EU AI Act: What Applies Now and What Waits

Why this is required?

AI governance is the set of rules, roles and checks an organisation uses to keep its AI safe, fair and lawful. Udemy's September 2026 learning data showed demand for AI ethics and governance rising 23% month over month.

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. The Digital Omnibus on AI, Regulation (EU) 2026/1744, changed those stages and entered into force on 27 July 2026. The main dates now are:

• 2 August 2026: transparency rules under Article 50 apply. The Omnibus did not defer them.
• 2 December 2026: two new prohibitions apply, covering systems that generate non-consensual sexual deepfakes and child sexual abuse material.
• 2 December 2027: high-risk rules apply to Annex III systems, such as those used in recruitment or credit scoring.
• 2 August 2028: high-risk rules apply to AI embedded in regulated products under Annex I.

Many guides still quote 2 August 2026 as the date for high-risk systems. That date has moved, so check any checklist against the official timeline before you rely on it.

flowchart LR
  A[2 Aug 2026 transparency rules apply] --> B[2 Dec 2026 new prohibitions]
  B --> C[2 Dec 2027 Annex III high-risk]
  C --> D[2 Aug 2028 Annex I high-risk]

How you can achieve this?

Four steps turn the calendar into a plan a small team can run.

• Inventory your AI use. List every AI system you build, buy or deploy, including chat tools in support and hiring software.
• Check the transparency duties now. If people talk to an AI system, or your product generates synthetic content, the Article 50 duties apply from 2 August 2026.
• Flag high-risk candidates early. Recruitment and credit-scoring systems are the Annex III examples, and the high-risk rules include documentation and human oversight. Start those records now.
• Put the dates in your roadmap. Add 2 December 2026 and 2 December 2027 to the project calendar, and review them when the Commission publishes guidance.

Keep the inventory in a simple record. The same fields work for a spreadsheet or a database.

type RiskTier = "prohibited" | "high" | "transparency" | "minimal";

interface AISystemRecord {
  name: string;
  owner: string;          // a named person
  purpose: string;
  riskTier: RiskTier;     // agree this with counsel; it is not a legal opinion
  usesPersonalData: boolean;
  humanOversight: string; // who can stop or override the system
  nextReviewBy: string;   // ISO date, e.g. "2026-12-02"
}

flowchart TD
  A[AI system in your inventory] --> B{Prohibited practice?}
  B -->|yes| X[Stop and remove it]
  B -->|no| C{Listed in Annex III or a regulated product?}
  C -->|yes| D[Plan high-risk duties for 2027 or 2028]
  C -->|no| E{Talks to people or makes synthetic content?}
  E -->|yes| F[Apply transparency duties now]
  E -->|no| G[Record it and review it regularly]

Review the record whenever a feature, a data source or a customer changes, because the tier can change with the use.

With/Without this concept?

Governance can be a one-page record or an expensive programme. The difference is whether the record answers the questions a regulator or a client will ask.

Effort comes up front, and documentation can feel like overhead. It is worth it for systems that touch hiring, credit, health or children's data, and for any chatbot that talks to customers. For a small internal tool, a one-page record is usually enough.

Beyond the EU rules, the Udemy data lists ISO/IEC 42001 and the NIST AI Risk Management Framework among the frameworks learners study, and both give teams a structure for this work. They do not change the dates in this article.

This article is general information, not legal advice. Check the official text of Regulation (EU) 2026/1744 and the AI Act Service Desk timeline before acting on any date.