If you read one headline about the EU AI Act this year, it was probably some variation of “AI Act delayed.” That headline is wrong in a way that matters: it describes a partial change to a schedule, and it obscures obligations that arrived on time and are already enforceable.
Here is the actual state of play as of October 2026, and why it matters for anyone building in this category.
What actually changed
The Digital Omnibus on AI — Regulation (EU) 2026/1744 — was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends the AI Act (Regulation (EU) 2024/1689) rather than replacing it.
Its headline effect was to move two sets of dates:
| Obligation | Applies from | Change |
|---|---|---|
| Transparency (Article 50) | 2 Aug 2026 | Unchanged — already live |
| Marking of synthetic content (Art. 50(2)) for systems on market before 2 Aug 2026 | 2 Dec 2026 | Four-month transition |
| Two new prohibited practices (non-consensual intimate imagery, CSAM generation) | 2 Dec 2026 | Added by the Omnibus |
| Stand-alone high-risk systems (Annex III) | 2 Dec 2027 | Moved from 2 Aug 2026 |
| High-risk AI embedded in regulated products (Annex I) | 2 Aug 2028 | Moved from 2 Aug 2027 |
| National AI regulatory sandboxes operational | 2 Aug 2027 | Unchanged |
The stated reason for the deferral was not that the obligations were softened — it was that the harmonised standards firms need in order to demonstrate conformity were not ready. The obligations themselves, the classification rules, and the penalties are substantially as they were.
What was never delayed
Several regimes were already running and continue to run:
- Prohibited practices and AI literacy have been applicable since 2 February 2025.
- General-purpose AI model obligations have applied since 2 August 2025.
- Enforcement at EU and national level commenced on 2 August 2026 across GPAI, prohibitions, transparency, and AI literacy.
- Everything outside the AI Act. Data protection law, employment law, consumer protection, anti-discrimination, and sectoral supervision all apply today. A deadline in 2027 does not immunise anything.
Penalties under the Act reach up to €15 million or 3% of global annual turnover for the most serious infringements — a figure that has not moved.
Anyone who read “delay” in the spring and stood down a compliance programme missed obligations that arrived exactly on schedule.
Why the demand side keeps compounding
The interesting signal for this market is not any single date. It is the shape of the demand curve underneath the dates.
The compliance calendar is now multi-year and legible. With fixed dates in force — December 2026, 2027, 2028 — organisations can actually plan and budget against them. Multi-year certainty is what converts a regulatory rumour into a funded workstream, and funded workstreams buy services, software, and counsel.
The perimeter keeps widening. Transparency duties now touch consumer-facing AI across the economy, not just the technology sector. Every company shipping an AI feature becomes a potential buyer of AI-legal advice.
Enforcement has started. Regulation changes behaviour differently once penalties are live and authorities are designated. Post-enforcement demand for guidance is always larger than pre-enforcement demand.
The obligations are durable even when dates move. Risk management, documentation, human oversight, logging and conformity assessment were not removed — they were rescheduled. Firms that delayed the underlying work now have less time to do the same amount of it.
That combination — a large addressable set of newly-obligated firms, a fixed and visible deadline sequence, and live enforcement — is about as clean a demand driver as a professional-services category gets.
The naming consequence
Categories like this tend to consolidate onto a small number of names early, while they are still cheap to think about, and then become expensive to enter once the market is crowded.
What buyers in an emerging category are really purchasing is the unambiguous address — the one that needs no spelling, no explanation, and no qualifier. In a field built on trust and precision, that clarity is not a vanity metric. It is the first impression every client, journalist, and counterparty receives.
The regulatory timeline will keep moving. The number of organisations inside the perimeter will not shrink.
Accurate as of 9 October 2026, based on the European Commission’s AI Act implementation timeline and Regulation (EU) 2026/1744. This is general information, not legal advice — verify against the consolidated text before acting.