The EU AI Act in November 2026: What Is in Force, and What Is Not

How to read this guide. This is a general-audience explainer of official EU timelines, current as of November 10, 2026. It is not legal advice and is not a substitute for the text of the AI Act or for counsel. Where the Commission’s AI Act Service Desk and EUR-Lex describe a date, we cite them. National enforcement details can still vary by member state.

By November 2026 it is no longer accurate to talk about the EU AI Act as a law that “has not started yet.” It is also not accurate to say that every rule in the Act already applies. The legislation was always staggered. In 2026 it was also amended.

The European Commission’s AI Act Service Desk timeline is the cleanest official map. It now “takes into account the AI Act amendments introduced by Digital Omnibus on AI,” and it describes a full roll-out of the main application milestones “by 2 August 2028.” EUR-Lex’s official summary of the rules identifies the amending measure as Regulation (EU) 2026/1744. EUR-Lex’s summary records the amendments, including delayed high-risk dates, made by that Digital Omnibus package (EUR-Lex summary).

The dates that have already arrived

These milestones, from the Service Desk and the EUR-Lex summary, were already in the past as of November 2026:

• 1 August 2024. The AI Act entered into force.
• 2 February 2025. General provisions, including definitions and AI-literacy obligations, and the original set of prohibited AI practices, began to apply.
• 2 August 2025. Obligations for providers of general-purpose AI (GPAI) models began to apply. Member states were to designate national competent authorities and adopt rules on penalties. EU-level governance (the AI Board, Scientific Panel, and Advisory Forum) was to be in place.
• 2 August 2026. The Commission describes this as the date when “the majority of rules of the AI Act come into force and enforcement starts for applicable rules.” Transparency rules under Article 50 start to apply. Enforcement concerning GPAI models, prohibitions, transparency, and AI literacy starts at national and EU level. Innovation-support measures also start to apply.

In plainer language: by early August 2026, the Union had moved from “the law exists” to “several core duties can actually be enforced,” including transparency duties for certain AI systems and the GPAI rules that had already been on the clock for a year.

The Service Desk’s FAQ is explicit that enforcement powers of the AI Office and of member-state authorities start to apply on 2 August 2026 for the provisions that are themselves applicable on that date — and that other provisions become enforceable only when they start to apply (AI Act Service Desk, FAQ).

The date that is about to arrive: 2 December 2026

This article is being published in the second week of November 2026, which makes 2 December 2026 the next official marker, not a historical one.

On that date, according to the Service Desk timeline:

• New prohibitions start to apply for AI systems that generate non-consensual sexual deepfakes and child sexual abuse material. Those prohibitions were added in the Digital Omnibus amendments; they were not part of the original 2024 package in this form.
• Certain providers of AI systems, including GPAI systems, that generate synthetic content and that were already on the market before 2 August 2026 reach the end of a short transition for Article 50(2) marking and detection duties. The Council’s timeline describes that grace period as having been shortened from six months to three, with the deadline set at 2 December 2026.

If you build or deploy generative systems that produce synthetic media for the EU market, this is a near-term compliance date, not a 2027 problem.

What is not in force yet: high-risk rules

This is the part of the 2026 story that is easiest to get wrong.

The original Act had aimed to apply high-risk-system duties earlier. The Digital Omnibus delayed them and fixed new backstop dates, which the Service Desk and EUR-Lex now both state as:

• 2 December 2027 for high-risk AI systems listed in Annex III (stand-alone high-risk systems in areas such as employment and law enforcement, in the Commission’s shorthand).
• 2 August 2028 for high-risk AI embedded in regulated products covered by Annex I (the Commission’s example is products such as medical devices).

The Commission’s FAQ explains the policy reason: standards and other support tools were delayed, so the high-risk timeline was aligned to their availability, with a maximum postponement. Sandboxes also moved: member states should have at least one AI regulatory sandbox operational by 2 August 2027 on the Service Desk timeline (the Council text also discusses a later sandbox date in the negotiation package — if you are a national authority, read the enacted text, not a headline).

For a regular reader, the practical point is simpler. In November 2026, “the AI Act is in force” is true, and “every high-risk duty already applies to every Annex III system” is not.

What this means if you are not an EU lawyer

• If you use a chatbot or image tool as a consumer, the part most likely to touch you in 2026 is transparency: being able to tell, in the cases Article 50 covers, that content is AI-generated or that you are interacting with an AI system. The details are in the Act, not in this summary.
• If you work at a company that provides a general-purpose model, the GPAI rules have been applicable since 2 August 2025, and Commission enforcement powers for the applicable set of rules are described as starting on 2 August 2026.
• If you sell or deploy a system that the Act will eventually classify as high-risk, you have a longer, officially delayed clock — but not an infinite one, and not an excuse to ignore the prohibitions and transparency rules that already apply.
• This is EU law. It can affect non-EU companies that place systems on the EU market or whose output is used in the Union. Whether it applies to a specific U.S. product is a facts-and-counsel question.

For the U.S. side of the same year, see our map of federal and state AI laws. For the court fights over training data, see copyright and AI cases in 2026.