk obligations under Annex III until December 2, 2027, providing an additional 16 months compared to the original timeline.
- The ban on non-consensual intimate/sexual content and AI-generated CSAM takes effect on December 2, 2026, a new date introduced by the Omnibus bill.
- Companies that are already using AI have work to do before August 2, 2026: inventory, risk classification, documentation, and human oversight policies.
A regulation that is in effect but is implemented in phases
Regulation (EU) 2024/1689, known as the AI Act or the Artificial Intelligence Regulation, was published in the Official Journal of the European Union on July 12, 2024, and entered into force on August 1, 2024. However, “entering into force” does not mean “being fully enforced from that moment on.”
Unlike an ordinary regulation, which takes effect the day after its publication, the AI Act establishes a deliberately phased transitional regime. The European legislature recognized that organizations would need time to adapt, harmonized technical standards would need to be developed, and the institutional oversight infrastructure would need to be built. The result is an implementation timeline that spans from February 2025 through 2031.
This phased approach has a direct implication for companies: there is no single “compliant or non-compliant” moment. Each type of AI use has its own timeline, its own obligations, and its own oversight framework. Understanding this landscape is the first task for any legal, technical, or executive leader who wants to manage regulatory risk in an informed manner.
Este análisis se basa en el texto consolidado del Reglamento (UE) 2024/1689 (EUR-Lex, CELEX 02024R1689-20240712) y en el Reglamento (UE) 2026/1744 del Parlamento Europeo y del Consejo (Digital Omnibus sobre IA), aprobado por el Consejo el 29 de junio de 2026 y publicado en el DOUE el 24 de julio de 2026. Para uso jurídico formal, debe consultarse la versión consolidada en EUR-Lex en la fecha de utilización.
Key Dates for the AI Act: From Its Origins to 2031
The following table lists the key dates and milestones of Regulation (EU) 2024/1689 in its original version, prior to the amendments introduced by the Digital Omnibus. It outlines the legal basis and practical implications for organizations that deploy or use AI.
| Date | Legal Basis | Obligation / Milestone | Practical Reading |
|---|---|---|---|
| June 13, 2024 | Regulation (EU) 2024/1689 | Date of the legislative act of the European Parliament and of the Council. | Base text of the AI Act. Reference for any legal interpretation. |
| July 12, 2024 | OJEU L 2024/1689 | Official publication in the Official Journal of the European Union. | Start of the countdown to entry into force (20 days later). |
| Aug. 1, 2024 | Art. 113 | Effective Date of the Regulation. | The regulation is in place and its phased implementation is beginning. |
| Since Aug. 2024, annually | Art. 112.1 | Commission: Annual assessment of the need to amend Annex III and the list of prohibited practices. | Relevant to institutional oversight and potential regulatory expansions. |
| Feb. 2025 | Art. 113.a; Arts. 1–5 | Application of Chapters I and II: General Provisions, Definitions, AI Literacy, and Prohibited Practices. | Key date: staff training (Art. 4) and prohibition of prohibited practices (Art. 5). Already in effect. |
| May 2, 2025 | Art. 56.9 | Best practice guidelines for general-purpose AI models: expected completion date. | Support for GPAI model providers and voluntary compliance. |
| Aug. 2, 2025 | Art. 113.b; Arts. 70.2 and 70.6 | Application of Chapter III, Section 4; Chapters V, VII, VIII, XII, Article 78. Notification by competent national authorities. | GPAI models, institutional governance, confidentiality. It allows for the identification of supervisors and the control structure. |
| Feb. 2, 2026 | Articles 6.5 and 72.3 | Commission: Guidelines on the Classification of High-Risk Systems and a Model for a Postmarket Surveillance Plan. | Interpretive guidelines. Article 72.3 was affected by the Omnibus Act. |
| Aug. 2, 2026 ★ | Art. 113, General Rule | General effective date of the Regulation for provisions not subject to a specific timeline. Includes Article 50 (transparency and labeling of summary content). | The transparency requirements under Article 50 take effect today. The high-risk category (Annex III) has been postponed by the Omnibus Act until December 2, 2027. |
| Aug. 2, 2027 | Original Art. 113.c; Art. 111.3 | Application of Article 6.1 and obligations for high-risk systems introduced before Aug. 2, 2025. (Amended by the Omnibus Act: Annex III → Dec. 2, 2027.) | Date rescheduled. See Table 2 for details on postponements. |
| Aug. 2, 2028 | Art. 112.2; Arts. 112.5–7 | The Commission's initial assessments of GPAI, transparency, governance, the AI Office, and energy efficiency. | Institutional review milestone; may result in changes. |
| Aug. 2, 2029 | Art. 112.3 | First General Report on the Evaluation and Review of the Regulations. | Monitoring of implementation and possible proposal for modification. |
| Aug. 2, 2030 | Art. 111.2 | High-risk AI systems intended for use by public authorities: mandatory compliance measures. | Specific transitional provisions for pre-existing public uses. |
| Dec. 31, 2030 | Art. 111.1 | AI systems that are components of large-scale computer systems listed in Annex X, placed on the market before Aug. 2, 2025. | Deadline for large regulated computer systems. |
| Aug. 2, 2031 | Art. 112.13 | Evaluation of the Regulation's Implementation Following Its First Few Years of Application. | Possible initiation of a structural review of the implementation model. |
★ Reference date for this analysis. The general date includes Article 50 but excludes the high-risk provisions of Annex III, which were deferred by the Digital Omnibus.
Changes in the Digital Omnibus: What Has Changed and Why It Matters
El 29 de junio de 2026, el Consejo de la UE aprobó el Digital Omnibus sobre IA, un paquete de modificaciones al AI Act que ajusta plazos, introduce nuevas prohibiciones y simplifica algunos requisitos. El texto se publicó en el DOUE el 24 de julio de 2026 como Reglamento (UE) 2026/1744, con entrada en vigor a los tres días de su publicación — antes del 2 de agosto de 2026, lo que confirma que los aplazamientos descritos a continuación son ya jurídicamente firmes.
The most significant change for most companies is the postponement of the high-risk obligations under Annex III from August 2, 2026, to December 2, 2027. This gives an additional 16 months to suppliers and system implementers operating in categories such as biometrics, critical infrastructure, employment, education, essential services, immigration, and the administration of justice.
The postponement to December 2, 2027, applies to Annex III as a whole, but does not affect Article 50 (transparency and labeling of synthetic content), which retains its general effective date of August 2, 2026. Nor is the ban on manipulation practices or the literacy requirements (Art. 4) already in effect postponed.
| Subject | Planned Start Date | New date / change | Legal Basis | Practical Scope | |
|---|---|---|---|---|---|
| High risk (Annex III) | Aug. 2, 2026 | → | Dec. 2, 2027 | Art. 113.c modificado; Reglamento (UE) 2026/1744 | Biometrics, critical infrastructure, employment, education, essential services, migration, justice, democratic processes. |
| High risk associated with Annex I products | Aug. 2, 2027 | → | Aug. 2, 2028 | Art. 113.c modificado; Reglamento (UE) 2026/1744 | AI Systems in Security Products (Existing Sector-Specific Directives). |
| New Prohibited Practices: Non-Consensual Intimate/Sexual Content and CSAM | Not included in the original text | → | Dec. 2, 2026 | Art. 5 modificado; Reglamento (UE) 2026/1744 | New specific ban on the creation or manipulation of non-consensual intimate or sexual content and child sexual abuse material. |
| Labeling of synthetic content for systems already on the market | Aug. 2, 2026 | → | Dec. 2, 2026 | Art. 111.4 nuevo; art. 50.2; Reglamento (UE) 2026/1744 | System providers, including GPAI, that generate synthetic audio, images, video, or text and were already on the market before Aug. 2, 2026, have an additional four months. |
| Sandbox regulatorio nacional de IA · pendiente de verificar | Aug. 2, 2026 | → | Aug. 2, 2027 | Art. 57.1 modificado; Reglamento (UE) 2026/1744 | Cada Estado miembro debe disponer de al menos un espacio controlado de pruebas. Fecha de aplazamiento no confirmada de forma independiente; otras fuentes previas a la publicación indicaban que esta obligación no se veía afectada por el Omnibus y seguía aplicando el 2 ago. 2026. Verificar contra el texto consolidado antes de publicar. |
| Plan de vigilancia poscomercialización · pendiente de verificar | Required by Feb. 2, 2026 | → | Voluntary Guide by September 2, 2027 | Art. 72.3 modificado; Reglamento (UE) 2026/1744 | Se sustituye el modelo obligatorio por orientación de la Comisión, más flexible para proveedores de alto riesgo. No se ha podido confirmar de forma independiente este cambio; verificar contra el texto consolidado antes de publicar. |
| Machinery and Regulatory Overlap | Regulations Under Annex I of the AI Act | → | Delegated acts applicable before Aug. 2, 2028 | Reglamento (UE) 2026/1744; Reglamento (UE) 2023/1230 | The relationship between the AI Act and the Machinery Regulation is being reorganized to avoid a double regulatory burden. |
“There is no general postponement of the AI literacy requirement: it remains in effect as of February 2, 2025. Nor is the block on general-purpose AI models, applicable as of August 2, 2025, being postponed, without prejudice to specific transitional arrangements.” — Table 2 of the Actiaris report, AI Governance · July 2026
What Organizations Should Monitor, and When
The value of the calendar lies not in memorizing dates, but in organizing compliance in layers. An organization that deploys AI has three distinct tasks: identifying which AI uses exist and who is using them; determining whether each use falls into a regulated category; and retaining sufficient evidence to demonstrate that it operates with human oversight, appropriate controls, and traceable documentation.
The four structural obligations that cannot be deferred
Beyond the specific dates, the Regulation sets out four categories of obligations that, to varying degrees, are already in effect or will take effect without extension as of August 2026:
AI Literacy
Operators and implementers must ensure that personnel working with AI systems have the appropriate skills. No formal degree is required, but evidence of education and training is required.
Now mandatoryTransparency and Labeling of Synthetic Content
Requirement to inform users when they interact with an AI and to label any artificially generated content (images, video, audio, text) in a technically detectable manner.
Since Aug. 2, 2026Effective human supervision
High-risk systems must be designed to allow for supervision by human operators. Human intervention must be able to interrupt, modify, or reject the system's outputs in real time.
Postponed to Dec. 2027Technical Documentation and Risk Management
Risk management system, data quality, Annex IV technical documentation, automated activity logs, transparency, accuracy, robustness, and cybersecurity.
Postponed to Dec. 2027What Organizations Can't Afford to Ignore Before the End of 2026
Postponing Annex III does not eliminate the risk; it merely shifts it. Companies that wait until December 2027 to begin establishing traceability, documentation, and human oversight will be too late. The experience with the GDPR showed that organizations that began adapting two or three years in advance were the ones that were able to demonstrate actual compliance; those that waited until the last month opted for superficial solutions that did not hold up under an audit.
There are three actions that any organization should have completed or underway by January 2027:
Identify all AI systems that are deployed or in use: vendor, function, data processed, whether they make or assist in decision-making, and whether they affect individuals. Without an inventory, classification is not possible.
For each inventory system: Is it for general use (GPAI)? Does it fall into any category in Annex III? Does it generate synthetic content? Does it make decisions about people? The classification determines which regime applies and on what date.
For high-impact use cases, begin documenting: who oversees the AI’s output, how human interventions are recorded, and what evidence exists to show that the process is effectively controlled. This documentation is valuable for a regulatory audit as well as for a contractual dispute or litigation.
These three actions are not formal requirements under the AI Act for all systems, but they constitute the minimum basis for responding to any supervisory authority or counterpart that requires proof of the governance of the AI system being used.
Cryptographic evidence as a response to the requirements of the EU AI Act
The transparency requirement in Article 50—the technically detectable labeling of AI-generated content—demands something that traditional document management systems do not provide: verifiable, independent evidence that content has a specific origin, that it was reviewed by a human, and that this evidence has not been altered.
V-PROOF operates as a layer of cryptographic evidence on top of AI outputs: it generates an hash of the document or content, anchors it via IPFS, and records it on Base L2, creating an on-chain seal on-chain by any third party without the need for credentials or reliance on the provider. The evidence never expires. Regulators do not need to trust the company’s system; they can verify it independently.
In addition to Article 50, V-PROOF the evidentiary aspects of Article 14 (human oversight: immutable record of critical interventions and authorizations) and Article 16 (data traceability and integrity in high-risk systems).
For organizations that develop their own AI models—including newly created in-house LLMs— V-PROOF AI Orchestrator module V-PROOF and cryptographically seals each phase of the lifecycle: data ingestion, EDA, training, evaluation, staging, and production deployment. Each model version receives its V-Seal , including models that do not pass evaluation. This coverage directly addresses the obligations set forth in Articles 53 through 55 of the Regulation, which establish the requirements for technical documentation, training data traceability, and GPAI model governance for providers that develop models internally.
For more information, visit vproofprotocol.com →What does V-PROOF cover V-PROOF the EU AI Act?
What V-PROOF covers, where it applies, and what is outside the product's scope
- Immutable cryptographic evidence of AI outputs — hash + IPFS + L2 layer, verifiable by any third party without credentials or reliance on a provider. Art. 50 · Labeling of AI-generated content
- An immutable record of interventions and authorizations for human oversight of AI systems. Art. 14 · Human Oversight
- Seal of integrity and traceability for data processed by high-risk systems, with timestamp on-chain timestamp . Art. 16 · Obligations of High-Risk Providers
- Verifiable technical documentation and an audit trail of critical system event logs. Art. 12 · Log Recording · Art. 13 · Transparency
- No additional infrastructure. No complex onboarding. Integration with existing outputs. All applicable items · Cross-functional implementation
- AI Orchestrator: Cryptographic traceability of the full lifecycle of ML/LLM models — ingestion → EDA → training → evaluation → staging → production. V-Seal version with recorded metrics. Audit trail for each phase, including models that do not pass evaluation. Art. 10 · Training Data Traceability · Arts. 53–55 · GPAI
- Article 50 has been in effect since Aug. 2, 2026: any organization that generates synthetic content must include detectable technical markup. Article 50 · Effective immediately
- Digital Omnibus: 16 meses adicionales para preparar la evidencia de alto riesgo. Ventana para implantación sin presión. Art. 113 modificado · Reglamento (UE) 2026/1744
- Regulated sectors—healthcare, finance, human resources, education—covered by Annex III, with requirements for demonstrable traceability to regulators. Annex III · High-risk systems
- B2B Contracts with AI Audit Trail Clauses: Implementers Require Evidence from Their Model Providers. Art. 25 · Responsibilities in the Value Chain
- It does not replace the conformity assessment by a notified body for high-risk systems. Art. 43 · Conformity Assessment
- It does not validate the intrinsic quality or biases of the training data, nor does it audit the model’s internal architecture. V-PROOF the process—it does not evaluate the technical quality of the data or the model. Art. 10 · Data Quality and Bias · Internal Technical Evaluation
- Does not apply to systems that do not generate documentable outputs or that operate without recordable intermediate outputs. Embedded systems or systems without structured output
- It does not perform the initial inventory of the organization's AI systems—this is the starting point prior to V-PROOF. Art. 4 · Literacy · Step Zero of Compliance
Does your organization know where it stands with regard to the AI Act?
We identify your regulatory exposure, classify your AI systems, and generate the cryptographic evidence required by the Regulation. No prior inventory required, no additional infrastructure needed.
Let's talk →Official sources and references
- Consolidated text of Regulation (EU) 2024/1689 — EUR-Lex · CELEX 02024R1689-20240712
- Official Publication of the AI Act in the OJEU — EUR-Lex · ELI / OJ
- Article 113 and Base Timeline — AI Act Service Desk · European Commission
- Official AI Act Implementation Page — European Commission · Shaping Europe's Digital Future
- Reglamento (UE) 2026/1744 del Parlamento Europeo y del Consejo (Digital Omnibus sobre IA) — publicado en el DOUE el 24 de julio de 2026. Consultar versión consolidada en EUR-Lex.
- Aprobación política del Consejo, 29 de junio de 2026 — Consejo de la UE · comunicado oficial
- Análisis de la reforma — RocaJunyent, "La UE redefine las reglas de la IA: claves del nuevo Reglamento Ómnibus", 24/07/2026.
