Rules
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
On 13 October 2026, the prohibited practices, AI literacy rules, rules for general-purpose models and transparency rules apply. The requirements for high-risk systems have been postponed: from 2 August 2026 to 2 December 2027 for the applications in Annex III, and to 2 August 2028 for AI in regulated products.
That postponement is no longer a proposal: the European Parliament and the Council adopted it in June 2026. We checked everything against sources from the European Commission, Parliament and Council on 13 October 2026. This subject changes quickly: check the Commission's AI Act Service Desk timeline before basing your planning on it.
The EU AI Act is Regulation (EU) 2024/1689. It entered into force on 1 August 2024 and becomes applicable in stages. The Commission gives the current dates on its overview of the regulatory framework for AI (updated on 3 August 2026).
| Date | What becomes applicable | For whom | Status |
|---|---|---|---|
| 2 February 2025 | Definitions, prohibited practices (Article 5) and AI literacy (Article 4) | Providers and deployers | Applies; Article 4 amended from 27 July 2026 |
| 2 August 2025 | Rules for general-purpose models; governance and supervision established; Member States designate supervisory authorities | Model providers; Member States | Applies |
| 2 August 2026 | Transparency rules (Article 50); start of enforcement of the rules already applicable | Providers and deployers | Applies |
| 2 August 2026 | Requirements for high-risk systems in Annex III (original date) | Providers and deployers of high-risk systems | Postponed to 2 December 2027 |
| 2 December 2026 | New prohibition on AI producing sexual images of people without consent or child abuse material | Everyone | Adopted, not yet applicable |
| 2 December 2026 | Machine-readable marking of AI content (Article 50(2)) for generative systems already on the market before 2 August 2026 | Providers of generative AI | Adopted, transitional period running |
| 2 August 2027 | At least one AI regulatory sandbox per Member State | Member States | Adopted, not yet applicable |
| 2 December 2027 | Requirements for high-risk systems in Annex III | Providers and deployers of high-risk systems | Adopted, not yet applicable |
| 2 August 2028 | Requirements for high-risk AI in regulated products (Annex I) | Manufacturers and users of those products | Adopted; previously 2 August 2027 |
| 2 August 2030 | Existing high-risk systems used by public authorities must meet the requirements | Public authorities and their suppliers | Adopted, not yet applicable |
| No date | Dutch AI Act implementing legislation | Dutch supervisory authorities and everyone they supervise | Proposal |
As at 13 October 2026. Here, “adopted” means that it appears in the adopted text, but the date is still in the future.
Article 5 prohibits certain applications regardless of who uses them. The Commission refers to eight prohibitions applicable since February 2025 and a ninth added by the omnibus. These prohibitions rarely come into play for a chatbot that creates texts or searches documents. Anyone wishing to use AI to assess employees' behaviour or emotions should read the article first.
Article 4 required providers and deployers to ensure sufficient AI literacy among their staff. The omnibus replaced that article. The adopted omnibus text now states that providers and deployers take measures to support the development of their staff's AI literacy, taking account of knowledge, experience, education and the context in which the system is used. It expressly states that the obligation does not require you to guarantee a particular level for each employee. The Commission and Member States are tasked with helping organisations do this, including through practical examples.
The obligation therefore still exists. It is framed as an effort rather than a result. We explain what that means for an employer in our article on AI literacy.
Since that date, the rules for providers of general-purpose AI models have applied, such as the models behind ChatGPT, Claude and Mistral Vibe. Those obligations fall on the model makers, rather than on you as a user. European governance was also meant to be in place by that date, and Member States should have designated their supervisory authorities and provided for penalties. The Netherlands has not yet laid down the latter in legislation; more on that below.
According to the Commission's timeline, most of the regulation became applicable on 2 August 2026 and enforcement began, at European and national level, of the rules already applicable: the prohibitions, AI literacy, model rules and transparency. The requirements for high-risk systems did not take effect on that date.
Article 50 divides obligations between two roles.
The information must be clear and given no later than the first interaction. Article 50 itself has not been postponed. Only the marking obligation in paragraph 2 has been given a transitional period for existing systems.
The Commission proposed the omnibus on 19 November 2025 as part of a broader digital package. According to the European Parliamentary Research Service briefing, the Council adopted its position on 13 March 2026 and Parliament on 26 March 2026, an agreement followed on 7 May 2026, and Parliament approved it on 16 June 2026. The Council adopted the regulation on 29 June 2026, as shown by the Council voting result. According to the Commission, the omnibus entered into force on 27 July 2026. The Commission refers to the text in the Official Journal under number 2026/1744.
The same briefing explains why: harmonised standards and tools for the high-risk requirements were not ready in time, and several Member States had not yet designated their supervisory authorities.
The November 2025 package contained a second proposal, on data and the GDPR. That follows a separate procedure. On 13 October 2026, we found no adopted text for that proposal; the latest documents we saw indicate ongoing Council discussions. Treat what you read about it as a proposal, and follow Parliament's and the Council's registers for its status.
The regulation applies directly, but each Member State decides who supervises it and how penalties are imposed. In the Netherlands, this is addressed through the AI Act implementing legislation. It went out for online consultation on 20 April 2026, until 1 June 2026 inclusive. Next come the processing of responses, the Council of State's advice and consideration by the Dutch House of Representatives.
On 13 October 2026, we found no government source showing that the bill had been submitted to the Dutch House of Representatives. Trade media report that submission has been moved to 2027, but we could not verify this in a parliamentary document. Assume, therefore, that the system remains a proposal and that the designation of supervisory authorities may change.
This makes little difference to your obligations. Rules already applicable also apply without implementing legislation, and the GDPR continues to apply alongside the AI Act whenever you work with personal data.
An organisation using an AI system under its own authority is called a deployer in the regulation. This already includes employees using a chatbot for their work. Providers carry the heaviest obligations, but your role brings obligations of its own.
A chatbot that helps summarise, write or search is not automatically a high-risk system. What matters is the purpose for which you use AI. Annex III lists eight areas, including employment and staff management, access to essential services, and the administration of justice.
If you have AI assess application letters or monitor employees' performance, you are in the employment area. The point about the administration of justice concerns AI that helps a judicial authority research and apply facts and law, or is used similarly in alternative dispute resolution. A law firm searching its own client files with AI does not necessarily fall within this. For that firm, professional rules are the strictest yardstick; these are covered in our article on professional secrecy and AI.
If your use does fall within it, Article 26 requires, among other things, that you use the system according to its instructions, assign human oversight to people with the right knowledge and authority, monitor its operation, retain logs for at least six months, and inform workers and their representatives in advance. Whether your application is high risk is a legal assessment. Have it checked if you are unsure.
The postponement gives time for the high-risk requirements. It changes nothing about what applies today.
PrivaSearch makes documents searchable after personal data has been replaced with pseudonyms and a colleague has checked this. It does not make decisions about people: it supplies passages with a source reference, and a human assesses what to do with them. The page on the GDPR and the AI Act explains, for each part, the measures we have taken and what remains your responsibility. It also states that the design supports classification outside the high-risk categories, depending on intended use and working practices. You classify your own use yourself.
Three elements relate to what the AI Act requires. Human review is mandatory. Answers have a source reference, allowing a user to check where a passage came from. And employees take brief AI literacy training, repeated periodically; without current training, the workspace does not open and the connection to an AI assistant also refuses access. That connection works with Claude, ChatGPT Business and Mistral Vibe. The steps appear on the page How PrivaSearch works.
Your environment also creates an AI policy and a DPIA starter document based on your own configuration. These are starter documents, not legal advice: review by a lawyer or your data protection officer, and adoption, remain your responsibility. Pseudonymised data remains personal data for your organisation.
Our page on the risks explains what happens when AI use is left unregulated. To see what this looks like in practice, book a demo.
Partly. The requirements for high-risk systems in Annex III have moved from 2 August 2026 to 2 December 2027, and those for AI in regulated products to 2 August 2028. Prohibited practices, AI literacy rules, rules for general-purpose models and transparency rules have not been postponed and currently apply.
Yes. The European Parliament approved the agreement on 16 June 2026, the Council adopted the regulation on 29 June 2026 and, according to the European Commission, it entered into force on 27 July 2026. A second proposal from the same package, on data and the GDPR, follows its own procedure. We found no adopted text for that proposal on 13 October 2026.
Yes, in amended form. Since 27 July 2026, Article 4 has required providers and deployers to take measures to support their staff's AI literacy, suited to knowledge, experience and the context of use. You do not have to guarantee a particular level per employee. Training suited to their tasks, which you can demonstrate, remains the practical approach.
This is addressed through the AI Act implementing legislation, which was under consultation in April and May 2026. Under the proposal, existing supervisory authorities supervise their own sectors, and the Autoriteit Persoonsgegevens and Rijksinspectie Digitale Infrastructuur take coordinating roles. As far as we could establish, the proposal was not yet law on 13 October 2026. The regulation itself does apply directly.
Usually not. Summarising, writing and searching documents do not appear in Annex III. Things change when you use AI for a listed purpose, such as selecting applicants, assessing employees or assessing creditworthiness. Purpose determines the classification, rather than the tool's name. Have a doubtful case legally assessed.
Not for every text. Article 50 requires it of organisations publishing AI text to inform the public on matters of public interest, unless a human has reviewed the text and someone has editorial responsibility. Deepfakes carry their own obligation to disclose that the material is artificial. Apart from the law, it makes sense to record in your AI policy when you tell clients about AI use.
What a deepfake is, which rules apply now, which prohibition is coming and how organisations tackle fraud using a fabricated voice or video.
What the Dutch Algorithm Register and IAMA are, what is mandatory and what is not, and what a municipality arranges when staff use AI chatbots.
When you must conduct a DPIA for an AI chatbot or AI search feature, what it needs to contain and how to approach the assessment in seven steps.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →