AI Act: when it comes into effect and what changes

The AI Act, i.e. Regulation (EU) 2024/1689, it is effective August 1, 2024, but its obligations apply to scales set out in Article 113: prohibitions and literacy from 2 February 2025, general purpose models and sanctions from 2 August 2025, transparency and almost everything else from 2 August 2026.

On 8 July 2026 the Digital Omnibus on AI, the Regulation (EU) 2026/1744, effective July 27, 2026. He moved the obligations for high risk systems to 2 December 2027 (Annex III) and to August 2, 2028 (Annex I), and rewrote the literacy obligation. Many guides on the network still report the earlier dates.

For an Italian company the practical question is "Which of these dates is about me?". Here you will find the complete calendar with the article fixing each date, what has changed with the Omnibus and what adds the Italian Law 132/2025.

The AI Act calendar, date by date

Each line refers to the article setting the date. The original dates are in the Article 113 of the AI Act; where the text has been modified, the source is the Digital Omnibus on AI.

For most SMEs there are three lines: literacy since February 2, 2025, transparency since August 2, 2026 (Article 113 of the AI Act) and, for those who use AI in the selection of personnel or in the evaluation of people, on December 2, 2027 set by the Omnibus. The others mainly concern those who develop models or manufacture regulated products.

What Changed the Digital Omnibus on AI, and Since

The Omnibus is the Regulation (EU) 2026/1744 of 8 July 2026, published in the EU Official Journal on 24 July and entered into force on 27 July 2026 (Article 4 of the Omnibus). It does not replace the AI Act: it modifies precise points. The reason for the referral is written in recital 40: technical standards, guidelines and national authorities were not ready, and maintaining on 2 August 2026 for the high risk could have significantly increased implementation costs.

On literacy the change is substantial. Since February 2, 2025, Article 4 called for ensuring a ‘sufficient’ level of expertise for those who use AI on behalf of the company. From 27 July 2026 the text replaced by the Omnibus calls for measures to support the development of those skills, taking into account experience, training and context of use, and specifies that no specific level should be guaranteed for any person. The Commission and the Member States must support the effort, in particular SMEs, and the Commission publishes practical examples of how to fulfil it.

There is a less visible change for machinery manufacturers. The Omnibus removed the old Machinery Directive from Section A of Annex I and added Machinery Regulation (EU) 2023/1230 to Section B: requirements for AI in machinery will come through delegated acts under the Machinery Regulation, which apply by 2 August 2028 (Article 1 and Article 3 of Regulation (EU) 2026/1744).

The rest has not moved: the bans in force since February 2, 2025, the obligations of the models for general purposes since August 2, 2025 and transparency towards those who talk with a chatbot, which remains at August 2, 2026 (Article 113 of the AI Act). The postponement concerns the high risk.

What the Italian law 132/2025 adds

The Act No. 132 of 23 September 2025, published in the Official Gazette on September 25, 2025, has been in force since October 10, 2025. does not produce new obligations for systems and models compared to those of the AI Act (Art. 3, paragraph 5). However, it adds national rules that touch companies closely:

• Authority. AgID is the notifying authority, ACN the market surveillance authority and the single point of contact with the EU; Bank of Italy, CONSOB and IVASS supervise the financial sector, and the Privacy Guarantor maintains its powers (Art. 20).
• Work. The employer informs the worker of the use of AI in the cases and in the manner of Article 1-bis of Legislative Decree 152/1997 (Art. 11).
• Intellectual professions. AI is only used for instrumental and support activities, and the professional informs the client about the systems he uses with clear language (Art. 13).
• Deep fake. The crime of unlawful dissemination of content generated or altered with AI (Article 612-quater of the Criminal Code), punished with imprisonment from one to five years (Art. 26).
• Penalties. The Government is delegated to adopt within twelve months of the entry into force of the Act the decrees giving the authorities of Article 20 the power to apply the sanctions of Article 99 of the AI Act (Art. 24). The status of decrees should be checked on Normattiva.

What an Italian company needs to do, and since

The path depends on the band in which your systems fall, theme of the four levels of risk. The practical discrimination is Annex III: if your use falls there, the obligations start from 2 December 2027 (Article 113 as amended by the Omnibus); otherwise literacy remains and, if AI talks to someone, transparency from August 2, 2026 (Article 50 of the AI Act).

In the right column, most Italian SMEs end up. It doesn't mean "do nothing": it means that the work is light and that the dates to remember are at most two. Then there is a case that the calendar does not say: who participates in tenders or supplies to structured customers it is seen to demand conformity in contract, often before the norm imposes it.

Three examples with the right dates

Professional studio using AI assistants for drafts and summaries. From the AI Act comes Article 4: Literacy measures for those who use the tools, in the lightest version in force since 27 July 2026 (Omnibus). The law 132/2025, art. 13 adds the obligation to tell the customer which AI systems you use, with clear words. The heavy theme remains the GDPR, that is, which documents end up in external tools: see GDPR and AI in the company.

E-commerce with customer assistant active for a year. From August 2, 2026 who chats must know that he speaks with an AI, at the latest at the first interaction and unless it is evident (Article 50(1) and (5)). If the assistant is a third-party product, the obligation to design it so is the supplier's, and you check that the message is visible. If you had it developed and put it into service with your brand, you are the supplier.

Software house selling a candidate scoring module. Here the dates really matter. Staff selection is in Annex III, so obligations from supplier start from 2 December 2027 (Article 113 as amended). Article 111 excludes systems already on the market before that date until the design changes significantly, but for a product with frequent releases it is a window on which it is not advisable to build a plan.

What is best to do now, regardless of the dates

There is a part of work that makes sense regardless of the calendar, because it serves the company before the legislator. It is also the part that, if done now, makes any revision of deadlines irrelevant: the Omnibus has just demonstrated this.

1. Census of the tools actually in use, including those that no one authorized. It is the passage that reveals the true situation.
2. Check active plans the services used: the conditions on the data change a lot between free version and business.
3. Fixing Transparency where AI talks to clients or candidates: it is an obligation since August 2, 2026 (Article 50 of the AI Act).
4. Training those using AI: is the most direct way of respecting Article 4. See how to train the team on AI.
5. Write two policy pages internal with the essential rules, following How to Write a Business Policy on AI.
6. Write down who controls what in processes where AI supports decisions.

Two of these points, transparency and training, are obligations with a date; the others do not. All reduce the real risk, which for an SME manifests itself more often as a lost contract than as a fine, as explained in AI Act sanctions.

How to recognize a guide with outdated dates

The Omnibus is recent and there are still schemes on the net written before. Three signals help to recognize them:

• They indicate the 2 August 2026 as the date of obligations for high risk: for Annex III today is 2 December 2027 (Reg. (EU) 2026/1744).
• They speak of an obligation to ensure a sufficient level Literacy: the new Article 4 calls for support measures, without a level to be guaranteed.
• They don't quote the Regulation (EU) 2026/1744, which amended the AI Act.

The most common errors with AI Act deadlines

• Reading the postponement as a "free everyone". The Omnibus has shifted the high risk, not the prohibitions nor the transparency of Article 50, which remains at 2 August 2026 (Article 113 of the AI Act).
• To think that obligations on models for general purposes relate to those who use them. They are about who develops them and puts them on the market.
• Waiting for the deadline to make the inventory. The inventory costs a few hours and in most cases closes the matter with a soothing outcome.
• Buying compliance packages without having classified. It is the most effective way to pay for fulfillments that do not compete with you.
• Counting on the exemption of systems already in use. For the high risk only applies until the design changes significantly (Article 111(2), as amended): with software that updates you often need a specific opinion.

Three Steps to Figure Out What Dates Affect You

1. Inventory AI systems actually used, including informal habits of collaborators.
2. Classification of each by risk group. If they all come out ‘minimum’, you are covered by Article 4 and, for chatbots, by Article 50.
3. Calendar for high-risk systems only, with 2 December 2027 or 2 August 2028 as reference (Article 113 as amended by the Omnibus) and a real plan behind every date.

Step 2 is the one that solves. The widespread feeling of "having to do something by a date" almost always dissolves as soon as you look at what you really use: those who don't develop systems and don't use AI in high-risk areas don't need a calendar, they need to know what they use. The method is in AI Act: The Business Guide and in How to Assess the Risks of an AI System, the general picture in AI for Companies: Complete Guide.

The date to score depends on what you do with AI

The AI Act comes by degrees, and the Omnibus has stretched just the heaviest degrees: obligations for high risk start from December 2, 2027 and August 2, 2028 (Regulation (EU) 2026/1744). For everyone else, literacy and, if an assistant talks to customers, transparency count.

The practical rule remains this: first rank, then look at the dates. Doing so on the contrary only produces anxiety and unnecessary estimates.

If you want to line up the AI tools you use and figure out which of these dates concerns you, we start with the inventory in a AI consulting for SMEs; for legal opinions the reference remains your consultant.