EU AI Act — what changed in 2026

High-risk deadlines pushed back

Annex III use-based high-risk obligations moved from 2 August 2026 to 2 December 2027 — a 16-month deferral. Annex I product-embedded high-risk moved from 2 August 2027 to 2 August 2028. The stated reason is the difficulty of operationalising testing, documentation and third-party assessment, including the absence of harmonised standards.

Two new prohibited practices

Article 5 gains prohibitions on AI systems generating or manipulating non-consensual intimate imagery of identifiable people, and on AI-generated child sexual abuse material. Providers are liable where such generation is the intended purpose or a reasonably foreseeable outcome absent adequate safeguards; deployers only where they use the system intentionally for the prohibited purpose. Applies from 2 December 2026.

New Article 4a — special category data for bias detection

The Act now expressly permits processing special-category data to detect and correct bias, subject to cumulative safeguards: no viable alternative (synthetic or anonymised data first), technical reuse limits, strict access control, no onward transmission, deletion once corrected, and documented justification. This directly addresses the long-standing tension between GDPR Article 9 and fairness testing.

AI literacy softened

Article 4 changes from a duty to "ensure" AI literacy to a duty to "take measures to support the development of" it — a materially less prescriptive standard.

Registration and documentation simplified

Providers who self-assess a system as not high-risk get a lighter registration path, with parts of Annex VIII removed. High-risk registration itself survives intact.

"Safety component" narrowed

Systems used purely for assistance, optimisation, efficiency or quality control fall outside high-risk classification unless failure could endanger health or safety — trimming some over-inclusive classifications.

Stronger duties up the supply chain

Article 25 now requires upstream providers to give downstream providers technical documentation sufficient to assess Article 16 compliance, disclose known limitations and failure modes, and grant targeted technical access for testing. Breach carries fines up to €15M or 3% of worldwide turnover.

AI Office gains direct supervision

The Commission’s AI Office takes exclusive competence over AI systems built on general-purpose models where the model and system share a provider, and over systems integrated into very large online platforms and search engines under the DSA — with power to run pre-market assessments.

People must be told they are interacting with an AI system — unless that is already obvious to a "reasonably well-informed, observant and circumspect" person. This is the chatbot rule.

Audio, image, video and text output must be marked as artificially generated or manipulated in a machine-readable format, effective, interoperable, robust and reliable as far as technically feasible. Does not apply to assistive editing that does not substantially alter the input.

Artificially generated or manipulated image, audio or video resembling real people, places or events must be disclosed as such. Artistic, creative, satirical or fictional works are exempt from the full duty provided the existence of manipulation is disclosed appropriately.

Text published to inform the public on matters of public interest must be disclosed as AI-generated — unless it underwent human editorial review and a person or organisation holds editorial responsibility.

People exposed to these systems must be informed, and the processing must independently satisfy the GDPR.