EU AI Act after the 2026 amendment: which deadline applies to whom

As of 25 October 2026. Revised version of the article from 26 March 2026, which still gave 2 August 2026 for the high-risk obligations. Change log at the end.

Summary. The EU amended the AI Act in July 2026, and the amendment has been in force since 27 July 2026 [9]. The obligations for high-risk systems, for example in recruitment, now only apply from 2 December 2027, and for AI in products such as lifts or toys from 2 August 2028 [7][9]. The AI literacy obligation has applied since February 2025, the transparency rules since 2 August 2026, and in December 2026 two new prohibitions are added [7]. In Germany, the Federal Network Agency (Bundesnetzagentur) has been the central supervisor since 29 July 2026 [13]. Five questions help you sort out which deadlines affect you.

Note: This article is expressly not legal advice. It describes what the legal texts say, as of 25 October 2026. Whether and how an obligation applies to your organisation is something to clarify with a lawyer.

A deadline that disappeared six days before

On 24 July 2026, Regulation (EU) 2026/1744 of 8 July 2026 was published in the Official Journal of the EU [7]. It entered into force on the third day after publication, on 27 July 2026 according to the Commission [2][9]. Until then, the original text of the AI Act gave 2 August 2026 as the general date of application, with exceptions only for certain chapters and Article 6(1) [1].

For an applicant tracking system with AI, this meant: the high-risk obligations were due to apply from 2 August 2026 [1]. That is also what this blog said. Six days before that date, a new timetable applied. For recruitment, the text now says 2 December 2027, 16 months later [7].

Where you get the current text

The amending regulation only says which sentences are replaced. EUR-Lex has a consolidated version as of 27 July 2026 [7]. It carries the notice: "This text is meant purely as a documentation tool and has no legal effect." [7] Only the two regulations published in the Official Journal are legally binding [1][2].

An example: you are looking for the deadline for marking AI images. The original text from 2024 has no transitional rule in Article 111(4), it only came with the amendment [2]. The consolidated version shows it in one text together with Article 50 [7].

Provider or deployer

Almost every obligation depends on your role. Under Article 3(3), a provider is anyone who develops an AI system or has it developed and places it on the market under its own name or trademark [7]. Under Article 3(4), a deployer is anyone "using an AI system under its authority" [7].

An example: an agency uses ChatGPT for advertising copy. For this case, Article 3(4) looks at the use of a system under its own authority [7]. If the same agency builds a chatbot for a client and delivers it under its own name, Article 3(3) mentions, among other things, placing on the market under its own name or trademark [7]. Article 25(1) lists cases in which a distributor, importer, deployer or other third party is considered a provider of a high-risk system, for example if it puts its name or trademark on such a system (point (a)) or modifies the intended purpose so that it becomes high-risk (point (c)) [7].

The deadlines at a glance

Date	What applies	For whom	Reference
2.2.2025	General provisions including AI literacy (Art. 4), prohibitions no. 1 to 8	all providers and deployers	Art. 113(a) [7][9]
2.8.2025	Obligations for general-purpose AI models, governance, penalties	model providers, authorities	Art. 113(b) [7]
2.8.2026	General date of application, including the transparency obligations under Art. 50	providers and deployers of certain systems	Art. 113 [7]
29.7.2026	German implementing act KI-MIG in force, Federal Network Agency responsible	everyone in Germany	KI-MIG [13]
2.12.2026	New prohibitions in points (ba) and (bb); marking under Art. 50(2) for systems placed on the market before 2.8.2026	providers and deployers (prohibitions); providers (Art. 111(4))	Art. 113(a), Art. 111(4) [7]
2.8.2027	Obligations for general-purpose AI models placed on the market before 2.8.2025	model providers	Art. 111(3) [7]
2.12.2027	High-risk obligations for systems under Annex III, for example recruitment	providers and deployers	Art. 113(c)(i) [7]
2.8.2028	High-risk obligations for AI in products under Annex I, for example lifts or toys	providers and deployers	Art. 113(c)(ii) [7][9]
2.8.2030	High-risk legacy systems used by public authorities	providers and deployers at public authorities	Art. 111(2) [7]

AI literacy already applies and is now supervised

Article 4 has applied since 2 February 2025 [7]. The amendment reworded it. Before, providers and deployers had to ensure AI literacy "to their best extent" [1]. Now they take measures "to support the development of AI literacy" of their staff [2]. The new sentence reads: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." [7]

The Commission's Q&A asks exactly this question: does a company whose staff use ChatGPT for advertising copy or translations have to comply with Article 4? The Commission's answer: yes, staff should be informed about the specific risks, for example hallucinations [8]. According to the Commission, a certificate is not necessary, an internal record of the training is enough, and Article 4 does not require a dedicated AI officer [8].

Article 4 is supervised by the national authorities, from 2 August 2026 according to the Commission [8]. Under Article 99(1), the Member States lay down the penalties [7]. Article 4 appears neither in the list in Article 99(4) nor in § 15 KI-MIG [7][13].

Transparency since August 2026

Article 50 has applied since 2 August 2026, with the general date of application [7]. Under Article 50(2), providers of systems that generate synthetic text, images, audio or video ensure that the outputs are "marked in a machine-readable format" [7]. For systems placed on the market before 2 August 2026, Article 111(4) sets a deadline of 2 December 2026 [7].

Deployers have an obligation of their own. If you use an AI system to generate images, audio or video that constitute a deep fake, Article 50(4) requires you to disclose that the content has been artificially generated or manipulated [7]. A separate disclosure obligation applies to AI-generated text published to inform the public on matters of public interest. It does not apply where the text has undergone human review or editorial control and someone holds editorial responsibility [7].

An example from this site: AI images on a-ops.de carry the sentence "Image generated with AI. It does not depict a real person or a real event." [15] Article 3(60) describes a deep fake as content that resembles existing persons, places or events and would falsely appear to be authentic [7]. The site labels its AI images regardless.

High-risk: more time, same obligations

The amendment postpones the high-risk obligations, it does not delete them. For systems under Annex III, they apply from 2 December 2027 [7]. Under Annex III point 4(a), this includes AI intended for the recruitment or selection of natural persons, "in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates" [7].

The deployer obligations are set out in Article 26. Three of them concern the HR department directly. Human oversight goes to people "who have the necessary competence, training and authority" [7]. Deployers keep the logs automatically generated by the system, to the extent they are under their control, "for a period appropriate to the intended purpose of the high-risk AI system, of at least six months, unless provided otherwise in applicable Union or national law, in particular in Union law on the protection of personal data" [7]. And before use at the workplace, the employer informs the workers' representatives and the affected workers [7].

An example: an applicant tracking system pre-sorts incoming applications by fit. Annex III point 4 mentions analysing and filtering job applications [7]. Article 6(3) lists exceptions, for example where a system only performs a narrow procedural task or a preparatory task [7]. But if it performs profiling of natural persons, Article 6(3) says it is always considered high-risk [7].

Two new prohibitions from December 2026

The amendment added two prohibitions that apply from 2 December 2026 [7]. Point (ba) concerns AI that generates realistic images, videos or audio showing the intimate parts of an identifiable person without that person's explicit consent [7]. Point (bb) concerns material within the meaning of Directive 2011/93/EU, that is, depictions of child sexual abuse [7].

Paragraph 1a narrows this down. For providers, a system is prohibited if such content is its intended purpose or if it produces such content as a reasonably foreseeable and reproducible outcome because safeguards are missing [7]. For deployers, under paragraph 1a point (b), use is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material [7]. The Commission guidelines on prohibited practices, C(2025) 5052 of 29 July 2025, predate the amendment [10]. They do not yet cover the new prohibitions [10]. The Commission itself states that the guidelines are not binding and that the authoritative interpretation lies with the Court of Justice of the EU [11].

Fines and supervision in Germany

The upper limits are set out in Article 99. For prohibited practices, fines go up to EUR 35 million or 7 % of worldwide annual turnover, whichever is higher [7]. For infringements of, among others, deployer obligations under Article 26 and transparency obligations under Article 50, they go up to EUR 15 million or 3 % [7]. For incorrect, incomplete or misleading information supplied to authorities, they go up to EUR 7.5 million or 1 % [7]. For SMEs, Article 99(6) sets the lower of the two amounts in each case [1]. Under paragraph 6a, the same applies to the newly introduced small mid-cap enterprises for paragraphs 4 and 5 [7].

In Germany, responsibility is set out in the KI-MIG of 22 July 2026, promulgated in the Federal Law Gazette on 28 July 2026 [13]. It has applied since 29 July 2026 [13]. Under § 2(1), the Federal Network Agency is responsible, unless the act provides otherwise [13]. Under § 8, it receives complaints as the central complaints office [13]. For certain infringements, § 15 sets its own fines of up to fifty thousand euros, for example where a deployer of a high-risk system under Annex III points 1, 3, 4 or 5 fails to ensure that an affected person receives the explanation under Article 86(1) [13]. § 15 refers to the Regulation "in the version of 13 June 2024" (our translation), that is, to the original text before the 2026 amendment [13].

Worksheet: the five-question check

Take the list of AI tools in your team and ask five questions about each tool. The answers show you which row of the table you need to read.

1. Are you a provider or a deployer? Your own system under your name: Article 3(3) and Article 25. Someone else's system under your authority: Article 3(4) and Article 26 [7].
2. Is the intended purpose listed in Annex III? Recruitment, promotion, termination, task allocation and performance monitoring are listed there under point 4 [7]. If yes: deadline 2 December 2027, and check the exceptions in Article 6(3) [7].
3. Is the AI part of a product under Annex I? For example lifts or toys. If yes: deadline 2 August 2028 [7][9].
4. Does the tool generate text, images, audio or video that other people see? If yes: Article 50 has applied since 2 August 2026 [7]. As a provider of a system placed on the market before that date, you have until 2 December 2026 for paragraph 2 [7].
5. Was the system already in use before a cut-off date? Then read Article 111. The Regulation only covers high-risk legacy systems once their design changes significantly, and for public authorities 2 August 2030 applies [7].

Article 4 also applies to every tool. According to the Commission, the people who work with it should know the risks, and an internal record of the training is enough as evidence [8].

Frequently asked questions

We are a small company with 30 employees. Does this affect us at all? The roles in Article 3 and the obligations in Articles 4, 26 and 50 are tied to providers and deployers, and they set no minimum size [7]. For fines, the lower amount applies to SMEs [1]. Under Article 4(2), the Commission publishes practical examples intended to help SMEs in particular [7].

Does the AI Act also apply if we only use a tool internally? Article 3(4) only excludes use in the course of a personal non-professional activity, and the definition says nothing about internal or external use [7]. Annex III point 4 describes the intended purpose, for example analysing or filtering job applications, and says nothing about whether the position is filled internally or externally [7]. Article 2(10) likewise only exempts natural persons from the deployer obligations if they use AI for purely personal, non-professional purposes [7].

Change log

• 26 March 2026: first version "EU AI Act 2026: The Guide for SMEs".
• As of 25 October 2026: revised after Regulation (EU) 2026/1744. High-risk deadlines corrected. The earlier version gave 1.5 % for Article 99(5), the Regulation says 1 % [16][7]. New prohibitions, transitional rule on marking, new wording of Article 4 and KI-MIG added. Seven-step plan replaced by the five-question check.

Sources

1. European Parliament and Council; published by the Publications Office of the EU: Regulation (EU) 2024/1689 of 13 June 2024 (Artificial Intelligence Act), OJ L, 12.7.2024, original version, accessed on 25.10.2026
2. European Parliament and Council; published by the Publications Office of the EU: Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI), OJ L, 24.7.2026, accessed on 25.10.2026
7. Publications Office of the EU (EUR-Lex): Regulation (EU) 2024/1689, consolidated version (as of 27.07.2026), CELEX 02024R1689-20260727, accessed on 25.10.2026
8. European Commission, Shaping Europe’s digital future: AI Literacy: Questions & Answers, accessed on 25.10.2026
9. European Commission, Shaping Europe’s digital future: AI Act (policy page), accessed on 25.10.2026
10. European Commission: Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act), C(2025) 5052 final, accessed on 25.10.2026
11. European Commission: Commission publishes the Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act., accessed on 25.10.2026
13. Federal Law Gazette (recht.bund.de): Gesetz zur Durchführung der Verordnung über künstliche Intelligenz (German act implementing the AI Regulation), BGBl. 2026 I Nr. 223, German only, accessed on 25.10.2026
15. a-ops.de: Spätlese 01: Gregor in the Open-Plan Office, accessed on 25.10.2026
16. a-ops.de: EU AI Act 2026: The Guide for SMEs (version of 26.03.2026), archived in the Wayback Machine on 26.10.2026, accessed on 26.10.2026