EU AI Regulatory Hub
Verification required. EU claims on this page were compiled on 7 October 2026 from secondary sources and from memory of the legal text. On 10 October 2026 the omnibus regulation and the dates tagged [Verified] below were checked against the Official Journal. Every other claim is tagged [Reported], [Recalled], [Conflict] or [Unverified] as explained on the section home page. Check the primary text on EUR-Lex before relying on any of them. This is not legal advice.
This page maps EU laws, guidance and standards that bear on AI to the wiki's controls.
1. How EU duties stack
| Layer | Instruments | Question it answers |
|---|---|---|
| Horizontal AI law | AI Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744 [Verified] | Is it prohibited, high-risk, transparency-only or minimal? Which role are we in? |
| Data protection | GDPR, ePrivacy, EDPB guidance | Lawful basis, rights, DPIA, transfers, automated decisions |
| Security and resilience | NIS2, DORA (finance), Cyber Resilience Act (products with digital elements) | Cyber risk management and reporting |
| Product and liability | Sector product law (medical devices, machinery and others), Product Liability Directive | Conformity and compensation |
| Data and platform law | Data Act, Digital Services Act | Data access, platform duties |
| Standards | CEN-CENELEC JTC 21 standards; ISO/IEC 42001; NIST AI RMF as a bridge | How to show conformity |
An AI system can fall inside several layers at once. For each topic, apply the strictest duty that applies.
2. AI Act timeline
Rows tagged [Verified] were checked against Regulation (EU) 2026/1744 on 10 October 2026. Verify the others against the Official Journal.
| Date | What | Status |
|---|---|---|
| 1 Aug 2024 | Entry into force | [Recalled] |
| 2 Feb 2025 | Prohibited practices (Art. 5) and AI literacy (Art. 4) apply | [Reported] |
| 2 Aug 2025 | General-purpose AI (GPAI) obligations apply (Arts. 51 to 55); penalties regime due from Member States | [Reported] |
| 2 Aug 2026 | Commission and AI Office enforcement powers over GPAI; national market surveillance enforcement; transparency (Art. 50) application | [Reported] |
| 2 Dec 2026 | Art. 50(2) marking grace ends for generative systems already on the market before 2 Aug 2026; new prohibition on generating non-consensual intimate imagery and CSAM | [Verified] |
| 2 Aug 2027 | Grace period ends for GPAI models placed on the market before 2 Aug 2025 | [Reported] |
| 2 Dec 2027 | High-risk AI, Annex III use cases (previously 2 Aug 2026) | [Verified] |
| 2 Aug 2028 | High-risk AI embedded in Annex I regulated products (previously 2 Aug 2027) | [Verified] |
2.1 Omnibus status
The secondary sources disagreed on whether the omnibus had been adopted. The Official Journal settles it [Verified]:
- The act is Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026, amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI).
- It was published on 24 July 2026 and entered into force on the third day after publication, 27 July 2026.
- Text: Regulation (EU) 2026/1744, retrieved 10 October 2026.
The changes tagged [Verified] below were read from that text. The original Article 113 of Regulation (EU) 2024/1689 could not be read in full, so the dates that the omnibus did not change keep their earlier tags. The wiki's Governance, Standards and Regulation page reports the same regulation number and the same high-risk dates.
2.2 Reported omnibus changes
| Change | Detail | Tag |
|---|---|---|
| High-risk delay | Annex III to 2 Dec 2027; Annex I to 2 Aug 2028 | [Verified] |
| Art. 50(2) marking | Providers of systems that generate synthetic audio, image, video or text and were placed on the market before 2 Aug 2026 have until 2 Dec 2026 to comply with Art. 50(2) (new Art. 111(4)). The general 2 Aug 2026 date for Art. 50 comes from the original Art. 113, which was not read | [Verified] for the grace period; [Reported] for the general date |
| New prohibition | New points (ba) and (bb) of Art. 5(1): AI systems that generate or manipulate intimate images of an identifiable person without consent, or child sexual abuse material. Placing on the market is prohibited only where that is the intended purpose, or a foreseeable outcome that the system lacks reasonable safeguards against (Art. 5(1a)); from 2 Dec 2026 | [Verified] |
| AI literacy (Art. 4) | Art. 4 is replaced. Providers and deployers "shall take measures to support the development of AI literacy" of staff, and the article says this does not require them to guarantee any specific level of literacy for any individual | [Verified] |
| Special category data for bias detection | "Strictly necessary" standard retained | [Reported] |
| Registration | Systems self-assessed as non-high-risk under Art. 6(3) still need EU database registration | [Reported] |
| SME relief | Extended to small mid-caps | [Reported] |
| Machinery and Annex I | Machinery reported as fully exempt; other sectors conditional, pending 2027 implementing acts | [Reported], single source |
3. AI Act core concepts
3.1 Risk tiers
Tagged [Recalled] unless noted.
| Tier | What | Main duties | Wiki controls and templates |
|---|---|---|---|
| Prohibited (Art. 5) | Manipulation, exploitation of vulnerabilities, social scoring, certain biometric and emotion-recognition uses, and others | Do not place on the market or use | AI-CTRL-012, AI-CTRL-011 |
| High-risk (Art. 6, Annex I and III) | Annex III areas: biometrics, critical infrastructure, education, employment, essential services (including credit and insurance), law enforcement, migration, justice and democratic processes [Reported list] | Risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, cybersecurity, QMS, conformity assessment, CE marking, registration, post-market monitoring | AI-CTRL-037, AI-CTRL-011, AI-CTRL-023, AI-CTRL-039, AI-CTRL-038, AI-CTRL-035 |
| Limited / transparency (Art. 50) | Chatbots, synthetic content, deepfakes, emotion recognition or biometric categorisation | Disclose AI interaction, mark synthetic output, label deepfakes | AI-CTRL-039, T06 |
| Minimal | Everything else | Voluntary codes | AI-CTRL-012 |
| GPAI models (Arts. 51 to 55) | Foundation and general-purpose models | Documentation, copyright policy, training-content summary; more for systemic-risk models | T12 |
3.2 Roles
The roles are provider, deployer, importer, distributor, authorised representative and product manufacturer [Recalled]. A deployer or distributor can become a provider by putting its name on a high-risk system, making a substantial modification, or changing the intended purpose to a high-risk one (Art. 25). The role decides the duties, so classify first with T01.
3.3 Obligation map for high-risk systems
Article numbers are [Recalled].
| Article | Topic | Applies to | Wiki control | Template |
|---|---|---|---|---|
| 9 | Risk management system | Provider | AI-CTRL-037 | T01, T02 |
| 10 | Data and data governance (including bias examination) | Provider | AI-CTRL-013, AI-CTRL-041 | T10 |
| 11 and Annex IV | Technical documentation | Provider | AI-CTRL-038 | T10 |
| 12 | Record-keeping and logs | Provider | AI-CTRL-008, AI-CTRL-038 | T10 |
| 13 | Transparency and instructions for deployers | Provider | AI-CTRL-039 | T10 |
| 14 | Human oversight | Provider (design), deployer (use) | AI-CTRL-023, AI-CTRL-025 | T10, role guides |
| 15 | Accuracy, robustness, cybersecurity | Provider | AI-CTRL-005, AI-CTRL-034, AI-CTRL-039 | T10 |
| 16, 17 | Provider obligations, quality management system | Provider | AI-CTRL-012 | T10 |
| 25 | Value chain responsibilities | All | AI-CTRL-014 | T03 |
| 26 | Deployer obligations (use per instructions, oversight, input data, monitoring, log retention, inform workers) | Deployer | AI-CTRL-023, AI-CTRL-038 | T02, T08 |
| 27 | Fundamental rights impact assessment | Certain deployers (public bodies and some private entities, for example for credit scoring and life or health insurance) | AI-CTRL-037, AI-CTRL-042 | T02 |
| 43, 47, 48 | Conformity assessment, declaration of conformity, CE marking | Provider | AI-CTRL-038 | T10 |
| 49 | Registration in the EU database | Provider (and some deployers) | AI-CTRL-011 | T10 |
| 72 | Post-market monitoring | Provider | AI-CTRL-035 | T05 |
| 73 | Serious incident reporting | Provider | AI-CTRL-035 | T05 |
| 86 | Right to explanation of an individual decision | Affected person | AI-CTRL-041 | T06 |
3.4 Penalties
The figures are [Recalled]. One secondary source repeats the high-risk figure.
| Breach | Maximum |
|---|---|
| Prohibited practices | EUR 35M or 7% of worldwide turnover, whichever is higher |
| Most other obligations, including high-risk and GPAI | EUR 15M or 3% |
| Incorrect information to authorities | EUR 7.5M or 1% |
For SMEs the lower of the two figures applies [Recalled]. Verify.
4. Register of related EU instruments
| # | Instrument | Relevance to AI | Key points | Wiki controls and templates | Tag |
|---|---|---|---|---|---|
| E1 | AI Act | Core | See sections 2 and 3 | Whole library | [Reported], [Recalled] |
| E2 | GDPR | Any personal data in training, prompts or outputs | Lawful basis, purpose limitation, minimisation, rights, Art. 22 automated decisions, DPIA (Art. 35), transfers (Ch. V), breach notice within 72 hours (Art. 33), fines up to EUR 20M or 4% | AI-CTRL-013, AI-CTRL-007, AI-CTRL-017, AI-CTRL-035 | [Recalled] |
| E3 | EDPB guidance on AI models and personal data | How to treat models trained on personal data; legitimate interest tests | Opinion 28/2024 exists | AI-CTRL-013 | [Recalled]; confirm title and content |
| E4 | Digital Omnibus on data (GDPR changes) | Would allow legitimate interest for AI training, redefine pseudonymised data and add Art. 9(2)(k) | Early stage as of Sept 2026; adoption not expected before 2027 | AI-CTRL-013 | [Reported], single source |
| E5 | NIS2 Directive | Cyber risk management and reporting for essential and important entities | Early warning in 24 hours, notification in 72 hours, final report in one month | AI-CTRL-005, AI-CTRL-035 | [Recalled] timings; transposition varies by Member State |
| E6 | DORA | Financial sector ICT risk, incident reporting, third-party risk | Applicable since Jan 2025; ICT third-party register | AI-CTRL-014, AI-CTRL-035 | [Reported] date |
| E7 | Cyber Resilience Act | Products with digital elements, including software with AI | Vulnerability reporting from 11 Sept 2026; full application 11 Dec 2027 | AI-CTRL-005, AI-CTRL-008 | [Reported], single source |
| E8 | Product Liability Directive (new) | Software and AI as products; defect liability | Transposition deadline not confirmed | AI-CTRL-037 | [Unverified] |
| E9 | Data Act | Access to and portability of connected-product data; cloud switching | Application from Sept 2025 | AI-CTRL-007, AI-CTRL-014 | [Recalled]; verify |
| E10 | Digital Services Act | Platforms, recommender systems, systemic risks | Risk assessment for very large platforms | AI-CTRL-039 | [Recalled] |
| E11 | Copyright Directive text-and-data-mining opt-out | Training data | Rights holders can reserve their rights; a GPAI copyright policy is needed | AI-CTRL-029 | [Recalled] |
| E12 | Commission guidelines: prohibited practices | Interpret Art. 5 | Published Feb 2025 | AI-CTRL-012 | [Recalled] |
| E13 | Commission guidelines: GPAI | Scope and obligations of GPAI providers | Published 10 July 2025 | T12 | [Reported] |
| E14 | Commission draft guidelines: high-risk classification (Art. 6) | Classification and the Art. 6(3) filter | Draft released 19 May 2026; consultation closed 23 July 2026; not final | T01 | [Reported] |
| E15 | GPAI Code of Practice (July 2025) | Route to show GPAI compliance | Reported signatories: OpenAI, Anthropic, Microsoft, Google, Mistral AI; xAI in part (safety chapter); Meta declined | T12 | [Reported], one source |
| E16 | Code of Practice on marking and labelling AI-generated content | Voluntary route to Art. 50 | Final version published 10 June 2026; multi-layer machine-readable marking; detection; deepfake labels | T06 | [Reported] |
| E17 | Harmonised standards, CEN-CENELEC JTC 21 | Presumption of conformity once cited in the OJ | EN 18286:2026 (QMS) reported approved 12 July 2026, OJ citation pending. Drafts: prEN 18228 (risk management), 18282 (cybersecurity), 18284 (dataset quality), 18229 parts 1 and 2 (trustworthiness: logging, transparency, human oversight) | AI-CTRL-012, AI-CTRL-037, AI-CTRL-005, AI-CTRL-013 | [Reported], single source; verify numbers |
| E18 | ISO/IEC 42001 | AI management system; likely to map to the AI Act QMS, but it is not a harmonised standard | Certification can support evidence | Whole library | [Recalled] |
5. Where the wiki covers this
The topics raised on this page are covered by the following controls, test cases and templates.
| Topic | Covered by |
|---|---|
| Obligations by role (provider or deployer) | T01 sets the role; the Applies to column in section 3.3 lists who each obligation falls on; TC-L03-037 |
| High-risk obligations by article | Section 3.3, with a wiki control and a template for each article |
| Fundamental rights impact assessment | T02; AI-CTRL-042; TC-L03-010, TC-L03-011; TC-L03-034 |
| Fairness, bias and explainability | AI-CTRL-041; TC-L03-008, TC-L03-029; bias testing record GCC T10; TC-L03-031, TC-L03-032 |
| General-purpose AI model obligations | T12; AI-CTRL-014; TC-L03-021 |
| Art. 50 transparency | T06; AI-CTRL-039; TC-L03-003; TC-L03-035 |
| AI literacy | T07; AI-CTRL-012; TC-L02-022; AI-CTRL-044; TC-L03-038 |
| Engagement with the AI Office and national authorities | T11; TC-L02-020, TC-L03-026; AI-CTRL-043; TC-L03-039 |
6. Verification checklist
- [ ] Omnibus regulation number, entry into force and final text
- [ ] Which articles the omnibus amended (4, 6, 10, 49, 50 and others)
- [ ] Annex III list and Annex IV content
- [ ] Penalty ceilings and the SME rule
- [ ] Art. 27 FRIA scope
- [ ] Art. 73 reporting timelines
- [ ] Final Art. 6 guidelines
- [ ] Standards status and OJ citation
- [ ] National competent authority and market surveillance designations, per Member State
- [ ] GDPR article numbers; EDPB Opinion 28/2024
- [ ] NIS2 transposition in your Member States; CRA dates
- [ ] Add the primary URL and retrieval date beside every confirmed row
7. Source note
Secondary sources used: law-firm and vendor notes on the AI Omnibus (Addleshaw Goddard, Usercentrics, VerifyWise, Secure Privacy, Data Protection Report), the Kennedys timeline, a Cloud Security Alliance research note on GPAI enforcement, Jones Day on the marking code, Osborne Clarke on the draft Art. 6 guidelines, Modulos documentation on harmonised standards, Heuking on the data omnibus, and an Advisori note on NIS2, DORA and the CRA. The Advisori note was written before the omnibus, so its AI Act dates were not used. No row above has been verified against a primary source.