Skip to content
MoorAI
// eu ai act · timeline, bans, roles

The EU AI Act: dates, prohibited practices and obligations by role, sourced

Regulation (EU) 2024/1689, the AI Act, applies in stages. Regulation (EU) 2026/1744, the AI Omnibus, amends it: it sets the dates for the high-risk rules, adds two prohibited practices and rewrites the AI literacy duty. This page lists every application date, every practice Article 5 prohibits, and what each role in the AI value chain has to do, with the article behind each statement. Where the Omnibus amends an article, the amended text is the one described.

Legal statements are checked against the Official Journal texts of both regulations, read on 9 October 2026; the Commission pages cited in the timeline are secondary sources (links at the end of the page). This page is not legal advice.

1. Timeline

  1. 1 August 2024 The AI Act enters into force. Source: [1], [2]; Omnibus recital 1 [6]
  2. 2 February 2025 Chapters I and II apply: the general provisions, including the definitions and the AI literacy obligation, and the prohibitions. The prohibitions that apply from this date are the eight in Article 5(1), points (a) to (h): harmful manipulation and deception, harmful exploitation of vulnerabilities, social scoring, individual criminal-offence risk prediction based solely on profiling, untargeted scraping to build facial-recognition databases, emotion recognition in workplaces and education, biometric categorisation to infer certain protected characteristics, and real-time remote biometric identification for law enforcement in publicly accessible spaces. Each is listed below. Article 4 on AI literacy has read as replaced by the Omnibus since 27 July 2026; it is covered in detail on our Article 4 page. Source: Art. 113(a) as replaced by the Omnibus [6]; [1], [2]
  3. 2 August 2025 Obligations for providers of general-purpose AI (GPAI) models apply, together with the rules on notified bodies, governance and penalties. Article 113(b) applies Chapter III Section 4 (notifying authorities and notified bodies), Chapter V (GPAI models), Chapter VII (governance) and Chapter XII (penalties) from this date, except Article 101 on fines for GPAI providers. The Commission describes this as Member States designating their national competent authorities and adopting national laws on penalties, and the AI Board, the Scientific Panel and the Advisory Forum being set up. Source: Art. 113(b) and recital 179 [5]; [1]
  4. 27 July 2026 The AI Omnibus enters into force, on the third day after its publication in the Official Journal on 24 July 2026. Source: Omnibus Art. 4 [6]; [4]
  5. 2 August 2026 The Act applies in general from this date, apart from the dates listed for specific provisions. This includes the transparency rules of Article 50: for example, people are told when they are interacting with an AI system, deepfakes are disclosed and synthetic content is marked in a machine-readable format. It also includes the measures in support of innovation (Chapter VI), market surveillance (Chapter IX) and the Commission's power to fine GPAI providers (Article 101). The Commission describes this date as the start of enforcement at national and EU level for the GPAI obligations, the prohibitions, the transparency rules and AI literacy. Source: Art. 113, second paragraph [5]; [1], [3]
  6. 2 December 2026 The two prohibitions the Omnibus adds apply: AI systems that generate or manipulate non-consensual intimate or sexually explicit material of an identifiable person, and AI systems that generate child sexual abuse material. The Commission describes them together as one new prohibition, giving “nudification” apps as an example. The same date is the deadline for providers of AI systems, including GPAI systems, that generate synthetic audio, image, video or text content and were placed on the market before 2 August 2026 to comply with Article 50(2). Source: Art. 113(a) and Art. 111(4) as amended by the Omnibus [6]; [1], [3]
  7. 2 August 2027 Each Member State has at least one AI regulatory sandbox at national level in operation. The same date is the deadline for providers of GPAI models placed on the market before 2 August 2025 to comply with the Act. Source: Art. 57(1) as replaced by the Omnibus [6]; Art. 111(3) [5]; [1]
  8. 2 December 2027 The high-risk rules (Chapter III, Sections 1 to 3) apply to AI systems that are high-risk under Article 6(2) and Annex III. Annex III lists eight areas: biometrics; critical infrastructure; education and vocational training; employment, workers' management and access to self-employment; access to essential private and public services and benefits; law enforcement; migration, asylum and border control management; and administration of justice and democratic processes. See the obligations by role below. Source: Art. 113(c)(i) as replaced by the Omnibus [6]; Annex III [5]; [1], [2], [3], [4]
  9. 2 August 2028 The high-risk rules apply to AI systems that are high-risk under Article 6(1) and Annex I: safety components of products, or products, covered by the listed EU product legislation. Annex I includes, for example, the legislation on toys and on lifts. Source: Art. 113(c)(ii) as replaced by the Omnibus [6]; Art. 6(1), Annex I [5]; [1], [2], [4]
  10. 2 August 2030 Providers and deployers of high-risk AI systems intended to be used by public authorities comply with the Act, including systems placed on the market before the high-risk rules applied. Other high-risk systems already on the market before their high-risk date fall under the Act only if their design changes significantly from that date. Source: Art. 111(2) as replaced by the Omnibus [6]

The AI Omnibus

The Commission proposed the AI Omnibus on 19 November 2025. A political agreement was reached on 7 May 2026, and the Omnibus entered into force on 27 July 2026 [2], [4]. Besides the high-risk dates above, it makes these changes:

  • AI literacy: Article 4 is replaced. Providers and deployers take measures to support the AI literacy of their staff, with no obligation to guarantee any individual's level, and the Commission and the Member States support them in doing so (Art. 4 [6]).
  • Prohibitions: two practices are added to Article 5, covered below (Art. 5(1)(ba) and (bb) [6]).
  • Small mid-caps: small mid-cap enterprises (SMCs) are defined and share several SME simplifications, including simplified technical documentation and capped fines (Art. 3(14b), 11(1), 99(6a) [6]).
  • EU database: the content required to register AI systems that a provider has concluded are not high-risk under Article 6(3) is reduced (Annex VIII, Section B, and recital 22 [6]).
  • Bias detection: special categories of personal data may be processed, under listed safeguards, to detect and correct bias (Art. 4a [6]).
  • AI Office: the AI Office is exclusively competent to supervise certain AI systems, including AI systems built on a GPAI model by the same provider (Art. 75(1) [6]).
  • Sandboxes: the AI Office may set up an EU-level regulatory sandbox, with priority access for SMEs and SMCs (Art. 57(3a) [6]).

2. Prohibited practices (Article 5)

Article 5(1) prohibits placing on the market, putting into service or using an AI system for any of the practices below. As amended by the Omnibus it has ten lettered points: the eight original points (a) to (h), and points (ba) and (bb) inserted by the Omnibus. The Commission describes (ba) and (bb) together as a single “ninth” prohibition, which is why its count is nine [1], [4]. The descriptions here are plain-language summaries; the exceptions and conditions are in the text [5], [6].

Art. 5(1) Prohibited practice Applies from
(a) Subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour by impairing their ability to make an informed decision, causing or likely to cause significant harm. 2 Feb 2025
(b) Exploiting a person's or group's vulnerabilities due to age, disability or a specific social or economic situation to materially distort their behaviour, causing or likely to cause significant harm. 2 Feb 2025
(ba) Generating or manipulating realistic images, video, audio or similar material of an identifiable person's intimate parts, or of an identifiable person engaged in sexually explicit activities, without that person's freely given, specific, informed, unambiguous and explicit consent. Added by the Omnibus. 2 Dec 2026
(bb) Generating or manipulating child sexual abuse material or performance, as defined in Article 2, points (c) and (e), of Directive 2011/93/EU, except where a “without right” defence applies under national law. Added by the Omnibus. 2 Dec 2026
(c) Social scoring: evaluating or classifying people over time by social behaviour or personal characteristics, where the score leads to unjustified or out-of-context detrimental treatment. 2 Feb 2025
(d) Assessing or predicting the risk that a person will commit a criminal offence based solely on profiling or on personality traits, unless the system supports a human assessment already based on objective, verifiable facts. 2 Feb 2025
(e) Creating or expanding facial-recognition databases through untargeted scraping of facial images from the internet or CCTV footage. 2 Feb 2025
(f) Inferring the emotions of a person in the workplace or in education institutions, except for medical or safety reasons. 2 Feb 2025
(g) Biometric categorisation of individuals to deduce or infer their race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. 2 Feb 2025
(h) Real-time remote biometric identification in publicly accessible spaces for law enforcement, except where strictly necessary for one of three listed objectives, under the authorisation and safeguards of Article 5(2) to (7). 2 Feb 2025

For points (ba) and (bb), placing a system on the market or putting it into service is prohibited only where that generation is its intended purpose, or where its design makes it a reasonably foreseeable and reproducible outcome without adequate safeguards to prevent it. Using such a system is prohibited only where the deployer uses it for that purpose (Art. 5(1a) [6]).

3. Obligations by role

The Act assigns duties by role. The Article 3 definitions decide which role an organisation has for a given AI system, and one organisation can hold different roles for different systems. Most of the duties below apply only to high-risk AI systems; the duties that apply more widely are Article 4 (AI literacy), Article 5 (the prohibitions) and Article 50 (transparency). The general-purpose AI model duties apply to the model, whatever system it ends up in.

Provider

Art. 3(3): a person or body “that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark”. Putting into service includes supply “for own use” (Art. 3(11)) [5].

  • High-risk requirements (Art. 8 to 15): a risk management system (Art. 9); data governance for training, validation and testing data (Art. 10, as amended by the Omnibus); technical documentation (Art. 11; SMEs and SMCs may use a simplified form under the Omnibus); automatic logging of events over the system's lifetime (Art. 12); transparency and instructions for deployers (Art. 13); design for effective human oversight (Art. 14); accuracy, robustness and cybersecurity (Art. 15).
  • Provider duties for high-risk systems (Art. 16): a quality management system (Art. 17, proportionate to the provider's size under the Omnibus); keep documentation (Art. 18) and the logs under its control (Art. 19); conformity assessment before placing on the market (Art. 43); EU declaration of conformity (Art. 47); CE marking (Art. 48); registration in the EU database for Annex III systems (Art. 49(1)); corrective actions and information duties (Art. 20); cooperate with authorities (Art. 21); accessibility requirements.
  • After placing on the market: a post-market monitoring system and plan (Art. 72) and reporting of serious incidents to market surveillance authorities (Art. 73).
  • Not high-risk by derogation: a provider that concludes an Annex III system is not high-risk under Art. 6(3) documents that assessment before placing it on the market and registers the system (Art. 6(4), 49(2)).
  • All providers: AI literacy measures for staff (Art. 4, as replaced by the Omnibus); systems that interact directly with people are designed so people are informed they are interacting with an AI system, unless obvious (Art. 50(1)); systems generating synthetic audio, image, video or text mark outputs in a machine-readable, detectable format (Art. 50(2)).

Text: Art. 3(3), 3(11), 6, 8 to 21, 43, 47 to 50, 72, 73 [5]; Art. 4, 10, 11(1), 17(2), 72(3) as amended [6]

Deployer

Art. 3(4): a person or body “using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity” [5].

  • All deployers: AI literacy measures for staff and others operating or using AI systems on their behalf (Art. 4, as replaced by the Omnibus; see our Article 4 page). The Article 5 prohibitions cover use, not only supply.
  • Transparency (Art. 50): deployers of an emotion recognition or biometric categorisation system inform the people exposed to it (Art. 50(3)); deployers disclose deepfake image, audio or video content (Art. 50(4)); deployers disclose AI-generated or manipulated text published to inform the public on matters of public interest, unless it has had human review or editorial control (Art. 50(4)).
  • High-risk systems (Art. 26): use the system according to its instructions for use; assign human oversight to people with the necessary competence, training and authority; ensure input data under their control is relevant and sufficiently representative; monitor operation, and inform the provider, distributor or importer and the market surveillance authority of risks and serious incidents, suspending use where the system presents a risk; keep the system's automatically generated logs under their control for at least six months; inform workers' representatives and affected workers before using the system at the workplace; use the provider's information for a data protection impact assessment where required; inform people subject to decisions by Annex III systems; cooperate with authorities.
  • Fundamental rights impact assessment (Art. 27): before deploying an Annex III high-risk system (other than in critical infrastructure, point 2), bodies governed by public law, private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems (Annex III, points 5(b) and (c)) assess its impact on fundamental rights. Under the Omnibus the assessment can cross-refer to a data protection impact assessment, and the AI Office provides a template.
  • Becoming a provider (Art. 25(1)): a deployer takes on the provider's obligations if it puts its name or trademark on a high-risk system, substantially modifies one, or changes the intended purpose of a system so that it becomes high-risk.

Text: Art. 3(4), 5, 25(1), 26, 27(1), 50(3) and (4) [5]; Art. 4, 27(4) and (5) as amended [6]

Importer

Art. 3(6): a person “located or established in the Union that places on the market an AI system that bears the name or trademark of a natural or legal person established in a third country” [5].

  • Before placing a high-risk system on the market (Art. 23(1)): verify that the provider carried out the conformity assessment, drew up the technical documentation, affixed the CE marking with the EU declaration of conformity and instructions for use, and appointed an authorised representative.
  • Ongoing (Art. 23(2) to (7)): do not place a non-conforming or falsified system on the market and report risks; put its own name and contact address on the system; keep storage and transport from compromising conformity; keep the certificate, instructions and declaration for 10 years; supply documentation to authorities on request and cooperate with them.

Text: Art. 3(6), 23 [5]; not amended by the Omnibus

Distributor

Art. 3(7): a person “in the supply chain, other than the provider or the importer, that makes an AI system available on the Union market” [5].

  • Before making a high-risk system available (Art. 24(1)): verify the CE marking, the copy of the EU declaration of conformity and the instructions for use, and that the provider and importer have met their labelling and quality management duties.
  • Ongoing (Art. 24(2) to (6)): do not make a non-conforming system available and report risks; keep storage and transport from compromising conformity; take or ensure corrective action, withdrawal or recall for a non-conforming system already supplied; supply information to authorities on request and cooperate with them.

Text: Art. 3(7), 24 [5]; not amended by the Omnibus

Authorised representative

Art. 3(5): a person “located or established in the Union who has received and accepted a written mandate from a provider of an AI system or a general-purpose AI model” to carry out the provider's obligations and procedures on its behalf [5].

  • For high-risk AI systems (Art. 22): providers established outside the EU appoint one by written mandate before making a high-risk system available. The representative verifies that the EU declaration of conformity and technical documentation exist and that conformity assessment was carried out; keeps the provider's contact details, the declaration, the technical documentation and any certificate for 10 years; supplies information, including logs under the provider's control, to authorities on request; cooperates with them; handles registration where applicable; and terminates the mandate, informing the authorities, if the provider acts contrary to its obligations.
  • For GPAI models (Art. 54): the same arrangement for providers outside the EU placing a GPAI model on the EU market, with the AI Office as the authority; it does not apply to qualifying free and open-source models unless they present systemic risk.

Text: Art. 3(5), 22, 54 [5]; not amended by the Omnibus

Product manufacturer

Article 3 does not define “product manufacturer”; the term is used in the definition of “operator” (Art. 3(8)), and the Act applies to “product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark” (Art. 2(1)(e)) [5].

  • Treated as the provider (Art. 25(3)): where a high-risk AI system is a safety component of a product covered by the legislation in Annex I, Section A, the product manufacturer is considered the provider and is subject to Article 16 if the system is placed on the market with the product under its name, or put into service under its name after the product is on the market.
  • Conformity assessment (Art. 43(3), as replaced by the Omnibus): for Annex I, Section A products, the provider follows the conformity assessment procedure of that sectoral legislation, with the AI Act's high-risk requirements assessed as part of it.

Text: Art. 2(1)(e), 3(8), 25(3) [5]; Art. 43(3) as replaced [6]

General-purpose AI model provider

A provider (Art. 3(3)) of a general-purpose AI model, defined in Art. 3(63) as a model that “displays significant generality and is capable of competently performing a wide range of distinct tasks” and can be integrated into a variety of downstream systems, excluding models used only for research, development or prototyping before release [5].

  • All GPAI model providers (Art. 53): keep technical documentation of the model (Annex XI) for the AI Office and national authorities; give documentation to downstream providers integrating the model (Annex XII); put in place a policy to comply with EU copyright law, including reservations of rights expressed under Article 4(3) of Directive (EU) 2019/790; publish a sufficiently detailed summary of the training content. Qualifying free and open-source models are exempt from the two documentation duties unless they present systemic risk.
  • GPAI models with systemic risk (Art. 55): in addition, evaluate the model with state-of-the-art protocols, including adversarial testing; assess and mitigate systemic risks at EU level; track and report serious incidents to the AI Office; ensure adequate cybersecurity for the model and its physical infrastructure.
  • Dates and fines: these duties apply from 2 August 2025 (by 2 August 2027 for models already on the market before 2 August 2025), and the Commission may fine GPAI providers under Article 101 from 2 August 2026.

Text: Art. 3(63), 53, 54, 55, 101, 111(3), 113 [5]; Articles 53 to 55 not amended by the Omnibus

4. Where an organisation using AI agents usually sits

A company whose staff use coding agents or other AI agents at work is, for those agents, usually a deployer: it uses an AI system under its authority in a professional activity (Art. 3(4)). The company that offers the agent is usually its provider, and the company that offers the underlying model is usually a GPAI model provider. What follows is a reading of the text, not a classification of any specific use.

  • What applies to such a deployer in any case: AI literacy measures (Art. 4) and the Article 5 prohibitions. The Article 50 transparency duties apply when the deployer does what they describe, for example publishing deepfakes or AI-generated text to inform the public on matters of public interest.
  • High-risk duties apply only if the system is high-risk under Article 6: a safety component of, or itself, a product under Annex I that requires third-party conformity assessment (Art. 6(1)), or a use listed in Annex III (Art. 6(2)). Software development is not one of the eight Annex III areas, but some uses an organisation might give an agent are: for example, recruitment and selection (Annex III, point 4(a)), or allocating tasks based on individual behaviour or personal traits and monitoring or evaluating staff performance (point 4(b)). Where a use is high-risk, the deployer duties of Article 26 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems.
  • When a deployer becomes a provider: under Article 25(1), by putting its name on a high-risk system, substantially modifying one, or changing a system's intended purpose so that it becomes high-risk. An organisation that develops an AI system itself and puts it into service under its own name, including for its own use, also meets the provider definition (Art. 3(3) and 3(11)).
  • Outside the EU: the Act also covers providers and deployers established in a third country where the output of the AI system is used in the EU (Art. 2(1)(c)).

5. Where MoorAI fits

MoorAI does not make an organisation compliant with the AI Act, and no tool does. What it produces is evidence: a content-free inventory of the models, agents and MCP servers in use, and a record of the checks, coaching and blocks on each agent action, without the prompt or file content. That record is not the log a high-risk AI system has to generate itself (Art. 12), and it does not take the place of any obligation listed above. The compliance crosswalk maps MoorAI's controls to the AI Act and other frameworks, the AI-BOM post covers the inventory, and the Article 4 page covers in-context AI literacy and what it does not discharge.

Sources

  1. European Commission, AI Act Service Desk, Timeline for the implementation of the EU AI Act. The page states that the timeline takes into account the amendments introduced by the Digital Omnibus on AI.
  2. European Commission, AI Act (Shaping Europe's digital future), last updated 3 August 2026.
  3. European Commission, Enforcement of the AI Act, last updated 6 October 2026. The Commission states that its enforcement overview is for information only and does not replace the provisions of the Act.
  4. European Commission, AI Omnibus enters into force, last updated 31 July 2026.
  5. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), OJ L, 2024/1689, 12.7.2024.
  6. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI), OJ L, 2026/1744, 24.7.2026.

Not legal advice. This page summarises the Official Journal texts and the Commission's published timeline. Obligations depend on your role, your systems and your jurisdiction; check the text and consult qualified counsel before relying on it.

See the compliance crosswalk → Article 4 (AI literacy) → AI-BOM & the EU AI Act →