EU AI Act Summary 2026: The Four Risk Categories, Every Live Deadline, and What the Digital Omnibus Changed

TL;DR. The EU AI Act (Regulation (EU) 2024/1689) regulates AI by risk. Four categories decide what you owe: unacceptable risk (banned), high risk (heavy obligations), limited or transparency risk (disclosure duties) and minimal risk (no new duties). A separate track covers general-purpose AI (GPAI) models. The Digital Omnibus on AI, Regulation (EU) 2026/1744, published on 24 July 2026 and in force since 27 July 2026, pushed the high-risk deadlines back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Prohibitions, AI literacy, GPAI rules, Article 50 transparency and AI Office enforcement powers are already live.

This is the one-page EU AI Act summary we wish existed when we started: organised by risk category, current as of October 2026, and honest about what is enforceable now versus later.

What the EU AI Act is, in one paragraph

The AI Act is an EU regulation, so it applies directly in all 27 member states without national transposition. It sets product-safety style rules for AI systems placed on the EU market or whose outputs are used in the EU, regardless of where the provider is based (see our guide to extraterritorial scope under Article 2). Obligations depend on two things: which risk category the system falls into and which role you play (provider, deployer, importer, distributor; see EU AI Act roles explained).

The four EU AI Act risk categories

Risk category	Typical examples	Core obligations	Applies from
Unacceptable risk (prohibited)	Social scoring, manipulative or exploitative AI, untargeted facial-image scraping, emotion recognition at work or school, most real-time remote biometric ID by police; new: nudifier apps and AI generating CSAM	Banned outright. No compliance route.	2 Feb 2025 (new nudifier/CSAM ban: 2 Dec 2026)
High risk	Annex III uses: recruitment and HR, education and exams, credit scoring, life and health insurance pricing, critical infrastructure, biometrics, law enforcement, migration, justice. Annex I: AI safety components in regulated products (medical devices, toys, lifts, vehicles)	Risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, QMS, conformity assessment, CE marking, EU database registration; deployer duties under Article 26 and FRIAs for some deployers	Annex III: 2 Dec 2027. Annex I: 2 Aug 2028. Public-authority systems: 2 Aug 2030
Limited / transparency risk	Chatbots, emotion recognition and biometric categorisation (where not banned), deepfakes, AI-generated text published on matters of public interest, synthetic image/audio/video output	Tell people they are interacting with AI; label deepfakes; mark synthetic content in a machine-readable way	2 Aug 2026 (legacy systems: machine-readable marking by 2 Dec 2026)
Minimal risk	Spam filters, recommendation engines, AI in video games, most internal productivity tools	No new obligations beyond AI literacy; voluntary codes encouraged	n/a

1. Unacceptable risk: the Article 5 prohibitions

Eight practices have been banned since 2 February 2025, including social scoring, subliminal or manipulative techniques that cause significant harm, exploitation of vulnerabilities, predictive policing based solely on profiling, untargeted scraping to build facial recognition databases, emotion recognition in workplaces and schools, biometric categorisation to infer sensitive traits, and real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions).

The Digital Omnibus added a ninth: from 2 December 2026, AI systems that generate non-consensual intimate imagery of identifiable people, or child sexual abuse material, are prohibited. For providers the ban bites not only where that is the intended purpose but also where such output is a reasonably foreseeable and reproducible outcome and the system lacks adequate safeguards. There is no grandfathering for systems already on the market. Full detail: Article 5 prohibited practices guide.

2. High risk: where most of the compliance work sits

A system is high-risk by one of two routes: it is a safety component of a product covered by EU harmonisation law listed in Annex I, or it is used for one of the purposes listed in Annex III. Article 6(3) lets a provider conclude that an Annex III system is not high-risk if it only performs a narrow procedural or preparatory task, but the Omnibus kept the duty to register such self-assessed systems in the EU database, through a simplified procedure. Use our high-risk classification guide to work through the test.

Providers carry the heaviest load (Articles 9 to 17, 43, 47 to 49, 72 and 73). Deployers have their own Article 26 obligations, and public bodies and certain private deployers must complete a fundamental rights impact assessment.

3. Limited risk: transparency under Article 50

Article 50 has applied to new systems since 2 August 2026. Chatbots must disclose that the user is talking to AI, deepfakes must be labelled, and providers of generative systems must mark outputs in a machine-readable, detectable way. Systems already on the market before 2 August 2026 have until 2 December 2026 for the marking obligation. See our Article 50 guide and the deeper dive on machine-readable marking and C2PA.

4. Minimal risk: most AI

The large majority of AI systems in use today fall here. They carry no specific AI Act obligations, although the general AI literacy provision in Article 4 still touches every provider and deployer. The Omnibus reworded Article 4 so that the Commission and member states "support and facilitate" AI literacy rather than requiring each organisation to "ensure" it, which lowers the evidentiary burden without removing the expectation.

The separate track: general-purpose AI models

GPAI models (large foundation models that can perform a wide range of tasks) are regulated as models, not by use case. Since 2 August 2025, every GPAI provider must keep technical documentation, give information to downstream providers, adopt a copyright policy and publish a training-data summary using the Commission template. Models with systemic risk (trained above 10^25 FLOPs or designated by the Commission) must also evaluate and mitigate systemic risk, report serious incidents and ensure cybersecurity. Models placed on the market before 2 August 2025 have until 2 August 2027. Since 2 August 2026 the AI Office can request information, access models and fine providers. Our GPAI obligations guide covers the details.

Master timeline: what is live now and what is next

Date	What applies	Status (Oct 2026)
1 Aug 2024	AI Act enters into force	Done
2 Feb 2025	Article 5 prohibitions; AI literacy (Article 4)	Live
2 Aug 2025	GPAI model obligations; governance and penalty provisions	Live
27 Jul 2026	Digital Omnibus (Reg. 2026/1744) in force	Live
2 Aug 2026	Article 50 transparency for new systems; AI Office enforcement powers; national authorities operational	Live
2 Dec 2026	Machine-readable marking for systems already on market; new nudifier/CSAM prohibition	2 months away
2 Aug 2027	GPAI models placed before Aug 2025 must comply; national AI regulatory sandboxes due	Upcoming
2 Dec 2027	Annex III high-risk obligations	Upcoming
2 Aug 2028	Annex I high-risk obligations (AI in regulated products)	Upcoming
2 Aug 2030	High-risk systems intended for use by public authorities	Upcoming

Sources: Cooley on Regulation (EU) 2026/1744; Gibson Dunn on the Omnibus agreement. For the full re-baselining exercise see EU AI Act implementation status 2026.

What else the Digital Omnibus changed

Beyond the dates, the Omnibus made targeted structural changes:

• Machinery: the Machinery Regulation moved from Section A to Section B of Annex I, so AI in machinery is handled mainly through sectoral rules.
• "Safety component" narrowed: AI that only assists users or optimises performance, and whose failure does not create health or safety risk, should not be swept into high-risk by default.
• Bias detection: the "strict necessity" threshold for processing special-category data to detect and correct bias was kept.
• SMEs and small mid-caps: SME simplifications now extend to small mid-cap enterprises, including lighter documentation and post-market monitoring flexibility.
• Sandboxes: a new EU-level sandbox run by the AI Office, with national sandboxes now due by 2 August 2027.
• AI Office powers: exclusive competence over AI systems built on a GPAI model by the same provider or corporate group.

Penalties at a glance

Article 99 sets three tiers: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for most other obligations; up to EUR 7.5 million or 1% for supplying incorrect or misleading information. GPAI providers face fines of up to EUR 15 million or 3%, imposed by the Commission. SMEs pay the lower of the two amounts. More in our Article 99 penalties guide.

What to do this quarter

1. Inventory every AI system, including AI features switched on inside SaaS tools you already buy.
2. Classify each one into one of the four risk categories and record your reasoning, especially for any Article 6(3) exemption.
3. Kill or fix anything near Article 5, and check generative tools against the new nudifier/CSAM ban before 2 December 2026.
4. Ship Article 50 disclosures and marking for chatbots and generative features; legacy systems have until 2 December 2026.
5. Confirm your role for each system; buyers who substantially modify a system can become its provider.
6. Use the high-risk runway to build the risk management system, technical file and QMS before December 2027 rather than after.
7. Document AI literacy measures, even though the Article 4 wording softened.

If you need a structured starting point, our 10-step compliance triage guide routes you to the right obligation set.

FAQ

What is the EU AI Act in simple terms? An EU regulation that sorts AI into four risk categories and attaches obligations to each, from outright bans to simple disclosure, with a separate regime for general-purpose AI models.

What are the four risk levels of the EU AI Act? Unacceptable (prohibited), high, limited (transparency) and minimal. GPAI models are regulated on a parallel track.

Is there an official EU AI Act PDF? Yes. The authoritative text is Regulation (EU) 2024/1689 on EUR-Lex, which offers PDF downloads. Read it together with the amending Regulation (EU) 2026/1744, or use the consolidated version once EUR-Lex publishes it.

Did the Digital Omnibus delay the whole AI Act? No. It delayed high-risk obligations only. Prohibitions, AI literacy, GPAI rules, Article 50 transparency and enforcement powers stayed on schedule, and the Omnibus added a new prohibition.

When do high-risk AI obligations apply now? 2 December 2027 for Annex III systems, 2 August 2028 for Annex I systems, and 2 August 2030 for high-risk systems intended for use by public authorities.

Does the EU AI Act apply to companies outside the EU? Yes, if they place AI on the EU market or their AI output is used in the EU.

This article is general information, not legal advice.