The EU Council has given final approval to simplifications to the AI Act under the Omnibus VII package. The key change concerns high-risk systems. The new deadlines are December 2, 2027 for stand-alone high-risk systems, and August 2, 2028 for AI systems embedded in regulated products.<\/p>
That doesn\u2019t mean, though, that the AI Act has been put on hold. The regulation took effect on August 1, 2024, but its most important obligations are being phased in. Some took effect in 2025, some are still scheduled for 2026, and some have just been pushed back.<\/p>
Therefore, let’s sort out where things stand: which provisions are already in force, which will take effect in the coming months, and which the European Union has phased in over a longer period?<\/p>
What’s already in effect?<\/strong><\/p> The first key phase began on February 2, 2025. As of that date, the AI Act’s definitions, bans on the riskiest applications of AI, and the requirement for so-called AI literacy, meaning competencies related to understanding and using artificial intelligence, took effect.<\/p> AI literacy sounds technical, but in practice it’s about something very simple: a company, a public agency or a school that uses AI should make sure the people using these tools understand what they’re dealing with. It’s not about a mandatory exam or a certificate. The European Commission explains that organizations should ensure a “sufficient level” of knowledge, depending on employees’ roles, the type of system and the risks associated with its use.<\/p> For example, if a marketing department uses ChatGPT, Copilot or Gemini to create copy, proposals or translations, the company doesn\u2019t need to build a full-blown compliance system right away. However, it should know who\u2019s using these tools and for what, what data they can paste into those tools, what\u2019s off-limits, who reviews the output and how to handle the risk of errors or hallucinations.<\/p> As of February 2, 2025, bans on AI uses deemed unacceptable also took effect. That\u2019s the highest risk level under the AI Act. This includes, among other things, manipulating people\u2019s behavior, exploiting their age, disability or vulnerable circumstances, social scoring, certain forms of predictive assessment of the risk of committing a crime, mass facial scanning from the internet or CCTV cameras to build facial recognition databases, and emotion recognition systems in the workplace and education.<\/p> This means, for example, that an employer can’t just deploy a system that analyzes camera footage or an employee’s voice to assess their emotions at work. A school can’t use a similar system to evaluate students’ emotional state in class. Such solutions aren’t treated as ordinary automation, but as an intrusion into a particularly sensitive area.<\/p> What goes into effect as of August 2025?<\/strong><\/p> The next phase began on August 2, 2025. That\u2019s when the rules for general-purpose AI models, or GPAI (General-Purpose AI), took effect. These aren\u2019t ordinary applications used in a company, but models that can handle many different tasks and become the foundation for many other services. This category includes large language and multimodal models that power chatbots, assistants, search engines and tools for writing, coding, document analysis and image generation.<\/p> The obligations primarily apply to providers of such models, not to every company that uses an off-the-shelf tool. For a typical company, this means that if you’re using an off-the-shelf tool based on a large AI model, you should understand whether you’re just a user or you’re deploying an AI system in a process that could affect other people’s rights or life opportunities.<\/p> What was supposed to happen on August 2, 2026?<\/strong><\/p> August 2, 2026 caused the biggest stir. Many companies treated that date as the cutoff after which the AI Act would really start to “bite”. It was largely about obligations for high-risk systems.<\/p> Not every AI tool is a high-risk system. So it\u2019s not about a company using a text generator to draft a LinkedIn post or a meeting summary. The operation of a high-risk system can genuinely affect a person\u2019s health, safety, rights or life opportunities. What matters isn\u2019t just the model itself, but above all the purpose AI is used for.<\/p> This category includes, among others, systems used in recruitment, education, critical infrastructure, access to public and private services, creditworthiness assessment, migration, border control, law enforcement and the justice system. The Commission cites examples such as systems for filtering job applications, evaluating candidates, assessing learning outcomes, detecting exam fraud, assessing creditworthiness, assessing risk in health and life insurance and certain applications in migration and the justice system.<\/p> In that case, the system provider would be responsible for risk assessment, data quality, documentation, system resilience, cybersecurity, system activity logging and a human oversight capability. The organization using such a tool, in turn, would need to follow the instructions, monitor its operation, respond to risks and assign a person responsible for oversight. The Commission also notes that the AI Act sets penalties for violations, which depend on the type of obligation and the size of the entity.<\/p> What has been postponed?<\/strong><\/p> Following the changes adopted under Omnibus VII, the obligations for standalone high-risk systems are set to take effect on December 2, 2027. That includes, among other things, systems used in biometrics, critical infrastructure, education, employment, migration, asylum and border control.<\/p> The deadline has been pushed back even further for AI systems built into products covered by sector-specific safety and market surveillance regulations. Here, the new date is August 2, 2028. This includes AI in products like elevators, toys, machinery and other devices regulated by separate EU rules.<\/p> That’s an important distinction. You need to treat a standalone AI system used in hiring differently from an AI feature in a product that already falls under separate safety regulations. The EU is trying to limit regulatory overlap here\u2014that is, situations where a company has to meet similar obligations multiple times, in different procedures and before different authorities. The Council of the EU notes that the new rules are meant to help resolve conflicts between the AI Act and sector-specific regulations, for example in the areas of medical devices, toys, elevators or watercraft.<\/p>