EU AI Act timeline, 2024–2030: every deadline that affects your website

The EU AI Act became law on 1 August 2024, but it switches on in stages, and in July 2026 the EU moved several of them. This guide lists every deadline from 2024 to 2030 as the law reads now, after the Digital Omnibus on AI, and says for each one what it means for an ordinary business website: the chatbot in the corner, the AI-made images on the homepage, the blog posts drafted with AI. The short version: the transparency rules have applied since 2 August 2026, the next date that matters is 2 December 2026, and the high-risk rules most people worry about do not reach most websites at all.

Six years of AI Act deadlines, stage by stage

Each row is one stage of the law, drawn from its first date to its last. Select one to see what applies, what it means for a website and the dated milestones inside it.

Every EU AI Act deadline, and what it means for a website

From the Official Journal text of Regulation (EU) 2024/1689 (Articles 111 and 113) as amended by Regulation (EU) 2026/1744, read on 10 October 2026. Providers build an AI system or put it into service under their own name; deployers use one in their business.

What the AI Act is, and why its dates moved

The AI Act, Regulation (EU) 2024/1689, is the EU’s law on artificial intelligence. It was signed on 13 June 2024, published on 12 July and has been in force since 1 August 2024. It does not apply all at once. It switches on in stages, and each stage covers a different group: banned practices first, then the companies behind large AI models, then the transparency rules that reach ordinary websites, and the high-risk systems last.

In July 2026 the stages moved. Regulation (EU) 2026/1744, the Digital Omnibus on AI, adopted on 8 July and in force since 27 July 2026, postponed the high-risk rules by 16 months for Annex III and 12 months for Annex I, added two bans, rewrote the AI literacy duty and gave generators already on the market until December to mark their output. Every date in this guide is checked against the Official Journal text of both regulations. It explains what the law says; it is not legal advice about a specific system.

2 February 2025: banned practices and AI literacy

Since 2 February 2025, Article 5 bans a short list of uses: AI that manipulates or deceives people into decisions that cause them significant harm, AI that exploits their age, disability or social or economic situation, social scoring, predicting crime from profiling alone, untargeted scraping of faces for recognition databases, emotion recognition at work and in schools, sorting people by sensitive traits from biometric data, and, with narrow exceptions, real-time biometric identification, such as facial recognition, by the police in public spaces. For a website the first two are the ones to know: an AI feature built to push visitors into a purchase by deceiving them is the AI version of dark patterns, and the fines for banned practices are the highest in the Act.

The same date started the AI literacy duty in Article 4: companies that build or use AI have to take measures so that the staff who work with it understand it. The Omnibus rewrote it on 27 July 2026, from ensuring "a sufficient level of AI literacy" to taking measures "to support the development" of it, and the new text says no specific level has to be guaranteed. Article 4 is also not among the obligations Article 99 sets a fine level for. In practice, a short written guide for anyone who uses AI tools on your site covers it: what they may paste into a chatbot, and who checks AI text before it goes live.

2 August 2025: rules for the companies behind the models

Since 2 August 2025, providers of general-purpose AI models, the large language and image models behind most chatbots and generators, have to keep technical documentation, give information to the companies that build on their models, have a policy for respecting EU copyright law and publish a summary of the content they trained on. Since 2 August 2026 the Commission can fine them, and models that were already on the market before 2 August 2025 have until 2 August 2027.

None of this is a website owner’s job. It has one useful side effect: if you build a chatbot or a tool on a model provider’s API, the provider has to give you documentation about the model, and that documentation is what you need to answer the questions in the next section. Most EU businesses are at that stage, using AI built by someone else, as the figures on where EU IT budgets are going show.

2 August 2026: chatbots and AI content have to be disclosed

Article 50 is the part of the AI Act that reaches ordinary websites, and the Omnibus did not postpone it: it has applied since 2 August 2026. It sets four duties. An AI system that interacts with people has to tell them it is an AI unless that is obvious. AI systems that generate audio, images, video or text have to mark their output in a machine-readable way. Emotion recognition and biometric categorisation have to be disclosed to the people they are used on. And deepfakes, plus AI text published to inform the public on matters of public interest, have to be disclosed by whoever publishes them.

If a visitor can chat with it, it has to say it is an AI, at the latest in its first message. Article 50(5) asks for the information to be clear and distinguishable, given at the first interaction at the latest, and accessible. The duty sits with the provider, which the Act defines as whoever develops an AI system, or has one developed, and puts it into service under their own name. A chatbot built for your site on a model API and run under your brand puts you close to that definition. With an off-the-shelf widget it is the vendor’s duty, but your visitors only see your site. More on choosing one in AI chatbots for business.

For images, the test is the Act’s definition of a deepfake: AI-made image, audio or video that resembles real people, objects, places or events and would falsely appear authentic. An AI "photo" of your team, your premises or your product presented as real is the clear case; an obviously illustrated hero graphic is not. For text, the duty covers only text published to inform the public on matters of public interest, and it falls away when a person has reviewed it and someone holds editorial responsibility. A blog post drafted with AI, edited and signed by a person, is not covered, and neither are product descriptions.

2 December 2026: marked output and two new bans

AI systems that generate audio, images, video or text and were on the market before 2 August 2026 have until 2 December 2026 to mark their output in a machine-readable way. That deadline was added by the Omnibus. The Act lists the techniques it has in mind: watermarks, metadata, cryptographic proofs of origin, logging and fingerprints. In May 2026 the Commission published studies on how this works for text, for images and video, and for audio. If your site lets visitors generate something, such as product mock-ups or AI-written text, the mark usually comes from the model provider, but check that it survives your own pipeline: converting or compressing an image can strip its metadata.

The same day, two bans added by the Omnibus apply: AI systems that make realistic intimate images of an identifiable person without their explicit consent, and AI systems that generate child sexual abuse material. They cover systems built for that purpose and systems that can do it easily without reasonable safeguards. They have nothing to do with a normal business site, but if your site generates images of people, those safeguards are now a legal requirement.

December 2027 and August 2028: high-risk systems

The heaviest obligations, risk management, data quality, logging, human oversight and a conformity assessment, apply to high-risk systems. They were due on 2 August 2026 for the uses listed in Annex III; since the Omnibus they apply from 2 December 2027. For AI inside products covered by EU safety law, listed in Annex I, the date moved from 2 August 2027 to 2 August 2028. High-risk systems used by public authorities have until 2 August 2030.

A marketing site, a shop or a booking form is not high-risk; the high-risk list is about AI that makes decisions about people. Annex III names recruitment (placing targeted job ads, filtering applications, evaluating candidates), credit scoring, life and health insurance pricing, education and access to essential public services, along with biometrics, policing, migration and justice. On a website that means a careers page whose AI ranks applicants, or a checkout that makes AI credit decisions for pay-later. The Omnibus also made clear that AI used only for user assistance, performance optimisation, automation or convenience is not a safety component.

Fines: the three levels, and the lower cap for smaller companies

Article 99 sets three maximums. Banned practices: up to €35 million or 7% of worldwide annual turnover. Most other obligations, including Article 50: up to €15 million or 3%. Misleading information to the authorities: up to €7.5 million or 1%. For large companies the higher figure applies; for small and medium-sized companies, including start-ups, the lower one, and the Omnibus extended that lower cap to small mid-caps. National authorities enforce the rules for AI systems, and the Commission’s AI Office enforces them for the model providers.

What to do on your website before 2 December 2026

Start with an inventory: every place where AI talks to your visitors, makes content they see or decides something about them. That means the chat widget, AI-made images, AI-written text, any generator visitors can use, and any form whose answers an AI screens. Most business sites end up with one or two lines.

Then fix each line. A chatbot says it is an AI in its first message, inside the widget. A realistic AI image of real people, places or products gets a visible label next to it. AI text that informs the public on matters of public interest gets a named editor or a label. A generator gets checked with its vendor for machine-readable marking, and your image pipeline gets checked for stripping it. If anything on the list screens job applicants or decides on credit, start the high-risk work now, because December 2027 is the date it has to be finished, not started. If you want someone to go through the site with you, that is part of our AI and automation work.

Sources

Every date and article number here is from the Official Journal text of Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, read on 10 October 2026. The Commission pages summarise the same law.

• Publications Office of the EU — Regulation (EU) 2024/1689 (Artificial Intelligence Act) ↗

  Signed 13 June 2024, Official Journal 12 July 2024. Article 4 AI literacy, Article 5 banned practices, Article 50 transparency, Article 99 fines, Article 113 dates.

• Publications Office of the EU — Regulation (EU) 2026/1744 (Digital Omnibus on AI) ↗

  Adopted 8 July 2026, Official Journal 24 July 2026, in force 27 July 2026. New Article 113 dates, Article 111(4) marking deadline, two new bans, Article 4 rewritten.

• European Commission — AI Act ↗

  The Commission’s summary of the risk levels and the timeline after the Omnibus: Annex III from 2 December 2027, Annex I from 2 August 2028.

• Publications Office of the EU — Technical solutions for marking and detecting AI generated text content in the context of Article 50(2) AI Act ↗

  May 2026 study for the Commission on marking AI-generated text.

• Publications Office of the EU — Technical solutions for marking and detecting AI-generated image and video content in the context of Article 50(2) AI Act ↗

  May 2026 study for the Commission on marking AI-generated images and video.