If your company builds AI, or puts it in front of customers and employees in Europe, parts of the EU AI Act already apply to you, and more arrives on fixed dates. Once you know which duties are live and which are still ahead, you can plan your roadmap and choose your vendors once, without reworking both at every deadline.
The law arrived in stages, and that's where most of the confusion starts. Some teams hear "the AI Act is in force" and assume every rule applies today. Others hear "the high-risk rules were delayed" and assume they have years before anything matters. Both are wrong.
The EU AI Act timeline
The Act entered into force on 1 August 2024. Since then, its duties have switched on one group at a time.
- 2 February 2025: the bans on unacceptable-risk practices and the AI literacy duty started to apply.
- 2 August 2025: the rules for general-purpose AI models started to apply.
- 2 August 2026: the transparency duties started to apply.
- 2 December 2027: the high-risk obligations apply to standalone systems.
- 2 August 2028: the high-risk obligations apply to AI built into regulated products.
The last two dates are new. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk obligations to those later dates. The other dates stayed where they were.
What already applies to your company
Three groups of rules are live as you read this.
The bans came first. The Act prohibits a set of practices it treats as an unacceptable risk, and one of them matters to any company using AI with staff or students. Emotion recognition in the workplace and in education is banned. If you're looking at AI for hiring, onboarding, training or teaching, that ban already limits what a tool may do with the people in front of it.
The AI literacy duty started on the same day. The people in your company who work with AI need to understand what they're working with.
Then came the rules for general-purpose AI models, the large models that many AI products are built on.
The newest group is the one your customers see. Since 2 August 2026, people have to be told when they're interacting with an AI system, and synthetic media has to be labelled. Systems that were already on the market before then have until 2 December 2026 to add machine-readable labels to the content they generate. This applies to the chatbot on your website, the voice on your support line and the face in your training module. It's also the easiest rule for an outsider to check, because anyone who talks to your AI can see whether it told them.
What the high-risk delay changes
The move to December 2027 and August 2028 gives companies with high-risk systems more time to prepare for the heaviest obligations. It doesn't pause the Act.
The bans still hold. The literacy duty still holds. The transparency duties didn't move at all, and they're the ones that touch the widest range of companies, because they apply wherever a person meets an AI system.
So the useful question for the next year is whether every AI touchpoint you run, or plan to buy, tells people what it is.
How we built Ojin for the EU AI Act
We build AI agents with a real face and a real voice that hold a conversation in real time, in the browser. That puts us right where the transparency duties apply, and we designed for them from the start.
Our agents can tell people they're talking to an AI. We treat that as part of the conversation. The more human an agent looks and sounds, the more it matters that the person on the other side knows what they're talking to, so the disclosure belongs in the product itself, where your team can rely on it.
The rest of our posture follows the same thinking. We built Ojin for the EU AI Act, GDPR, SOC 2 and data sovereignty, because the companies we work with in Europe answer to all of them at once. A buyer in finance, insurance or HR has to show their own legal team that a new AI system fits the rules. We want that to be a short conversation.
We made these choices early because a staged law rewards it. Each new date on the timeline is a known requirement, and a product built to meet it from day one doesn't need a rebuild when the date arrives.
What to do with the dates
Start with what's live. List every place where a customer, candidate or employee meets an AI system in your company, and check that each one says so. Check any tool used with staff or learners against the emotion recognition ban. Make sure the teams who work with AI have been trained on it.
Then look ahead. If any of your systems fall under the high-risk obligations, the new dates tell you how long you have.
Ask every AI vendor the same plain questions. Can your product tell people it's an AI? Which parts of the Act did you build for, and when? A vendor that built for the Act will answer quickly.
Why we welcome the rules
Europe's transparency rule asks for something we'd build anyway. An agent with a human face and voice works because people are comfortable talking to it, and that comfort depends on them knowing what they're talking to.
Some companies will treat the AI Act as a cost to keep as low as they can. We see it as the standard that human-like AI has to meet before anyone should trust it. An agent that says what it is loses nothing in the conversation, and it earns the trust that everything else depends on.