Print / Save PDF

EU AI Act timeline after the Digital Omnibus

Dates below follow the Commission AI Act Service Desk timeline and the published text of Regulation (EU) 2026/1744. The national-sandbox deadline in the published regulation (amended Art. 57(1)) and the Commission timeline is 2 Aug 2027. [1][3]

Related: compliance deadlines calendar and .ics.

What the Digital Omnibus on AI changed

Regulation (EU) 2026/1744 of 8 July 2026 — the Digital Omnibus on AI — was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. [3][6][7]

Legislative path: Commission proposal 19 November 2025 (COM(2025) 836); provisional agreement 7 May 2026; Council final approval 29 June 2026; signed 8 July 2026; OJ 24 July 2026; in force 27 July 2026. [3][4]

• Fixed delayed dates for high-risk rules: 2 December 2027 (Annex III) / 2 August 2028 (Annex I) (Art. 113 point (c)).
• New prohibitions: AI systems that generate or manipulate non-consensual intimate material of an identifiable person, or child sexual abuse material (Art. 5(1)(ba), (bb), (1a), (1b)); apply from 2 December 2026.
• AI literacy (Art. 4) rewritten: providers and deployers “shall take measures to support the development of AI literacy” of staff; the obligation “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”. The Commission publishes practical examples.
• New Art. 4a: legal basis to process special-category personal data where strictly necessary for bias detection and correction, with listed safeguards.
• Article 50(2) transition for generative systems already on the market: 2 December 2026 (new Art. 111(4)).
• Small mid-caps (SMCs) added alongside SMEs: simplified technical documentation form (Art. 11(1)), proportional QMS (Art. 17(2)), lower-of fine caps (new Art. 99(6a)).
• The AI Office gets exclusive supervision of AI systems built on GPAI models by the same provider and of AI in VLOPs/VLOSEs (Art. 75(1)), with new Arts. 75a–75d (investigation, commitments, fines, periodic penalties up to 5% of average daily turnover).
• EU-level sandbox run by the AI Office (Art. 57(3a)); fundamental rights impact assessments can cross-reference a GDPR DPIA (Art. 27(4)); AI Office questionnaire template (Art. 27(5)).
• Cyber Resilience Act link: high-risk AI meeting CRA Art. 12(1) conditions is deemed to meet AI Act Art. 15 cybersecurity (Art. 42(3)).
• New Annex XIV notified-body codes list includes a code for “AI systems based on other emerging AI technologies … including Agentic AI” — the first time “agentic AI” appears in the AI Act text.

Penalties (Art. 99, unchanged caps) [8]: up to EUR 35 million or 7% of worldwide annual turnover for Art. 5 breaches; up to EUR 15 million or 3% for operator obligations including Art. 50 transparency; up to EUR 7.5 million or 1% for incorrect or misleading information; whichever is higher, except SMEs (and now SMCs for paragraphs 4–5) get whichever is lower.

New this month

19 Oct 2026 — first harmonised standard

The Commission announced that the reference to EN 18286:2026 “Artificial intelligence – Quality management system for EU AI Act regulatory purposes” (CEN-CENELEC JTC 21) is published in the Official Journal through Commission Implementing Decision (EU) 2026/2274 (decision dated 12 October 2026; JTC 21 says the OJ citation is dated 14 October 2026). [9][10]

Providers that implement it get a presumption of conformity with the Article 17 QMS requirements it covers. The Commission says it is “the only AI QMS standard with a presumption of conformity” and is designed to be layered on top of ISO/IEC 42001, ISO 9001 or a sectoral QMS such as ISO 13485, not replace them. JTC 21 says the standard was published in July 2026, is the first deliverable under standardisation request M/613, and the amended request runs until 28 February 2027 (risk management, data governance, logging, transparency, human oversight, accuracy, robustness, cybersecurity and conformity assessment standards still in progress). [9][10]

Practical point: ISO/IEC 42001 certification alone does not give an AI Act presumption of conformity. EN 18286 does for the Art. 17 parts it covers, and it maps to ISO/IEC 42001.

21 Oct 2026 — Council mandate on the wider Digital Omnibus (not law yet)

The Council agreed its position on the separate data/privacy/cyber part of “Omnibus VII”. It keeps the GDPR definition of personal data and adds a pseudonymisation provision; supports extending the personal-data-breach notification deadline; an EU-level single list of high-risk processing categories and common templates; keeps cookie rules in the ePrivacy Directive with more consent-exempt purposes (service provision, audience measurement, device security); and replaces the proposed single EU incident-reporting entry point with a national entry point in each Member State plus an EU-level information point. Parliament still has to adopt its position before trilogues. The press release also notes the AI part was adopted on 29 June 2026. [11]

What to do before 2 December 2026

A short planning checklist. General information, not legal advice. Confirm scope with your counsel or auditor.

1. Inventory AI systems that generate synthetic audio/image/video/text placed on the EU market before 2 August 2026 and confirm Art. 50(2) machine-readable marking by 2 December 2026.
2. Check image/video generation features against the new Art. 5(1)(ba)/(bb) bans and Art. 5(1a) safeguards.
3. Re-plan high-risk (Annex III) programmes against 2 December 2027, not 2 August 2026.
4. If you build a QMS for high-risk AI, evaluate EN 18286 on top of ISO/IEC 42001 / ISO 9001.
5. Keep AI literacy measures documented (Art. 4 still applies, now as “take measures to support”).

What the Agent Index dataset shows

Counts below are computed at build from agents.json and auditors.json. Framework tags are vendor-stated, not certification. Alphabetical. Not a ranking. [12]

Cite: Agent Index open dataset v0.1.27 (CC BY 4.0), DOI 10.5281/zenodo.23604511.

AI agents in our index that state EU AI Act support

17 of 410 agents have “EU AI Act” in frameworks_claimed or frameworks.

Agents that state ISO/IEC 42001 support

19 of 410 agents have “ISO 42001” or “ISO/IEC 42001” in frameworks_claimed or frameworks. Vendor-stated, not certification.

ISO/IEC 42001 certification bodies in our directory

33 firms have “ISO 42001” in frameworks. See the directory filter ISO 42001 firms. Headquarters counts (not a ranking):

• United States — 15
• United Kingdom — 5
• Australia — 4
• India — 3
• Netherlands — 3
• Japan — 2
• Canada — 1

European-HQ agents

155 agents have hq_region “europe”. See the Europe region.

Templates, matching and updates

Everything on Agent Index is 100% free through Q1 2027.

• GRC Survival Kit: audit-prep templates and the kit download. Templates are subscriber-gated with double opt-in; any email provider.
• Get matched: find an ISO 42001 certification body or an AI governance agent.
• Newsletter signup: What Changed in GRC & AI Agents, weekly.

Related: compliance deadlines calendar and .ics · State of AI Compliance & Audit.

Get matched

FAQ

Did the EU delay the AI Act?

Only high-risk Chapter III Sections 1–3: to 2 Dec 2027 for Annex III use cases and 2 Aug 2028 for AI in Annex I regulated products. Prohibitions, GPAI, transparency and AI literacy dates are unchanged.

What happens on 2 December 2026?

New Article 5(1)(ba)/(bb) prohibitions apply to AI that generates non-consensual intimate material or child sexual abuse material. Providers of generative AI systems placed on the market before 2 August 2026 must comply with Article 50(2) machine-readable marking (new Art. 111(4)).

Is ISO 42001 enough for AI Act compliance?

No. ISO/IEC 42001 certification alone does not give an AI Act presumption of conformity. EN 18286:2026 is the harmonised QMS standard for the Article 17 parts it covers, and it maps to ISO/IEC 42001.

What is EN 18286?

EN 18286:2026 “Artificial intelligence – Quality management system for EU AI Act regulatory purposes” (CEN-CENELEC JTC 21). The Commission announced on 19 October 2026 that the reference is published in the Official Journal through Commission Implementing Decision (EU) 2026/2274. Providers that implement it get a presumption of conformity with the Article 17 QMS requirements it covers. The Commission says it is the only AI QMS standard with a presumption of conformity and is designed to be layered on top of ISO/IEC 42001, ISO 9001 or a sectoral QMS such as ISO 13485, not replace them.

What are the maximum AI Act fines?

Article 99 caps (unchanged): up to EUR 35 million or 7% of worldwide annual turnover for Article 5 breaches; up to EUR 15 million or 3% for operator obligations including Article 50 transparency; up to EUR 7.5 million or 1% for incorrect or misleading information; whichever is higher, except SMEs (and now small mid-caps for paragraphs 4–5) get whichever is lower.

Is the Digital Omnibus on GDPR/cookies law yet?

No. The Council agreed its mandate on 21 October 2026. Parliament still has to adopt its position before trilogues.

Does the AI Act mention agentic AI?

Yes. New Annex XIV notified-body codes include a code for “AI systems based on other emerging AI technologies … including Agentic AI”. That is the first time “agentic AI” appears in the AI Act text.

Sources

1. European Commission AI Act Service Desk, Timeline of the implementation of the EU AI Act, checked 26 Oct 2026. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act
2. European Commission, AI Act policy page, checked 26 Oct 2026. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
3. Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex, checked 26 Oct 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
4. Council of the EU, Timeline — Artificial Intelligence Act (29 Jun 2026 final approval; 7 May 2026 deal), checked 26 Oct 2026. https://www.consilium.europa.eu/en/policies/artificial-intelligence-act/timeline-artificial-intelligence/
5. AI Act Article 111 (consolidated, Future of Life Institute explorer), checked 26 Oct 2026. https://artificialintelligenceact.eu/article/111/
6. Digital Omnibus on AI full text (FLI explorer of the OJ text), checked 26 Oct 2026. https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/
7. Publications Office of the EU, Regulation (EU) 2026/1744 record, checked 26 Oct 2026. https://op.europa.eu/en/publication-detail/-/publication/b459c07f-86fb-11f1-bf5e-01aa75ed71a1/language-en
8. AI Act Article 99 (penalties), checked 26 Oct 2026. https://artificialintelligenceact.eu/article/99/
9. European Commission, “First harmonised standard supporting the AI Act published in the Official Journal”, 19 Oct 2026, checked 26 Oct 2026. https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal
10. CEN-CENELEC JTC 21, “EN 18286 becomes the first harmonised standard under the EU AI Act”, 14 Oct 2026, checked 26 Oct 2026. https://jtc21.eu/en-18286-becomes-the-first-harmonised-standard-under-the-eu-ai-act/
11. Council of the EU press release, 21 Oct 2026, checked 26 Oct 2026. https://www.consilium.europa.eu/en/press/press-releases/2026/10/21/digital-rulebook-council-agrees-position-to-simplify-data-protection-privacy-and-cyber-reporting-rules/
12. Agent Index open dataset v0.1.27 (CC BY 4.0), DOI 10.5281/zenodo.23604511, generated 2026-10-27. Auditors dataset v0.1.32. https://theagentindex.io/agents.json

Prepared by Agent Index (Heritage Services). Last reviewed 26 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.