Artificial intelligenceEuropean Union

In forceApplies from 2 August 2026, including the transparency duties of Article 50 and the Commission’s fines on general-purpose AI model providers; the high-risk requirements follow the dates set in 2026 (December 2027 / August 2028).

EU Artificial Intelligence Act (2024) and its 2026 « Digital Omnibus » amendment

Regulation (EU) 2024/1689, in force since 1 August 2024, regulates AI according to risk: eight practices banned since 2 February 2025, rules for general-purpose AI models since 2 August 2025, obligations for high-risk systems, transparency duties, fines of up to €35m or 7% of worldwide turnover. Regulation (EU) 2026/1744 (« Digital Omnibus on AI »), in force since 27 July 2026, postponed the high-risk obligations to 2 December 2027 and 2 August 2028 and added a ban on « nudification » apps and AI-generated child sexual abuse material from 2 December 2026.

Updated: November 5, 2026Next milestone: December 2, 2026 — Ban on « nudification » and AI child sexual abuse material applies; marking deadline for generative systems already on the market

At a glance

Reference text

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)[1]

No. 2024/1689 · June 13, 2024

Read the text ↗

Carried by

  • Thierry Breton[4]Member of the European Commission, leading the 2021 proposal (DG CONNECT) · 2021 · Initiator
  • Brando Benifei, Dragoş Tudorache[7]Co-rapporteurs of the European Parliament (Internal Market and Civil Liberties committees) · 2024 · Initiator
  • Henna Virkkunen[6]Member of the European Commission, leading the « Digital Omnibus on AI » proposal (DG CONNECT) · 2025 · Amendment
  • Arba Kokalari, Michael McNamara[8][9]Co-rapporteurs of the European Parliament on the « Digital Omnibus on AI » (Internal Market and Civil Liberties committees) · 2026 · Amendment

Implementation

Status

In force

since August 2, 2026[1][2][9]

Applies from 2 August 2026, including the transparency duties of Article 50 and the Commission’s fines on general-purpose AI model providers; the high-risk requirements follow the dates set in 2026 (December 2027 / August 2028).

Stated objective

Improve the functioning of the internal market and promote the uptake of human-centric and trustworthy AI, while ensuring a high level of protection of health, safety and fundamental rights — including democracy, the rule of law and environmental protection — against the harmful effects of AI systems, and supporting innovation. The 2026 amendment aims to ease implementation, given delayed standards and authorities, « without reducing the level of protection ».[1][2]

According to Article 1 of Regulation (EU) 2024/1689 and recitals 2 and 3 of Regulation (EU) 2026/1744

Main measures

  • Eight banned practices (Article 5): harmful manipulation or deception, exploitation of vulnerabilities, social scoring, predicting crime risk solely from profiling, untargeted scraping of facial images, emotion recognition at work and in schools (save medical or safety reasons), biometric categorisation inferring sensitive traits, and real-time remote biometric identification in public spaces by police, save narrow exceptions under prior authorisation.[1][14]
  • Ninth ban added in 2026, applicable from 2 December 2026: AI systems generating realistic intimate images, videos or audio of an identifiable person without consent (« nudification ») or child sexual abuse material — for providers when it is the intended purpose or a foreseeable outcome without adequate safeguards, and for deployers who use them for that purpose.[2][9]
  • High-risk systems — AI used as a safety component of products under EU safety legislation (Annex I) and AI used in eight areas listed in Annex III, such as recruitment, credit scoring, education, law enforcement or migration — must manage risks, ensure data quality, documentation, logging, human oversight, accuracy and robustness, and undergo a conformity assessment.[1][7]
  • General-purpose AI models: technical documentation, information for downstream providers, a copyright-compliance policy and a public summary of training content. Models trained with more than 10²⁵ floating-point operations are presumed to carry systemic risk and must also be evaluated (including adversarial testing), mitigate risks, report serious incidents and ensure cybersecurity.[1]
  • Transparency: people must be told when they interact with an AI system; AI-generated audio, image, video or text must be marked in a machine-readable format; deep fakes must be disclosed by those who deploy them.[1]
  • Penalties set by Member States: up to €35m or 7% of worldwide annual turnover (whichever is higher) for banned practices; €15m or 3% for most other obligations; €7.5m or 1% for misleading information. For SMEs — and, since 2026, small mid-caps — the lower amount applies. The Commission may fine general-purpose model providers up to €15m or 3%.[1][2]
  • Governance: the Commission’s AI Office enforces the rules on general-purpose AI models (information requests, evaluations, fines) and supervises AI systems built on a model by the same provider, a role reinforced in 2026; national market surveillance authorities enforce the rest; the AI Board brings together the Member States.[1][2][13]
  • 2026 simplifications: narrower definition of « safety component »; AI-literacy duty softened into an obligation to take measures to support staff literacy; personal data may exceptionally be processed to detect and correct bias; machinery moved to its own sectoral safety rules; SME reliefs extended to small mid-caps.[2][1]

In data

Enterprises using AI (10+ employees)

20%

2025

EurostatSee the card →

People using generative AI tools

32.7%

2025

EurostatSee the card →

Key figures

Maximum fine for a banned AI practice

7%

of worldwide annual turnover · Announced

according to Article 99(3) of the regulation[1][2]

Or €35m if higher; for SMEs and small mid-caps, the lower of the two.

European Parliament votes in favour of the AI Act

523

13 March 2024 · Observed

according to the European Parliament[7]

46 against, 49 abstentions.

European Parliament votes in favour of the 2026 omnibus

423

16 June 2026 · Observed

according to the European Parliament[9]

57 against, 174 abstentions.

Estimated administrative savings from the Digital Omnibus on AI (upper bound)

€0.43bn

initial estimate, November 2025 · Announced

according to the European Commission (explanatory memorandum of COM(2025) 836)[5]

Range of about €297.2m to €433.2m, for the proposal as tabled; no impact assessment was carried out.

Timeline

  1. Announced

    Commission proposal COM(2021) 206[3][4]

  2. Under debate

    Parliament adopts its amendments: negotiations with the Council[4]

  3. Provisional agreement between Parliament and Council negotiators[7]

  4. Commission decision setting up the AI Office[1]

    The regulation defines the AI Office as the Commission’s function for implementing, monitoring and supervising AI systems and general-purpose AI models, provided for in the Commission Decision of 24 January 2024.

  5. European Parliament adopts its first-reading position: 523 for, 46 against, 49 abstentions[7][4]

  6. Adopted

    Council approves Parliament’s first-reading position: the act is adopted[4][1]

  7. Signature by the Presidents of the Parliament and of the Council[4][1]

  8. Publication in the Official Journal of the European Union[1][4]

  9. In force

    Entry into force (twentieth day after publication)[1][2]

    In force, with a staggered application: no obligation applies yet on that date.

  10. In force

    Bans on prohibited AI practices and AI-literacy duty apply[1][14]

    Chapters I and II apply: general provisions (including AI literacy) and the eight prohibited practices of Article 5.

  11. General-Purpose AI Code of Practice published[11][12]

    A voluntary code drawn up by 13 independent experts with input from over 1,000 stakeholders, in three chapters (transparency, copyright, safety and security). The Commission and the AI Board confirmed it is an adequate tool for providers to demonstrate compliance; signatories listed by the Commission include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI.

  12. In force

    Rules for general-purpose AI models, governance and penalties apply[1]

    Notified bodies (Chapter III, Section 4), general-purpose AI models (Chapter V), governance (Chapter VII), penalties (Chapter XII, except the Commission’s fines on model providers) and confidentiality apply.

  13. Commission proposes the « Digital Omnibus on AI » (COM(2025) 836)[5][6]

    Citing delays in harmonised standards and in setting up national authorities, the proposal linked the start of the high-risk obligations to a Commission decision confirming that compliance support is available, with backstop dates of 2 December 2027 and 2 August 2028, and gave providers of generative systems already on the market until 2 February 2027 to mark AI-generated content.

  14. Council agrees its position on the Digital Omnibus on AI[10]

  15. European Parliament adopts its amendments to the omnibus[6]

  16. Provisional agreement on the omnibus between Parliament and Council[8]

    The negotiators set fixed dates for the high-risk obligations and brought the marking deadline for AI-generated content forward to 2 December 2026, instead of 2 February 2027 in the Commission proposal.

  17. European Parliament approves the omnibus: 423 for, 57 against, 174 abstentions[9][6]

  18. Council approves Parliament’s position: the omnibus is adopted[6][2]

  19. Regulation (EU) 2026/1744 of 8 July 2026 published in the Official Journal[2][6]

    Signed on 8 July 2026; it entered into force on the third day after its publication.

  20. In force

    Amended by Regulation (EU) 2026/1744 (« Digital Omnibus on AI »)[2][6]

    High-risk obligations postponed to 2 December 2027 (Annex III uses) and 2 August 2028 (AI in products under Annex I legislation); new ban on « nudification » and AI child sexual abuse material from 2 December 2026.

  21. In force

    General date of application: most remaining provisions apply[1][2][9]

    Applies from 2 August 2026, including the transparency duties of Article 50 and the Commission’s fines on general-purpose AI model providers; the high-risk requirements follow the dates set in 2026 (December 2027 / August 2028).

  22. Upcoming — the outcome is not known

    Ban on « nudification » and AI child sexual abuse material applies; marking deadline for generative systems already on the market[2]

    New Article 5(1)(ba) and (bb) apply. Providers of systems generating synthetic audio, image, video or text placed on the market before 2 August 2026 must by then mark outputs in a machine-readable, detectable way (Article 50(2)).

  23. Upcoming — the outcome is not known

    Obligations for high-risk AI systems listed in Annex III apply[2][1]

    Biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, justice and democratic processes. Initially due on 2 August 2026, before the 2026 amendment.

  24. Upcoming — the outcome is not known

    Obligations for high-risk AI embedded in products under EU safety legislation (Annex I) apply[2][1]

    Initially due on 2 August 2027, before the 2026 amendment.

The debate

Citoyen takes no position: arguments are reported as their authors put them.

According to its supporters

  • The Parliament’s co-rapporteurs presented it as the world’s first binding law on AI, meant to reduce risks, combat discrimination and bring transparency, with unacceptable practices banned and workers’ and citizens’ rights protected (Brando Benifei, S&D) and AI linked to the EU’s fundamental values (Dragoş Tudorache, Renew).[7]
  • For the Commission and the co-legislators, the 2026 postponement responds to the late availability of harmonised standards and national authorities, which made compliance heavier than expected; the Commission estimated savings of €297m to €433m. The EESC had recommended aligning high-risk deadlines with the availability of standards.[2][5][16]
  • Omnibus co-rapporteur Arba Kokalari (EPP) argued that « pressing the pause button » and cutting red tape would make it simpler to build tech companies in Europe; co-rapporteur Michael McNamara (Renew) said the text gives legal certainty while preserving the Act’s architecture and adds an outright ban on nudification apps.[9]

According to its opponents

  • In 2021 the European Economic and Social Committee found the bans too narrow: it called for a ban on automated biometric recognition in publicly and privately accessible spaces (except authentication) and on recognition of behavioural signals, whereas the final text allows real-time police identification in listed cases and treats other biometric uses as high-risk.[15][1]
  • The European Committee of the Regions regretted that the omnibus packages were not subject to impact assessments and public consultations to gauge their effect on fundamental-rights safeguards; the Commission states that it carried out no impact assessment, deeming the amendments technical.[17][5]
  • The EESC asked to keep an explicit obligation to ensure a sufficient level of AI literacy among staff — the 2026 text replaced it with a duty to take measures to support it — and to keep transparency towards authorities when providers classify an Annex III system as not high-risk.[16][2]

Indicators to watch

  • Enterprises using AI (10+ employees) · EurostatSee the card →
  • People using generative AI tools · EurostatSee the card →
  • Annual reports on the use of real-time remote biometric identification by law enforcement (Article 5(7)) · Commission européenneno Citoyen card yet

Sources

  1. [1]Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) — OJ L, 2024/1689, 12.7.2024 — EUR-Lex — Official Journal of the European Union, July 12, 2024
  2. [2]Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) — OJ L, 2026/1744, 24.7.2026 — EUR-Lex — Official Journal of the European Union, July 24, 2026
  3. [3]Proposal for a Regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), COM(2021) 206 final — European Commission (EUR-Lex), April 21, 2021
  4. [4]Procedure 2021/0106/COD — steps of the procedure — EUR-Lex
  5. [5]Proposal for a Regulation amending Regulations (EU) 2024/1689 and (EU) 2018/1139 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), COM(2025) 836 final — European Commission (EUR-Lex), November 19, 2025
  6. [6]Procedure 2025/0359/COD — steps of the procedure — EUR-Lex
  7. [7]Artificial Intelligence Act: MEPs adopt landmark law (press release) — European Parliament, March 13, 2024
  8. [8]AI Act: deal on simplification measures, ban on “nudifier” apps (press release) — European Parliament, May 7, 2026
  9. [9]AI Act: EP approves simplification measures and “nudifier” app ban (press release) — European Parliament, June 16, 2026
  10. [10]Legislative Train Schedule — Digital omnibus on AI, 2025/0359(COD) — European Parliament
  11. [11]The General-Purpose AI Code of Practice (contents and signatories) — European Commission — Shaping Europe’s digital future
  12. [12]The General-Purpose AI Code of Practice is now available — European Commission — Shaping Europe’s digital future
  13. [13]European AI Office — European Commission — Shaping Europe’s digital future
  14. [14]AI Act — regulatory framework for AI — European Commission — Shaping Europe’s digital future
  15. [15]Opinion of the European Economic and Social Committee on the Proposal for a Regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) (2021/C 517/09) — European Economic and Social Committee (EUR-Lex, OJ C 517, 22.12.2021), December 22, 2021
  16. [16]Opinion of the European Economic and Social Committee on the Digital Omnibus on AI and the Digital Omnibus (C/2026/3225) — European Economic and Social Committee (EUR-Lex, OJ C, 2.7.2026), July 2, 2026
  17. [17]Opinion of the European Committee of the Regions — Digital simplification and Data Union Strategy (C/2026/3469) — European Committee of the Regions (EUR-Lex, OJ C, 24.7.2026), July 24, 2026