The EU AI Act is the only comprehensive AI law among the main markets, and its timeline was reset in July 2026: high-risk rules now apply from 2 December 2027, or 2 August 2028 for AI built into regulated products. Prohibitions and general-purpose AI obligations already apply, and enforcement powers have run since 2 August 2026. In the other markets researched, the operative rules found are data protection rules on automated decisions, such as the UK's 2026 reforms and California's automated decision-making regulations.
The EU AI Act timeline after the AI Omnibus
The AI Act entered into force on 1 August 2024. Prohibited practices and AI literacy duties have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. The AI Omnibus, in force since 27 July 2026, moved the high-risk rules: systems in areas such as biometrics, education and employment from 2 December 2027, and AI integrated into products such as lifts or toys from 2 August 2028. It also added a prohibition on AI that generates non-consensual sexually explicit content.
Enforcement powers apply from 2 August 2026. The AI Office enforces the general-purpose model rules and national authorities the rest. Fines reach EUR 35 million or 7% of worldwide turnover for prohibited practices and EUR 15 million or 3% for most other breaches.123456789
Other markets regulate AI through data law
In the UK, new automated decision-making rules came into force on 5 February 2026 under the Data (Use and Access) Act. In the US, California's state regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect on 1 January 2026 as part of the CCPA framework. Businesses using AI for hiring, credit or customer decisions should treat these as the operative rules outside the EU.1011
| Rule | Applies from | Who is affected | Source |
|---|---|---|---|
| AI Act enters into force | 1 August 2024 | All in-scope operators | European Commission |
| Prohibited practices and AI literacy | 2 February 2025 | Providers and deployers | European Commission |
| General-purpose AI model obligations | 2 August 2025 | GPAI model providers | European Commission |
| Enforcement powers | 2 August 2026 | AI Office and national authorities | European Commission |
| High-risk systems (Annex III) | 2 December 2027 | Providers and deployers in biometrics, education, employment and other listed areas | European Commission |
| High-risk AI in regulated products (Annex I) | 2 August 2028 | Manufacturers of products such as lifts and toys | European Commission |
| UK automated decision-making rules | 5 February 2026 | Controllers under UK GDPR | legislation.gov.uk |
| California ADMT regulations (state) | 1 January 2026 | CCPA-covered businesses | California Privacy Protection Agency |
Decisions to make
- Do any of our AI uses fall into a prohibited practice?28Prohibitions have applied since February 2025 and carry the highest fines.
- Do we use AI in employment, education, biometrics or other Annex III areas?5High-risk obligations apply from 2 December 2027.
- Do we provide or fine-tune a general-purpose AI model?37GPAI obligations apply now and the AI Office can enforce them from 2 August 2026.
- Do we make significant automated decisions about UK or California individuals?1011Data protection rules on automated decisions already apply in both.
Documents usually needed
- Inventory of AI systems and models with risk classification
- AI literacy training records
- Technical documentation and risk assessments for high-risk or GPAI systems
- Data protection impact assessments for automated decision-making
- Supplier due diligence on third-party AI tools
Common mistakes
- Relying on the original 2 August 2026 high-risk date, which the AI Omnibus changed
- Assuming the AI Act only applies to developers, not to deployers
- Ignoring data protection rules on automated decisions outside the EU
- Using third-party AI tools without knowing what the supplier has documented
- Treating AI governance as a one-off review rather than an inventory kept current
Questions businesses ask
When do the high-risk AI rules apply?
After the AI Omnibus, from 2 December 2027 for systems in Annex III areas and from 2 August 2028 for AI integrated into regulated products.564
Who enforces the AI Act?
The AI Office for general-purpose AI models and national authorities for other systems, with powers from 2 August 2026.7
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- AI frameworks in India, Singapore, the UAE and Saudi Arabia (mostly guidance rather than law) could not yet be checked.
- US state AI laws other than California's ADMT regulations, and federal executive action on AI, were not researched.
- The Official Journal text of the AI Omnibus could not yet be checked; dates are from Commission pages.
- Transparency obligations under Article 50 and their dates were not confirmed after the Omnibus.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
The EU AI Act entered into force on 1 August 2024. EU-wide regulation.
The AI Act's prohibited practices and AI literacy obligations have applied since 2 February 2025. EU-wide. The AI Omnibus simplified the company-facing AI literacy requirement.
The AI Act's governance rules and obligations for general-purpose AI models have applied since 2 August 2025. Providers of general-purpose AI models placed on the EU market.
The AI Omnibus amending the AI Act entered into force on 27 July 2026, after political agreement on 7 May 2026. Proposed on 19 November 2025. It adds a prohibition on AI systems that generate non-consensual sexually explicit content, extends SME simplifications to small mid-cap companies and resets high-risk dates. The prohibitions on non-consensual intimate material and child sexual abuse material apply from 2 December 2026.
Prohibition dates for new practices taken from the Commission page on enforcement of the AI Act.
As amended by the AI Omnibus, the AI Act's rules for high-risk AI systems in areas such as biometrics, education and employment apply from 2 December 2027. High-risk systems listed in Annex III.
High-risk rules for AI systems integrated into products such as lifts or toys apply from 2 August 2028. Products covered by EU harmonisation legislation in Annex I, as amended by the AI Omnibus.
Enforcement powers of the AI Office and national authorities under the AI Act apply from 2 August 2026; the AI Office enforces the rules for general-purpose AI model providers and national authorities enforce the rules for other AI systems. EU-wide. The European Data Protection Supervisor enforces the rules for EU institutions.
Fines for prohibited AI practices can reach EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. EU-wide.
Other breaches of the AI Act, including general-purpose AI obligations, can attract fines of up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. EU-wide. Supplying incorrect or misleading information can attract up to EUR 7.5 million or 1%.
Most of the Act's Part 5 data protection and privacy changes came into force on 5 February 2026, including recognised legitimate interests, the new automated decision-making rules, the international transfer changes, the cookie exceptions and the PECR enforcement changes. Brought into force by regulation 2 of SI 2026/82 so far as not already in force; transitional provisions limit some changes for conduct before commencement.
Reused from market guide claim gb-data-002.
California's regulations on cybersecurity audits, risk assessments and automated decision-making technology, together with other CCPA regulation updates, took effect on 1 January 2026. California. Adopted by the California Privacy Protection Agency board on 24 July 2025 and filed with the Secretary of State on 22 September 2025. Some obligations are phased in after 1 January 2026; the phased dates were not confirmed on the page read.
Phased compliance dates for risk assessment submissions, audit certifications and ADMT duties are in the approved regulation text, which could not yet be checked. Reused from market guide claim us-data-004.
Questions on this topic
11 statements on ai regulation
