Has the EU AI Act Passed and What Does It Mean for Your Business?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• The EU AI Act was adopted on 13 June 2024 (Regulation (EU) 2024/1689) and entered into force on 1 August 2024.
• General applicability began on 2 August 2026; some provisions started earlier (prohibited practices from 2 Feb 2025, transparency from 2 Aug 2025).
• The July 2026 Digital Omnibus amendment postponed high - risk deadlines and added new bans, but the core regulation remains in force.
• Compliance obligations vary by risk tier; high - risk AI systems must meet requirements by 2 Dec 2027 (stand - alone) or 2 Aug 2028 (product - embedded).
• Enforcement is handled by national AI Offices and the EU AI Office, with penalties for non - compliance.

Did the EU AI Act actually pass?

Yes - the EU AI Act was formally adopted by the European Parliament and Council on 13 June 2024 and became law as Regulation (EU) 2024/1689. It entered into force on 1 August 2024, making the legislation legally binding.

When did the Act become generally applicable?

The regulation started applying to AI systems placed on the EU market or used in the Union on 2 August 2026. That date marks the point when all providers must adhere to the full set of obligations, unless specific provisions have earlier entry dates.

What are the key implementation milestones?

What does the Digital Omnibus amendment change?

The amendment, published on 24 July 2026 and effective 27 July 2026, does not repeal the AI Act. It mainly postpones high - risk compliance dates and adds new prohibited practices such as nudifier tools and child - sexual - abuse - material generation. The core framework and enforcement mechanisms remain unchanged.

Which obligations apply to my organization today?

• Prohibited practices (Art. 5) are enforceable from 2 Feb 2025. Ensure you are not deploying any AI system that falls under the listed bans.
• AI - literacy duties also start on 2 Feb 2025; provide training for users of high - risk AI.
• Transparency (Art. 50) requires disclosing AI interaction and labelling synthetic content (e.g. deepfakes) from 2 Aug 2026 - separate from GPAI model documentation duties under Art. 53, which started 2 Aug 2025.
• High - risk AI systems still have a compliance window until late 2027/2028, but preparing early is recommended.

How is the Act enforced?

National AI Offices and the EU AI Office monitor compliance. They can issue fines up to €35 million or 7 % of global annual turnover for violating the prohibited - practices list, with lower tiers (€15 million/3 % and €7.5 million/1 %) for other breaches — a stricter maximum than GDPR's 4 % cap. Enforcement actions typically start after the general applicability date, but earlier penalties can be applied for prohibited practices.

What should I do next?

1. Inventory your AI systems - identify any that are placed in the EU market or used by EU customers.
2. Classify risk - determine if any fall under the high - risk category defined in Annex II.
3. Check prohibited practices - verify none of your systems perform activities listed in Art. 5.
4. Prepare documentation - create model - cards, data - governance records, and AI - literacy training plans.
5. Plan for deadlines - schedule compliance work to meet the 2 Dec 2027 and 2 Aug 2028 high - risk deadlines.

Where can I find more detailed guidance?

• Implementation Guidance for the EU AI Act (PDF) - official EU document.
• EU AI Act - Shaping Europe’s digital future - European Commission overview.
• EU AI Act Tracker - what actually applies on 2 Aug 2026 - detailed timeline.

This article reflects the latest publicly available information as of September 2026.