Summary
- One regulation that applies directly in all 27 EU Member States. It sorts AI into four buckets: prohibited, high-risk, transparency risk and minimal risk (no new rules).
- Duties depend on your role (provider, deployer, importer, distributor, authorised representative) and the risk tier of the system. General-purpose AI (GPAI) models have their own chapter.
- It entered into force on 1 Aug 2024 and switches on in stages. Prohibitions and AI literacy applied from 2 Feb 2025; GPAI rules from 2 Aug 2025; most other rules (including Art. 50 transparency) from 2 Aug 2026.
- AI Omnibus (Regulation (EU) 2026/1744): proposed 19 Nov 2025, signed 8 Jul 2026, published in the Official Journal on 24 Jul 2026 and in force since 27 Jul 2026. It is now part of the law, not a proposal.
- The Omnibus postponed high-risk rules to 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I), softened the AI literacy duty, extended SME relief to small mid-caps, added two new prohibitions (non-consensual intimate deepfakes and child sexual abuse material) and widened the AI Office's powers.
Who it applies to
- Providers (who develop an AI system or GPAI model, or have one developed, and place it on the EU market under their own name), wherever they are based (Art. 2(1)(a)).
- Deployers (who use an AI system in a professional capacity) located in the EU (Art. 2(1)(b)).
- Providers and deployers outside the EU where the AI system's output is used in the EU (Art. 2(1)(c)). This is the clause that catches Indian companies that never set up an EU entity.
- Importers, distributors, product manufacturers who ship AI inside their product, and authorised representatives of non-EU providers (Art. 2(1)(d) to (f)).
- Not covered: military, defence and national security uses; pure scientific research and development; personal non-professional use; most free and open-source components unless they are high-risk, prohibited or Art. 50 systems (Art. 2(3), (6), (10), (12)).
Key dates
- Regulation (EU) 2024/1689 signed by Parliament and Council
- Published in the Official Journal (OJ L, 2024/1689)
- Entry into force
- Chapters I and II apply: definitions, AI literacy (Art. 4) and the original eight prohibitions (Art. 5)
- GPAI model obligations, governance and penalty rules apply
- Commission proposes the Digital Omnibus on AI
- European Parliament position on the Omnibus
- Council decision adopting the Omnibus
- Regulation (EU) 2026/1744 (Digital Omnibus on AI) signed in Strasbourg
- Omnibus published in the Official Journal (OJ L, 2026/1744)
- Omnibus enters into force; softer Art. 4 AI literacy duty applies
- General date of application: Art. 50 transparency, national and EU enforcement
- New prohibitions on non-consensual intimate material and CSAM apply; Art. 50(2) marking deadline for generative systems already on the market before 2 Aug 2026Upcoming
- Each Member State to have at least one AI regulatory sandbox running; legacy GPAI models must comply (Art. 111(3))Upcoming
- High-risk rules apply to Annex III systems (postponed from 2 Aug 2026)Upcoming
- High-risk rules apply to Annex I product systems (postponed from 2 Aug 2027)Upcoming
- Legacy high-risk systems used by public authorities must complyUpcoming
Full date record
| Date | Event |
|---|---|
| 2024-06-13 | AI Act signed (Regulation (EU) 2024/1689) |
| 2024-07-12 | Published in the Official Journal |
| 2024-08-01 | Entry into force |
| 2025-02-02 | Prohibitions (Art. 5) and AI literacy (Art. 4) apply |
| 2025-08-02 | GPAI model obligations, governance and penalty rules apply |
| 2025-11-19 | Commission proposes the Digital Omnibus on AI |
| 2026-06-29 | Council adopts the Omnibus (Parliament position 16 Jun 2026) |
| 2026-07-08 | Omnibus signed as Regulation (EU) 2026/1744 |
| 2026-07-24 | Omnibus published in the Official Journal |
| 2026-07-27 | Omnibus in force; new Art. 4 wording applies |
| 2026-08-02 | General application: Art. 50 transparency, enforcement by AI Office and national authorities |
| 2026-12-02 | New Art. 5 bans (intimate deepfakes, CSAM) apply; Art. 50(2) marking deadline for generative systems on the market before 2 Aug 2026 |
| 2027-08-02 | National sandboxes due; GPAI models placed before 2 Aug 2025 must comply |
| 2027-12-02 | High-risk rules apply to Annex III systems (was 2 Aug 2026) |
| 2028-08-02 | High-risk rules apply to Annex I product systems (was 2 Aug 2027) |
| 2030-08-02 | Legacy high-risk systems used by public authorities must comply |
Penalties and enforcement
- Art. 99(3): prohibited practices, up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher.
- Art. 99(4): breaches of most operator duties (providers, authorised representatives, importers, distributors, deployers, notified bodies, Art. 50 transparency), up to EUR 15 million or 3%. The Omnibus added Art. 25(2) and (4) value-chain duties to this list.
- Art. 99(5): incorrect, incomplete or misleading information to authorities or notified bodies, up to EUR 7.5 million or 1%.
- Art. 99(6): for SMEs and start-ups, each cap is the lower of the two figures. The Omnibus also tells Member States to weigh the economic viability of SMEs and SMCs when setting penalties (amended Art. 99(1)).
- Art. 101: the Commission can fine GPAI model providers up to EUR 15 million or 3%.
- No fine is listed in Art. 99 for Art. 4 AI literacy as such; enforcement there depends on national penalty rules.
- Who enforces: national market surveillance authorities for most systems; the AI Office for GPAI models and, after the Omnibus, for AI systems built on a GPAI model by the same provider or group and AI in very large online platforms or search engines (with carve-outs such as financial institutions and law enforcement).
What it means for an Indian company
- Indian SaaS selling AI features to EU customers: you are most likely a provider. Map every AI feature against Art. 5 (stop), Annex III (high-risk) and Art. 50 (disclose). Most chatbots and copilots land in Art. 50 only.
- HR tech, credit scoring, insurance pricing, edtech exam scoring, biometrics: these are Annex III areas. You now have until 2 Dec 2027, but notified bodies, QMS and technical files take 12 to 18 months to build. Start now; the dates are fixed and no longer slide with standards.
- IT services firms building AI for EU clients: usually the client is the provider. Your contract should say so and spell out Art. 25 cooperation (documentation, access, support). If you rebrand or substantially modify a high-risk system, you become the provider.
- GPAI or foundation model builders: Art. 53 duties already apply (technical documentation, downstream information, copyright policy, public training-data summary). Appoint an EU representative (Art. 54).
- Generative AI products: from 2 Aug 2026, outputs must be machine-readable marked (Art. 50(2)); products already on the market before that date have until 2 Dec 2026.
- Image or video generators: the new Art. 5 ban from 2 Dec 2026 requires real safeguards against nudification and CSAM, not just terms of use.
- AI literacy: still a legal duty for every provider and deployer, but now "take measures to support" literacy. A training programme and records are enough evidence; no guaranteed competence level is required.
- An ISO/IEC 42001 AIMS gives you most of the governance scaffolding (policy, inventory, risk, roles); EU-specific items such as CE marking, EU database registration and Art. 73 incident reporting need extra work.
Obligations
Article numbers are from Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. "Provider" and "deployer" follow the Act's definitions.
Showing 35 of 35
| ID | Obligation | Reference | Applies to | Controls |
|---|---|---|---|---|
| EUAIA-01 | Do not place on the market, put into service or use AI for the banned practices: harmful manipulation, exploiting vulnerabilities, social scoring, crime prediction from profiling alone, untargeted facial image scraping, emotion recognition at work or school, sensitive biometric categorisation, real-time remote biometric ID in public for policing (narrow exceptions) | Art. 5(1)(a) to (h) | Both | |
| EUAIA-02 | From 2 Dec 2026, do not offer or use AI that generates realistic non-consensual intimate material of identifiable people or child sexual abuse material; providers of general image or video tools need reasonable and adequate safeguards against these outputs | Art. 5(1)(ba), (bb), 5(1a), 5(1b) (added by Reg. 2026/1744) | Both | |
| EUAIA-03 | Take measures to support AI literacy of staff and others operating AI on your behalf, suited to their background and the context of use (no specific level must be guaranteed) | Art. 4 (as replaced by Reg. 2026/1744) | Both | |
| EUAIA-04 | Classify each AI system: is it a safety component of an Annex I product needing third-party assessment, or used in an Annex III area? | Art. 6(1), 6(2); Annex I, Annex III | Provider | |
| EUAIA-05 | If you claim an Annex III system is not high-risk (Art. 6(3) derogation), document the assessment before launch, give it to authorities on request, and register the system (simplified content after the Omnibus) | Art. 6(3), 6(4); Art. 49(2); Annex VIII | Provider | |
| EUAIA-06 | Run a documented, continuous risk management system across the high-risk system's lifecycle, including testing | Art. 9 | Provider | |
| EUAIA-07 | Govern training, validation and test data: relevance, representativeness, error checks, bias examination and mitigation | Art. 10 | Provider | |
| EUAIA-08 | Process special category personal data for bias detection and correction only where strictly necessary and with the Art. 10(5) safeguards; the Omnibus extends this legal basis to other AI systems, models and deployers | Art. 10(5); Art. 4a (added by Reg. 2026/1744) | Both | |
| EUAIA-09 | Prepare and keep up to date technical documentation (Annex IV) before placing on the market; SMEs and SMCs may use the simplified form | Art. 11; Annex IV | Provider | |
| EUAIA-10 | Build automatic event logging into high-risk systems so their operation can be traced | Art. 12 | Provider | |
| EUAIA-11 | Give deployers clear instructions for use: purpose, accuracy, limits, risks, oversight measures, log handling | Art. 13 | Provider | |
| EUAIA-12 | Design high-risk systems so humans can understand, monitor, override and stop them | Art. 14 | Provider | |
| EUAIA-13 | Achieve and declare appropriate accuracy, robustness and cybersecurity, including against data poisoning, adversarial inputs and model flaws | Art. 15 | Provider | |
| EUAIA-14 | Meet the general provider duties: name and contact on the system, comply with Section 2, take corrective action, cooperate with authorities, meet accessibility rules | Art. 16, 20, 21 | Provider | |
| EUAIA-15 | Operate a documented quality management system (simplified option now open to all SMEs) | Art. 17; Art. 63 | Provider | |
| EUAIA-16 | Keep documentation for 10 years after placing on the market and keep logs under your control | Art. 18, 19 | Provider | |
| EUAIA-17 | Non-EU providers of high-risk systems: appoint an EU authorised representative by written mandate | Art. 22 | Provider | |
| EUAIA-18 | Pass the relevant conformity assessment (internal control or notified body), then draw up the EU declaration of conformity and affix the CE marking | Art. 43, 47, 48 | Provider | |
| EUAIA-19 | Register the high-risk system (and yourself) in the EU database before placing on the market | Art. 49(1); Art. 71 | Provider | |
| EUAIA-20 | Run a post-market monitoring plan that collects and analyses performance data over the system's life | Art. 72 | Provider | |
| EUAIA-21 | Report serious incidents to the market surveillance authority within the Art. 73 deadlines | Art. 73 | Provider | |
| EUAIA-22 | Importers: check conformity assessment, documentation, CE marking and authorised representative before import; do not import non-compliant systems; keep records | Art. 23 | Both | |
| EUAIA-23 | Distributors: check CE marking, declaration and instructions; withhold or withdraw non-compliant systems and inform the provider | Art. 24 | Both | |
| EUAIA-24 | Treat yourself as the provider if you rebrand, substantially modify or repurpose a system into high-risk; suppliers of components must cooperate by written agreement | Art. 25 | Both | |
| EUAIA-25 | Deployers of high-risk AI: use per instructions, assign competent human oversight, check input data relevance, monitor and report risks or incidents, keep logs at least six months | Art. 26(1) to (6) | Deployer | |
| EUAIA-26 | Deployers: inform workers before using high-risk AI at work and tell people when an Annex III system makes or helps make decisions about them | Art. 26(7), 26(11) | Deployer | |
| EUAIA-27 | Public bodies, private providers of public services and deployers of credit-scoring or life and health insurance pricing AI: complete a fundamental rights impact assessment before first use (may cross-refer to a DPIA) | Art. 27 | Deployer | |
| EUAIA-28 | Give affected people a clear explanation of the role of a high-risk system in a decision that significantly affects them | Art. 86 | Deployer | |
| EUAIA-29 | Tell people they are interacting with an AI system unless it is obvious | Art. 50(1) | Provider | |
| EUAIA-30 | Mark synthetic audio, image, video and text outputs in a machine-readable, detectable way (legacy systems on the market before 2 Aug 2026 have until 2 Dec 2026) | Art. 50(2); Art. 111(4) | Provider | |
| EUAIA-31 | Inform people exposed to emotion recognition or biometric categorisation; disclose deepfakes and AI-generated text published on matters of public interest | Art. 50(3), 50(4) | Deployer | |
| EUAIA-32 | GPAI model providers: keep technical documentation, give downstream providers the information they need, adopt an EU copyright policy, publish a training-content summary | Art. 53(1) | Provider | |
| EUAIA-33 | Non-EU GPAI model providers: appoint an EU authorised representative | Art. 54 | Provider | |
| EUAIA-34 | GPAI models with systemic risk: evaluate and adversarially test the model, assess and mitigate systemic risks, report serious incidents to the AI Office, ensure cybersecurity | Art. 55 | Provider | |
| EUAIA-35 | Track which EU AI Act dates and roles apply to each product and update as the Commission issues guidelines, codes and standards | Art. 113; Art. 96 | Both |
Controls that do the most work here
- SC-AI-032 Logging and record keeping4 obligations
- SC-AI-002 AI roles, accountability and oversight committee3 obligations
- SC-AI-004 AI risk classification and use-case tiering3 obligations
- SC-AI-007 Third-party and vendor AI due diligence3 obligations
- SC-AI-014 Model documentation (model cards, system cards)3 obligations
- SC-AI-018 Robustness and adversarial testing (red teaming)3 obligations
Evidence an auditor will ask for
- AI system inventory with role (provider, deployer, importer) and risk tier for every system, plus the Art. 5 screening record.
- Art. 6(3) derogation assessments for any Annex III system you call "not high-risk", and EU database registration receipts.
- AI literacy programme: training materials, attendance logs, role mapping (Art. 4).
- For high-risk systems: risk management file, data governance records, Annex IV technical documentation, instructions for use, log design, accuracy and robustness test reports.
- QMS manual and procedures (Art. 17), change control records.
- Conformity assessment report or notified body certificate, EU declaration of conformity, CE marking evidence.
- Authorised representative mandate (non-EU providers).
- Post-market monitoring plan and reports; serious incident register and Art. 73 notifications.
- Deployer side: oversight assignments, log retention (six months minimum), worker notices, FRIA (where Art. 27 applies).
- Art. 50 evidence: chatbot disclosure screens, watermark or metadata implementation, deepfake labels.
- GPAI: model documentation, downstream information pack, copyright policy, public training-content summary.
- Contracts with EU clients showing provider or deployer allocation and Art. 25 cooperation.
Common mistakes
- Thinking "we have no EU office, so it does not apply". Art. 2(1)(a) and (c) reach non-EU providers and any system whose output is used in the EU.
- Assuming the Omnibus cancelled high-risk rules. It postponed them to fixed dates (2 Dec 2027 and 2 Aug 2028); they no longer depend on standards being ready.
- Assuming AI literacy was deleted. It was softened, not removed.
- Assuming Art. 50 was delayed. Transparency duties applied from 2 Aug 2026; only legacy generative systems got a marking grace period to 2 Dec 2026.
- Using the Art. 6(3) derogation without writing down the assessment.
- Treating a white-labelled model as "the vendor's problem"; rebranding makes you the provider (Art. 25).
- Forgetting the EU authorised representative for high-risk systems and GPAI models.
- Quoting the 2024 timeline (2 Aug 2026 for Annex III) in customer contracts and proposals.
Glossary
- Provider: whoever develops an AI system or GPAI model (or has it developed) and puts it on the market under its own name.
- Deployer: an organisation using an AI system under its authority in a professional setting.
- Authorised representative: an EU-based person or firm mandated in writing to act for a non-EU provider.
- High-risk AI system: AI that is a safety component of a regulated product (Annex I) or used in a listed sensitive area (Annex III), such as hiring, credit or education.
- Annex III: the list of high-risk use areas (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice).
- GPAI model: a general-purpose AI model, such as a large language model, that can be used for many tasks.
- Systemic risk: the extra risk tier for the most capable GPAI models.
- Conformity assessment: the check that a high-risk system meets the rules before sale; done internally or by a notified body.
- CE marking: the mark showing a product meets EU requirements.
- FRIA: fundamental rights impact assessment under Art. 27.
- SMC (small mid-cap enterprise): a company that has outgrown the SME definition; the Omnibus extended some SME relief to them, using the definition in Commission Recommendation (EU) 2025/1099.
- AI Omnibus: Regulation (EU) 2026/1744, the July 2026 amending law that simplified and delayed parts of the AI Act.
- Harmonised standard: an EU-endorsed technical standard; following it gives a presumption of conformity.
Key takeaways
- Binding, directly applicable and extraterritorial: Indian providers and any AI whose output is used in the EU are in scope.
- The AI Omnibus (Reg. 2026/1744) is in force since 27 Jul 2026. High-risk rules now start 2 Dec 2027 (Annex III) and 2 Aug 2028 (Annex I), on fixed dates with no standards trigger.
- Prohibitions, AI literacy, GPAI duties and Art. 50 transparency already apply; two new bans arrive on 2 Dec 2026.
- Fines go up to EUR 35m or 7% of global turnover; SMEs pay the lower of the two figures.
- 35 obligations mapped here; the heaviest load is on high-risk providers (Arts. 9 to 22, 43, 47 to 49, 72, 73).
Official sources
- Regulation (EU) 2024/1689, Official Journal (EUR-Lex), accessed 2026-10-19
- Regulation (EU) 2026/1744, Digital Omnibus on AI, Official Journal (EUR-Lex), accessed 2026-10-19
- European Commission news: AI Omnibus enters into force, accessed 2026-10-19
- European Commission: AI Act policy page and timeline, accessed 2026-10-19
- AI Act Service Desk: implementation timeline, accessed 2026-10-19
- AI Act Service Desk: Digital Omnibus FAQ (describes the proposal), accessed 2026-10-19
- Secondary, for context only: Gibson Dunn client alert on the Omnibus agreement, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.