AI Act deadlines. Half the ones you'll find online have been out of date since July.

On 24 July 2026 the AI Act timeline was rewritten, and the high-risk dates slipped by more than a year. But the postponement covers exactly the part a small business doesn't use, while the part that does concern it has already kicked in.

This piece belongs to the guide on AI Act obligations for businesses and SMEs and keeps its timeline up to date. It's written for people running a business, and it stops where a lawyer's work begins.

What has already kicked in

The AI Act entered into force on 1 August 2024 and applies in stages. Article 113 sets the general date at 2 August 2026 and lists the exceptions, which were rewritten in July 2026.

Date	What kicks in	Status
2 February 2025Chapters I and II	General provisions, definitions, staff AI literacy under Article 4 and the prohibitions in Article 5.	In force
2 August 2025governance and models	Chapter III Section 4, Chapter V on general-purpose models, Chapter VII on governance, Chapter XII and Article 78, with the exception of Article 101.	In force
27 July 2026Articles 102 to 110	The amendments to other Union acts, brought forward by the omnibus through a new point in Article 113.	In force
2 August 2026general date	The regulation applies, and with it the transparency obligations in Article 50: say when there's an AI involved, and disclose synthetic content.	In force

What's still to come

After the postponement, four dates remain, and the first is only a few months away. The two in the middle concern high-risk systems, so a minority of businesses; the last concerns the public sector.

Date	What kicks in	Who it applies to
2 December 2026two deadlines	The two new prohibited practices in Article 5, and the deadline for marking synthetic content from systems placed on the market before 2 August 2026.	Anyone generating synthetic content. The next one due.
2 December 2027high-risk, Annex III	Chapter III, Sections 1, 2 and 3, for high-risk systems under Article 6(2). Postponed from 2 August 2026.	Businesses using systems for the Annex III use cases, recruitment for example.
2 August 2028high-risk, Annex I	The same sections, for high-risk systems under Article 6(1): those tied to products. Postponed from 2 August 2026.	Manufacturers of products with an intelligent component built in.
2 August 2030public sector systems	Providers and deployers of high-risk systems intended for public authorities take the measures needed to comply, under Article 111.	The public sector and its suppliers.

What has been postponed, and what hasn't

Regulation (EU) 2026/1744, published in the Official Journal of the European Union on 24 July 2026, rewrote point (c) of the third paragraph of Article 113. Chapter III, Sections 1, 2 and 3, except Article 6(5), now applies from 2 December 2027 for Annex III and from 2 August 2028 for Annex I.

“Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), shall apply from: 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III.”
Regulation (EU) 2024/1689, Article 113, as replaced by Regulation (EU) 2026/1744 (our translation of the Italian text)

The reason is in the recitals, and it isn't political. Delays in the availability of harmonised standards, common specifications and guidance made application difficult and implementation costs disproportionate, to the point where keeping the original date couldn't be justified.

What almost no article points out is how narrow the postponement is. The prohibitions in Article 5, AI literacy under Article 4, the transparency obligations in Article 50, governance and the rules on general-purpose models all keep their dates. An ordinary business hasn't gained a single day on anything that concerns it.

The next real date: 2 December 2026

It's the only deadline still ahead that affects private businesses, and it brings two different things. The first is the two new prohibited practices added to Article 5 by the omnibus: points (ba) and (bb) of paragraph 1, with paragraphs 1a and 1b, on the non-consensual generation or manipulation of sexually explicit material and on the material covered by Directive 2011/93/EU.

The second is a catch-up deadline for providers. Anyone who placed on the market before 2 August 2026 a system that generates audio, image, video or text synthetic content, general-purpose systems included, must take the measures needed to comply with Article 50(2), machine-readable marking, by that date.

For a business buying tools, the second deadline comes down to a question for your supplier: will the content your system generates be marked by 2 December 2026? It's worth having the answer in writing.

Systems already in use, and the acquired rights that don't exist

The transitional provisions are in Article 111, which was also amended in 2026. For high-risk systems placed on the market or put into service before Chapter III applies, the regulation applies only if, from that date, they undergo significant changes in their design.

The exception is the public sector. Providers and deployers of high-risk systems intended to be used by public authorities must take the measures needed to comply by 2 August 2030 in any case.

For the transparency obligations it's the other way round, and it's worth saying plainly because this is where most of the confusion comes from. Article 50 grants no acquired rights: it applies to systems in scope regardless of when they were placed on the market. An assistant installed on a website in 2024 had to be disclosed from 2 August 2026.

The Italian deadline nobody's watching

Alongside the European timeline runs a national one. Article 24 of Law 132/2025 empowers the Government to adopt one or more legislative decrees bringing national law into line with the regulation, within twelve months of the law coming into force: by 10 October 2026.

Those decrees have to give AgID and ACN, designated as national authorities by Article 20, all the supervisory, inspection and enforcement powers the regulation provides for. Until they arrive, Italy's penalty framework for the AI Act remains incomplete, while the European obligations apply in full.

Meanwhile, the regulation's penalties are those in Article 99: up to €35 million or 7% of total worldwide annual turnover for prohibited practices, and up to €15 million or 3% for the band that includes the transparency obligations, with the lower of the two figures applying to SMEs.

In practice, a business has two timelines to watch, and the two nearest deadlines, 10 October and 2 December 2026, both fall in the coming months.

Why the dates you read online are often out of date

The postponement dates from July 2026, so every page written before then gives 2 August 2026 as the high-risk date. Those pages have hardly ever been updated, and they keep showing up near the top of the results because they have years of history behind them.

The way to get it right is always the same and doesn't need a subscription: check the consolidated version of the regulation on EUR-Lex rather than a commentary. The consolidated version includes the amendments; a commentary includes the date it was written.

It works the other way too. If someone tells you the AI Act has been postponed so you don't need to do anything, they're using the high-risk postponement to cover obligations that have been in force for eighteen months.

The three dates that apply to you, and what to do now

Strip everything else away, and for a business using third-party tools the timeline comes down to three lines, two of which have already passed.

2 February 2025. The obligation to see to the skills of the people using the systems, and the prohibitions. If you've never run an internal session on the tools you use, that's the first thing to do, and it takes a morning.

2 August 2026. The disclosures: one line under every automated point of contact, and a note on generated content where it's needed. 2 December 2026. Marking synthetic content from existing systems, which is a question to pass on to your supplier.

In the systems we build, these things are part of the project rather than a last-minute scramble: any message that commits the business, such as offers, quotes, prices and confirmations, goes out only after a person has read and approved it. Replies drawing on information the owner has already approved can go out on their own, the owner switches that on and off channel by channel, and the reply says it comes from a system, as Article 50 requires. The full scope is in our AI principles, and the systems we actually use are on the AI transparency page.

Questions and answers

This article is a practical overview, not legal advice. On how a deadline applies to a specific system, the answer has to come from a professional who looks at your business.