Turns Out · · 8 min read
EU AI Act timeline 2025–2027: every deadline that touches a business website
Every EU AI Act deadline in one list: Feb 2025 duties, the 2 Aug 2026 transparency rules, and what is deferred to 2027 — written for website owners.
If you search for an EU AI Act timeline, some pages still tell you that the 2 August 2026 deadline is about high-risk AI. That part stopped being true in July. The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026. It entered into force three days later and rewrote several dates in the Act.
If you run a chatbot, publish AI-generated images or screen job applicants with an AI tool, the practical question is which of those features is regulated now and which can wait. Each one now sits under a different date. So we rebuilt the EU AI Act timeline from the primary sources, as of late October 2026, and mapped each date to the website feature it touches.
We started from the European Commission’s AI Act Service Desk timeline, which already reflects the Omnibus, and checked each date against the amending regulation on EUR-Lex and the article texts. For the detail of the transparency rules we relied on law-firm summaries of the Commission’s final Article 50 guidelines, published on 20 July 2026. Then we asked, for each date, which website feature it touches.
The EU AI Act timeline, date by date
Two terms from Article 3 decide who carries each duty. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority, as most websites do.
- 2 February 2025, applies — Article 5 bans on prohibited AI practices and the AI-literacy duty in Article 4. Touches any business using AI in the EU.
- 2 August 2025, applies — rules for general-purpose AI models; Member States set up authorities and penalty laws. Touches model providers; if your site calls their API, ask them in writing for their AI Act documentation.
- 27 July 2026, in force — the Digital Omnibus amends the Act: new high-risk dates, a softer Article 4, new prohibitions. Touches everyone.
- 2 August 2026, applies — Article 50 transparency and most remaining rules. Touches chatbots, AI-generated media and public-interest text.
- 2 December 2026, upcoming — new prohibitions on AI that creates non-consensual intimate imagery or child sexual abuse material. The Article 50(2) marking grace also ends for certain providers of generative systems already on the market. Touches providers of generative systems.
- 2 August 2027, upcoming — general-purpose models placed on the market before 2 August 2025 must comply. Touches model providers.
- 2 December 2027, deferred from 2 August 2026 — high-risk rules for Annex III systems. Touches AI in recruitment, credit checks, education admissions and access to essential services.
- 2 August 2028, deferred from 2 August 2027 — high-risk rules for AI inside products regulated by EU safety law (Annex I). Touches product manufacturers, rarely a website.
Which EU AI Act rules already apply to your website
Prohibited practices. Article 5 bans eight practices today, according to the Bundesnetzagentur summary, and new prohibitions follow on 2 December 2026. Two can touch a website. One is AI that manipulates or deceives people into harmful decisions. The other is AI that exploits vulnerabilities linked to age, disability or economic situation. On a website, the realistic risk is personalization that targets people in financial difficulty in ways that harm them.
AI literacy. The Omnibus, Regulation (EU) 2026/1744, rewrote Article 4. Providers and deployers must now take measures to support AI literacy among the staff who operate AI for them. The text no longer asks them to guarantee any particular level. We still recommend a short policy, a dated training record and a named owner as evidence; our AI use policy template covers the first.
Transparency. Article 50 is the part that affects the most websites. The EU AI Act transparency obligations have four parts:
- 50(1) chatbots and AI agents — providers must design these systems so people are told they are talking to an AI, unless that is obvious from context.
- 50(2) machine-readable marking — providers of systems that generate audio, images, video or text must mark the output as AI-generated.
- 50(3) emotion recognition and biometric categorization — deployers must inform the people exposed.
- 50(4) deepfakes and public-interest text — deployers must disclose deepfakes. They must also disclose AI text published to inform the public on matters of public interest, unless a person reviewed or edited it and someone holds editorial responsibility for it.
Fines. Under Article 99, breaching Article 50 can cost up to €15 million or 3% of worldwide annual turnover, whichever is higher. For SMEs and small mid-caps, the cap is whichever of the two is lower.
What this means if you run a website with a chatbot
Your chatbot must say it is an AI at the first interaction, where a visitor will see it. The final guidelines, as summarized by Stephenson Harwood, accept a plain-language notice at the start of a session, a persistent label next to the input field, or a spoken statement in a voice interface.
Three checks we would run this week:
- Open the widget as a new visitor — does the first message say it is an AI?
- Ask your vendor in writing how images or audio produced by the bot are marked.
- Check what the bot can do — if it books, buys or acts for someone, Stephenson Harwood’s summary says it should state on whose behalf it acts.
Take a typical site: a support bot built on a model API under your own brand, AI-generated product photos, and a CV-screening plugin on the careers page. The branded bot usually makes you its provider under Article 3, so the 50(1) disclosure is yours now; with a vendor’s own branded widget, the vendor is the provider. The photo tool’s provider handles 50(2) marking, and you label the photos only if they are deepfakes. The CV screener is Annex III and waits for 2 December 2027. Our EU AI Act Article 50 guide covers roles, wording and edge cases.
How the Digital Omnibus changed the dates
Besides the softer Article 4 and the 50(2) grace, the Omnibus made four changes a website owner should know about:
- Annex III high-risk rules move to 2 December 2027. Annex III includes AI in recruitment, creditworthiness checks, education admissions and access to essential services. A CV-screening tool on your careers page or an AI credit pre-check at checkout belongs here.
- Annex I high-risk rules move to 2 August 2028 for AI inside regulated products.
- New prohibitions start on 2 December 2026 for AI that generates non-consensual intimate imagery or child sexual abuse material.
- A new small mid-cap category. Per Orrick’s summary, companies that are not SMEs, with fewer than 750 staff and turnover up to €150 million or a balance sheet up to €129 million, get SME-style relief, including lower fine caps for most breaches.
A named owner, an inventory of AI tools and a risk register are the cheapest preparation for what comes next, and none of them needs a consultant.
EU AI Act compliance work that can wait
- A high-risk conformity assessment for a marketing chatbot or writing assistant. Neither is an Annex III system.
- An “AI Act compliant” badge. The Act has no certificate for chatbots or AI content. For a deployer, visible disclosure is what counts; machine-readable marking is the provider’s job.
- Relabeling old AI images and video. Per Reed Smith’s reading of the final guidelines, media generated before 2 August 2026 needs no deepfake label.
One honest caveat: a timeline tells you when rules apply, not how hard they will be enforced. Enforcement is uneven, and the Future of Privacy Forum notes that many Member States were late designating their market surveillance authorities. Plan calmly, but plan.
EU AI Act questions website owners ask
Does the EU AI Act apply to non-EU companies?
Yes. It covers providers placing AI systems on the EU market wherever they are based, and deployers in the EU. It also covers non-EU providers or deployers whose AI output is used in the Union, so a US or UK chatbot serving EU visitors is in scope.
What are the fines under the EU AI Act?
Under Article 99: up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other obligations, including Article 50. Supplying incorrect information to authorities can cost up to €7.5 million or 1%. Other companies face whichever is higher. For SMEs the cap is the lower figure in every tier; for small mid-caps, in the €15 million and €7.5 million tiers only.
Is the high-risk deadline really deferred to 2027?
Yes. Regulation (EU) 2026/1744 is in force and moves Annex III high-risk obligations to 2 December 2027 and Annex I obligations to 2 August 2028. The prohibitions, the AI-literacy duty and Article 50 were not deferred, apart from the short 50(2) marking grace for certain systems already on the market.
Do I have to label AI-written blog posts?
Only text published to inform the public on matters of public interest, and only if no one with editorial responsibility reviewed it. A product blog your team edits is usually outside that duty. As a deployer, you owe a visible label on AI images only if they are deepfakes: realistic content that could pass as real people, places or events.
If you are not sure which of these dates apply to your stack, our free AI readiness assessment is a good place to start; it will say “not yet” where that is the honest answer.
We are engineers, not attorneys. Confirm what applies to you with your lawyer.