The EU AI Act Explained: What Applies Now, What Changes on December 2, 2026, and What It Costs to Get It Wrong

The EU AI Act is Regulation (EU) 2024/1689, the European Union law that sets rules for artificial intelligence. It was published in the Official Journal on July 12, 2024, and entered into force on August 1, 2024. It sorts AI systems by risk, bans a small list of uses, and sets duties for everyone else who builds or uses AI in the EU. Most of it already applies. The next date that matters is December 2, 2026, a Wednesday.

When people search for "eu ai act 2026", they usually want one of two things: what the Act says this year, and what changes next. Both answers are below. The short version: 2026 is the year most of the Act started to apply, the year the Digital Omnibus moved the high-risk dates, and the year the December 2 deadline lands.

What is the EU AI Act?

The EU AI Act is a risk-based law. The higher the risk an AI system poses to health, safety and fundamental rights, the stricter the rules. Most AI carries little risk and is barely touched. A small set of uses is banned. High-risk systems face strict duties before they can be sold or used. Systems that talk to people or generate content face transparency duties.

The Act applies to providers and deployers in the EU, and to providers outside the EU where the output of their system is used in the EU. A provider builds or sells the system. A deployer uses it. The same company can be both. Importers and distributors carry duties of their own.

In July 2026 the Act was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744. The European Parliament adopted it on June 16, 2026, the Council approved it on June 29, 2026, it was signed on July 8, 2026, published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026. The Omnibus moved the high-risk dates back and added the December 2 items. It did not delay the bans, the GPAI rules, or Article 50. Those dates stayed as they were.

What applies right now, in November 2026

The Act applies in stages, set by Article 113. Four stages are already behind us. The table below gives each date and what started on it.

Date	What started
August 1, 2024	The Act entered into force.
February 2, 2025	Eight banned practices applied. The AI literacy duty in Article 4 started.
August 2, 2025	GPAI rules in Chapter V applied. Governance bodies started work. The penalty framework became applicable.
August 2, 2026	Most of the Act applied, including Article 50 transparency. Enforcement powers became active.
December 2, 2026	Marking grace ends for older generative systems. Two new bans start.
December 2, 2027	Annex III high-risk duties apply, moved here by the Omnibus.
August 2, 2028	Annex I high-risk duties apply, moved here by the Omnibus.

The four risk tiers

Everything in the Act flows from four tiers. Finding the tier for each system is the first step, because the tier decides every duty that follows.

Tier	What it means	Since when
Prohibited	Banned outright under Article 5. Ten uses, listed below.	February 2, 2025, with two more from December 2, 2026
High-risk	Allowed, with strict duties: risk management, data governance, records, human oversight under Article 14, and registration in the EU database.	December 2, 2027 for Annex III, August 2, 2028 for Annex I
Limited risk	Transparency duties under Article 50 only.	August 2, 2026
Minimal risk	No mandatory duties. Voluntary codes of conduct only.	Always

High-risk systems come through two routes. Annex I covers AI used as a safety part of a product already covered by EU product safety law, such as medical devices, machinery and vehicles. Annex III covers AI used in eight sensitive areas: biometrics, critical infrastructure, education, employment, essential public and private services, law enforcement, migration and border control, and the administration of justice.

General-purpose AI models sit outside the four tiers, with their own set of rules under Chapter V. The large foundation models behind tools such as ChatGPT and Gemini fall here. Their providers owe technical documentation, information for downstream providers, a copyright policy, and a public summary of training content. A model counts as carrying systemic risk when the compute used to train it passes 10 to the power of 25 floating point operations, which brings extra duties around model evaluation, adversarial testing, and incident reporting to the EU AI Office. Chapter V has applied since August 2, 2025. Models placed on the market before that date have until August 2, 2027 to comply.

Article 50: the transparency rules

Article 50 is the part of the Act most people will meet first. It has applied since August 2, 2026. It sets four duties, and each one falls on a different party.

First, Article 50(1): providers must make sure people know they are interacting with an AI system. A chatbot or voice agent must say so, unless it is obvious from the context. Second, Article 50(2): providers of generative AI must mark their output in a machine-readable format, so it can be detected as AI-generated. Third, Article 50(3): deployers of emotion-recognition or biometric-categorisation systems must tell the people subject to them. Fourth, Article 50(4): deployers who publish AI-generated text on matters of public interest must disclose that it was generated by AI. This is the deepfake rule.

The Act does not name one marking method. C2PA Content Credentials, which attach signed provenance data to a file, are the leading way to meet the marking duty. The Commission published transparency guidelines on July 20, 2026, and a voluntary Code of Practice on transparency was published on June 10, 2026. The guidelines explain the duties. They are guidance, and they are not law by themselves.

Article 50 is the rule that reaches the most companies. Anyone who ships an image, video, audio or text generator into the EU, or runs a chatbot for EU users, has a duty under it. That is why the December 2 deadline matters, and why it is covered in detail in the next section.

December 2, 2026: the next deadline

December 2, 2026 brings two changes, and both are already law. The date is fixed, and it is 27 days from November 5.

The first change is the end of the marking grace period. Article 50(2) marking applied from August 2, 2026, but the Omnibus added a transition in a new Article 111(4): generative systems already on the market before August 2, 2026 had until December 2, 2026 to add machine-readable marking. Systems placed on the market after August 2, 2026 had no grace period. After December 2, every generative system on the EU market must mark its output.

The second change is two new bans, added to Article 5 by the Omnibus as points (ba) and (bb). From December 2, 2026, it is prohibited to place on the market, put into service, or use an AI system that generates or manipulates non-consensual intimate imagery of an identifiable person, or that generates or manipulates child sexual abuse material. The ban covers realistic images, videos, audio and similar material, and it covers face-swap and nudification tools that alter an existing image. Safeguards matter only where the banned output is a reasonably foreseeable outcome, and not where it is the intended purpose of the system.

The original eight bans have applied since February 2, 2025: harmful manipulation, exploiting vulnerabilities of age, disability or socio-economic situation, social scoring, predicting criminal offences from profiling alone, untargeted scraping of facial images, emotion recognition in workplaces and schools outside medical and safety use, biometric categorisation that infers protected characteristics, and real-time remote biometric identification in public spaces for law enforcement outside narrow exceptions. Enforcement of the bans has only been possible since August 2, 2026, when the enforcement provisions took effect.

Worked example: five systems, sorted

The rules above are easier to use on real cases. Here are five ordinary systems, each put in its tier with its first duty and its date.

System	Tier	First duty	Date
Shop chatbot that answers customers	Limited risk	Tell users they are talking to AI, Article 50(1)	Since August 2, 2026
CV-screening tool for hiring	High-risk, Annex III employment	Conformity assessment, records, human oversight, EU database registration	December 2, 2027
Spam filter in an email app	Minimal risk	No mandatory duties	None
City social-scoring system	Prohibited	Banned. It cannot be placed on the market or used in the EU.	Since February 2, 2025
Image generator sold in the EU with no marking	Limited risk, Article 50(2)	Add machine-readable marking to all output	December 2, 2026, if on the market before August 2, 2026. Already due if placed after.

The pattern to take from the table: the chatbot and the image generator need a small, concrete change now, while the CV-screening tool needs a longer programme of work that runs to December 2027. The spam filter needs nothing. The social-scoring system needs to stop.

Fines, worked out in euros

Article 99 sets three tiers of fines. Each fine is the higher of a fixed sum and a percentage of worldwide annual turnover. These are ceilings, and not fixed tariffs. Member states write their own penalty rules inside the ceilings.

Breach	Ceiling
Banned practices, Article 5	EUR 35 million or 7% of worldwide annual turnover, whichever is higher
Most other operator duties, including Article 50	EUR 15 million or 3% of worldwide annual turnover, whichever is higher
Giving incorrect, incomplete or misleading information to authorities	EUR 7.5 million or 1% of worldwide annual turnover, whichever is higher

The sums change with the size of the company. Take a company with EUR 100 million in worldwide turnover. Seven percent is EUR 7 million, so the fixed EUR 35 million sets the ceiling for a banned use. Three percent is EUR 3 million, so the fixed EUR 15 million sets the ceiling for an Article 50 breach. One percent is EUR 1 million, so the fixed EUR 7.5 million sets the ceiling for wrong information to a regulator.

Take a company with EUR 1 billion in worldwide turnover. Seven percent is EUR 70 million, so the percentage sets the ceiling for a banned use. Three percent is EUR 30 million, so the percentage sets the ceiling for an Article 50 breach. One percent is EUR 10 million, so the percentage sets the ceiling for wrong information. The crossover sits at EUR 500 million of turnover for the first two tiers, and EUR 750 million for the third.

Small and medium-sized enterprises pay the lower of the two figures. A startup with EUR 2 million in turnover faces a ceiling of EUR 140,000 for a banned use, EUR 60,000 for an Article 50 breach, and EUR 20,000 for wrong information. Since the Omnibus, small mid-caps get the same lower-of-the-two treatment in the second and third tiers. GPAI providers face a separate regime run by the Commission, with fines up to EUR 15 million or 3%, plus periodic penalties of up to 5% of average daily turnover per day.

Who must act, and what to do first

Three groups carry the work. Providers build or sell AI systems. Deployers use them. GPAI providers supply the foundation models. If you sell or use AI in the EU, you are in one of these groups, and the steps below are the order to take them in.

First, list every AI system you place on the market or use in the EU, including tools bought from others. Second, put each one in a tier, using the table above. Third, check the Article 50 duties for anything that talks to people or generates content. Fourth, check the marking on every generative system before December 2, 2026. Fifth, check that nothing on your list matches the ten banned uses. Sixth, for high-risk systems, start the conformity work now. December 2, 2027 is thirteen months away, and the work behind it is long.

Two related terms come up in the same searches. AI regulation is the field itself: the rules governments set for AI. The EU AI Act is the main example, and US states and other countries have their own rules, covered in our November AI regulation update. AI compliance is the work of meeting the duties the Act sets for your tier: classify, document, disclose, mark, and keep a human in charge of high-risk systems. AI law is the wider body of law that covers AI, which in the EU means the AI Act plus data protection, product safety, copyright, and national penalty rules.

What is still uncertain

Enforcement practice is young. National regulators are still staffing up and writing the penalty rules that set actual fines inside the ceilings. No court has yet tested which marking methods satisfy Article 50(2), and the Commission guidelines on the subject are guidance, not law. The Omnibus also changed the AI literacy duty in Article 4, and the final wording is still settling.

The high-risk dates moved once, in July 2026. Treat December 2, 2027 and August 2, 2028 as the law today, and check them again before you plan around them. For the wider picture, including the US states, the November 2026 votes, and the rules in fifteen countries, see our November AI regulation update, AI Regulation News November 2026: The December 2 Countdown, US Midterms, and 15 Countries Update.

Questions people ask

Sources: Regulation (EU) 2024/1689, Official Journal July 12, 2024, in force August 1, 2024; Regulation (EU) 2026/1744, the Digital Omnibus on AI, Official Journal July 24, 2026, in force July 27, 2026; European Commission, AI Act transparency guidelines, July 20, 2026; DLA Piper, AI Laws of the World, prohibited practices; Orrick AI Law Center, EU AI Act prohibited AI; Complipath, EU AI Act prohibited practices guide, checked against 2024/1689 and 2026/1744, reviewed October 31, 2026. All sources checked November 5, 2026.