The AI Act deadlines. Half of those you find written around have been out of date since July.

On 24 July 2026 the AI Act calendar was rewritten, and the high-risk dates slipped by more than a year. The postponement, however, concerns precisely the part a small business doesn't use, while the part that concerns it has already fallen due.

This piece sits within the guide to the AI Act obligations for companies and SMEs and keeps its calendar up to date. It is written for whoever runs a business, and it ends where a lawyer's work begins.

What has already kicked in

The AI Act came into force on 1 August 2024 and applies in stages. Article 113 sets the general date at 2 August 2026 and provides for exceptions, which were rewritten in July 2026.

Date	What kicks in	Status
2 February 2025Chapters I and II	General provisions, definitions, the staff literacy of Article 4 and the prohibitions of Article 5.	In force
2 August 2025governance and models	Chapter III section 4, Chapter V on general-purpose models, Chapter VII on governance, Chapter XII and Article 78, with the exception of Article 101.	In force
27 July 2026Articles 102 to 110	The amendments to other Union acts, brought forward by the omnibus with a new point in Article 113.	In force
2 August 2026general date	The regulation applies, and with it the transparency obligations of Article 50: saying there is an AI, disclosing synthetic content.	In force

What is still to come

After the postponement four dates remain ahead, and the first falls within a few months. The two central ones concern high-risk systems, so a minority of businesses; the last concerns the public sector.

Date	What kicks in	Who it concerns
2 December 2026two deadlines	The two new prohibited practices of Article 5, and the deadline for marking synthetic content from systems placed on the market before 2 August 2026.	Anyone generating synthetic content. The next in time.
2 December 2027high risk, Annex III	Chapter III, sections 1, 2 and 3, for high-risk systems under Article 6(2). Postponed from 2 August 2026.	Whoever uses systems in the Annex III use cases, for example in recruitment.
2 August 2028high risk, Annex I	The same sections, for high-risk systems under Article 6(1), that is, those linked to products. Postponed from 2 August 2026.	Whoever manufactures products with an intelligent component inside.
2 August 2030public administration systems	Providers and deployers of high-risk systems intended for public authorities take the measures to comply, under Article 111.	The public sector and those who supply it.

What has been postponed, and what hasn't

Regulation (EU) 2026/1744, published in the Official Journal of the European Union on 24 July 2026, rewrote point (c) of the third paragraph of Article 113. Chapter III, sections 1, 2 and 3, with the exception of Article 6(5), now applies from 2 December 2027 for Annex III and from 2 August 2028 for Annex I.

«Chapter III, sections 1, 2 and 3, with the exception of Article 6(5), shall apply from: 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III.»
Regulation (EU) 2024/1689, Article 113, as replaced by Regulation (EU) 2026/1744 (our translation of the Italian text)

The reason is written in the recitals and it isn't political. The delay in the availability of harmonised standards, common specifications and guidance made application difficult and implementation costs disproportionate, to the point of not justifying keeping the initial date.

The point almost no article highlights is the scope of the postponement. The prohibitions of Article 5, the literacy of Article 4, the transparency obligations of Article 50, governance and the rules on general-purpose models stay at their dates. An ordinary business hasn't gained a single day on what concerns it.

The next real date: 2 December 2026

It is the only deadline still ahead that affects private parties, and it brings two different things. The first is the two new prohibited practices inserted into Article 5 by the omnibus: points (ba) and (bb) of paragraph 1, with paragraphs 1a and 1b, on the non-consensual generation or manipulation of sexually explicit material and on the material covered by Directive 2011/93/EU.

The second is an alignment deadline for providers. Whoever placed on the market before 2 August 2026 systems generating synthetic content in audio, image, video or text, including general-purpose systems, must take the measures to comply with Article 50(2), that is, with machine-readable marking, by that date.

For a business buying tools, the second deadline translates into a question to ask the provider: will the content your system generates be marked by 2 December 2026? It pays to have the answer in writing.

Systems already in use, and the grandfathering that doesn't exist

The transitional provisions are in Article 111, also amended in 2026. For high-risk systems placed on the market or put into service before the date of application of Chapter III, the regulation applies only if, from that date, they are subject to significant changes in their design.

The exception concerns the public sector. Providers and deployers of high-risk systems intended to be used by public authorities must in any case take the measures to comply by 2 August 2030.

For the transparency obligations it is the opposite, and it is worth saying clearly because it is the most common source of misunderstanding. Article 50 provides no grandfathering: it applies to systems within scope regardless of the date on which they were placed on the market. An assistant installed on the website in 2024 had to be disclosed from 2 August 2026.

The Italian deadline nobody watches

Alongside the European calendar runs a national one. Article 24 of Law 132/2025 delegates to the Government the adoption of one or more legislative decrees to align national law with the regulation, within twelve months of the law's entry into force, that is, by 10 October 2026.

Those decrees must give AgID and ACN, designated national authorities by Article 20, all the supervisory, inspection and penalty powers provided for by the regulation. Until they arrive, the Italian penalty framework of the AI Act remains incomplete while the European obligations are in full force.

The regulation's penalties, meanwhile, remain those of Article 99: up to €35 million or 7% of total worldwide annual turnover for prohibited practices, and up to €15 million or 3% for the band that includes the transparency obligations, with the lower of the two amounts where SMEs are concerned.

The practical reading for a business is that there are two calendars to watch, and that the two closest deadlines, 10 October and 2 December 2026, both fall in the coming months.

Why the dates you read around are often old

The postponement dates from July 2026, so every page written before it gives 2 August 2026 as the high-risk date. Those pages have almost never been updated, and they keep appearing among the top results because they have years of history behind them.

The way not to get it wrong is always the same and needs no subscription: look at the consolidated version of the regulation on EUR-Lex instead of a commentary article. The consolidated version incorporates the amendments, a commentary article incorporates the date on which it was written.

It also works the other way round. If someone tells you the AI Act has been postponed and so you don't need to do anything, they are using the high-risk postponement to cover obligations that have been in force for eighteen months.

The three dates that apply to you, and what to do now

Setting everything else aside, for a business using third-party tools the calendar comes down to three lines, and two have already passed.

2 February 2025. The obligation to take care of the skills of those who use the systems, and the prohibitions. If you have never held an internal session on the tools in use, that is the first thing, and it is a morning's work.

2 August 2026. The disclosures: a line under every automated point of contact, and a note on generated content where needed. 2 December 2026. Marking of synthetic content for pre-existing systems, which is a question to pass on to the provider.

In the systems we build these things sit inside the project instead of in a scramble: every message that commits the company, that is, offers, quotes, prices and confirmations, goes out only after a person has read and approved it. Replies on information already approved by the owner can go out on their own, the owner switches channels on and off one by one, and the reply states that it is a system as Article 50 requires. The extended scope is in the AI principles, the systems we actually use on the AI transparency page.

Questions and answers

This article is an operational overview, not a legal opinion. On how a deadline applies to a specific system, the answer comes from a professional who looks at your company.