Regulation (EU) 2024/1689 applies in stages set by Art. 113. Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved dates, not obligations. The GPAI duties in Art. 53 to 55, the Art. 50 transparency duties, the original Art. 5 prohibitions and the Art. 4 literacy duty apply now. The Annex III and Annex I high-risk obligations, the national sandboxes, the new Art. 5 prohibitions and the Art. 50(2) marking duty for legacy systems carry later dates. Each later-dated item keeps the content adopted in the original text.
Application timeline
The table lists every entry in the regulation data, sorted by application date. The Date column shows the application date with its status. The Omnibus change column quotes what Regulation (EU) 2026/1744 changed on that item, or states none. The Verified on column links to the source that was read for the entry.
Application dates and Omnibus changes, all entries
Item
Applies to
Date
Omnibus change
Verified on
AI Act, Regulation (EU) 2024/1689, entry into force
AI literacy, Art. 4, as a duty to take supporting measures (amended wording from the Omnibus entry into force)
providers, deployers
In force
Amended Art. 4(1) from 'take measures to ensure, to their best extent, a sufficient level of AI literacy' to 'take measures to support the development of AI literacy', and added that the obligation 'does not require providers or deployers to guarantee any specific level of AI literacy of any individual'. New Art. 4(2) and 4(3) task the Commission with practical examples and the Board with recommendations.
The Omnibus moved application dates and amended provisions; it did not remove obligations. New Art. 113(d) states that Articles 102 to 110 apply from the entry-into-force date.
Machinery Regulation (EU) 2023/1230 moved from Annex I Section A to Section B
providers
In force
Deleted Annex I Section A point 1 (Directive 2006/42/EC on machinery) and added Regulation (EU) 2023/1230 as Annex I Section B point 21. The Omnibus also amends Regulation (EU) 2023/1230 itself, with delegated acts on AI-specific requirements due by the Annex I application date.
Article 4a (formerly Article 10(5)) legal basis for processing special-category data for bias detection and correction, necessity threshold
providers, deployers
Working reading
Deleted Art. 10(5) and inserted Art. 4a. Art. 4a(1): 'To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g)... providers of such systems may exceptionally process special categories of personal data', subject to conditions (a) to (f) including that 'bias detection and correction cannot be effectively fulfilled by processing other data, including synthetic or anonymised data'. Art. 4a(2) extends the basis to providers and deployers of other AI systems and models and deployers of high-risk systems where 'strictly necessary'.
Article 6(3) not-high-risk self-assessment, EU database registration retained with streamlined data set
providers
Working reading
Kept Art. 6(4) documentation duty and Art. 49(2) registration. Deleted Annex VIII Section B point 7 (summary of the grounds for the not-high-risk conclusion) and point 9 (Member States where the system is placed on the market). Points 1 to 6 and 8 remain, including 'the condition or conditions under Article 6(3) based on which the AI system is considered to be not-high-risk'.
Commission enforcement powers for GPAI (fines, requests for information)
gpai-providers
In force
none to the date. The Omnibus gave the AI Office exclusive competence over general-purpose AI systems under Art. 75 and added supervisory powers in Art. 75a to 75d.
none to the date. A new Art. 111(4) grants systems that generate synthetic content and were already on the market a grace period for the Art. 50(2) marking duty (entry article-50-2-legacy-marking).
Article 50(2) machine-readable marking for systems placed on the market before the Article 50 date
providers
Deferred
New Art. 111(4): 'Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.'
New Article 5 prohibitions (non-consensual intimate imagery, CSAM) with technical safeguards
providers, deployers
Deferred
Inserted Art. 5(1) points (ba) and (bb) and Art. 5(1a) and (1b). Amended Art. 113(a): 'Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026'.
National AI regulatory sandboxes, at least one per member state
all
Deferred
Amended Art. 57(1): the sandbox 'shall be operational by 2 August 2027' (previously 2 August 2026). The AI Office may also establish a Union-level sandbox.
Amended Art. 113(c): 'Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III'. Previously these obligations applied from the general application date. Obligations are unchanged in content.
Amended Art. 27(4) and (5): deployers may cross-reference or include parts of a GDPR data protection impact assessment, and the AI Office template must allow this. Art. 27 sits in Chapter III Section 3, which amended Art. 113(c) applies from the Annex III date.
Amended Art. 113(c)(ii): '2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I'. Previously Art. 6(1) obligations applied from 2 August 2027.
Regulation (EU) 2026/1744 was published in the Official Journal In force and entered into force on the third day after publication In force. The Omnibus moved application dates and amended provisions; it did not remove obligations. New Art. 113(d) states that Articles 102 to 110 apply from the entry-into-force date. Each item below quotes the amended text recorded for its entry.
Annex III standalone high-risk obligations
Deferred Amended Art. 113(c): "Chapter III, Sections 1, 2, and 3,
with the exception of Article 6(5), shall apply from" the date shown "as regards AI systems
classified as high-risk pursuant to Article 6(2) and Annex III". Previously these obligations
applied from the general application date. Obligations are unchanged in content. Art. 111(2) applies
them to high-risk systems already on the market only where those systems undergo significant changes
in design after that date.
Annex I product-embedded high-risk obligations
Deferred Amended Art. 113(c)(ii) applies Chapter III Sections 1, 2
and 3 from the date shown "as regards AI systems classified as high-risk pursuant to Article 6(1)
and Annex I". Previously the Art. 6(1) obligations applied twelve months earlier.
National AI regulatory sandboxes
Deferred Amended Art. 57(1): each Member State's sandbox "shall be
operational by" the date shown, twelve months later than before. The AI Office may also establish a
Union-level sandbox.
Article 50(2) marking for systems already on the market
Deferred New Art. 111(4): "Providers of AI systems,
including general-purpose AI systems, generating synthetic audio, image, video or text content, that
have been placed on the market before" the Article 50 application date "shall take the necessary
steps in order to comply with Article 50(2) by" the end of a four-month grace period. The Art. 50
date itself did not move.
New Article 5 prohibitions
Deferred Inserted Art. 5(1) points (ba) and (bb) and Art.
5(1a) and (1b): AI systems intended to generate non-consensual intimate imagery or child sexual
abuse material are prohibited. Systems that can generate such content must carry technical safety
measures to prevent it. Amended Art. 113(a) applies these inserted points from the date shown; the
rest of Chapters I and II stays on the original date.
AI literacy wording, Article 4
In force Amended Art. 4(1) from "take measures to ensure, to
their best extent, a sufficient level of AI literacy" to "take measures to support the development
of AI literacy". The amended text adds that the duty does not extend to any specific level of AI
literacy of any individual. New Art. 4(2) and 4(3) task the Commission with practical examples and
the Board with recommendations. The amended wording took effect on the Omnibus entry-into-force
date; the date of the duty itself did not move.
Machinery Regulation moved to Annex I Section B
In force "Deleted Annex I Section A point 1 (Directive
2006/42/EC on machinery) and added Regulation (EU) 2023/1230 as Annex I Section B point 21." AI
safety components in such machinery follow the sectoral conformity route of Section B rather than
the New Legislative Framework route of Section A. Delegated acts on AI-specific requirements are due
by the Annex I application date.
What it did not move
Article 50 transparency
In forceArt. 50 applies from the
general application date to every AI system that performs a listed function: interaction with
persons, synthetic content generation, emotion recognition, biometric categorisation, and deep
fakes. The trigger is the function of the system. Classification under Annex III is not a condition.
The Omnibus left the date unchanged; the only addition is the Art. 111(4) grace period for systems
already on the market.
General-purpose AI models
In force Art. 53 to 55 apply from the date shown. Commission
enforcement under Art. 101 applies from the general application date
In force. The Omnibus gave the AI Office exclusive
competence over general-purpose AI systems under Art. 75 and added supervisory powers in Art. 75a to
75d. Neither date moved. Models placed on the market before the GPAI date have the transitional
period in Art. 111(3).
Prohibitions adopted in the original text
In force Amended Art. 113(a) keeps Chapters I and II on their original
application date. Chapter II holds the Art. 5 prohibitions as adopted; only the inserted points (ba)
and (bb) and paragraphs (1a) and (1b) carry the later date shown above.
The AI literacy duty
In force The duty in Art. 4 has applied since the Chapter I application
date. The Omnibus changed the wording of the duty, as quoted above, and nothing about when it
applies.
High-risk obligations in content
The Annex III entry records that the high-risk obligations are unchanged in content; only the application date moved. A test against Art. 10 or Art. 15 addresses the same requirements as before the Omnibus. Pages under /obligations/ state each requirement with its regulation entry.
Unsettled points
Four points on this page have two readings. Each block shows both readings, the working reading marked, its rationale in one sentence and the sources read for each reading. Every page that states an obligation touched by a point shows the same block.
The reading fixes the date by which a deployer's fundamental rights impact assessment under Art. 27 must exist. The Omnibus amended Art. 27(4) and (5): a deployer may cross-reference or include parts of a GDPR data protection impact assessment. That amendment sets the structure of the FRIA evidence file under either reading.
The threshold fixes what a bias detection legal-basis record under Art. 4a must show before special-category data enters a test set for Art. 10(2). Under the working reading the record must show that synthetic or anonymised data could not serve the purpose.
The reading fixes when the documented Art. 6(3) assessment and the streamlined Annex VIII Section B data set must exist. It concerns an Annex III system that a provider treats as not high-risk. The evidence file for such a system holds the documented assessment under either reading; under the working reading the registration record exists before the system is placed on the market.
The reading fixes which marking techniques count as adequate under Art. 50(2). The documents relevant to that question are listed below with their stage.
Documents relevant to Article 50
Standard and stage
Title
Articles
Cited in OJEU
Verified on
European Commission
Code of Practice on Transparency of AI-Generated ContentPublished
Code of Practice on Transparency of AI-Generated Content (marking and labelling under Art. 50(2) and 50(4))
The regulation verifier reads every entry against a primary source or a top-tier secondary source. It writes the source and the verified-on date into the data. Every date on this site renders from that data; no page types one.
Changes appear on /regulation/changelog/ with the source and the pages updated. A change to the regulation data passes through a script that requires a source URL and appends a changelog entry.
Standards and guidelines are on /standards/ with their stage and whether they are cited in the Official Journal. A harmonised standard cited in the Official Journal would give a presumption of conformity; none is cited as of the anchor date, so tests run against draft standards, ISO/IEC references and Commission guidance.
The obligation tracker reads the same data in the browser and lists the entries that apply to a role.
AIAssuranceLabs tests against the requirements these entries trigger and prepares the evidence; the limits of that work are set out at /what-we-cannot-do/.
At the anchor run, EUR-Lex returned no text to automated fetch. Article wording was read from the consolidated post-Omnibus rendering of the AI Act Explorer, with struck and inserted text distinguished. Each reading was cross-checked against the Commission timeline and law-firm briefings dated after the Omnibus entry into force. The primary-text link in the disclaimer stays on EUR-Lex. A spot-check of Art. 113, 111(4), 4a and 57(1) against the Official Journal text is recorded as an open item.