The Council of the European Union’s timeline for the Artificial Intelligence Act, updated after its June 29, 2026 sign-off, splits the law into dates a buyer can actually use. Most of the Act’s rules reached their general application on August 2, 2026. The high-risk regime did not. The Council records a fixed delay: December 2, 2027 for stand-alone high-risk systems, and August 2, 2028 for high-risk systems embedded in products. The European Commission’s AI Act Service Desk, which says its timeline includes the Digital Omnibus amendments, lists the same two high-risk dates, and a nearer one: December 2, 2026.
This briefing is for a company that buys software, including a company outside the EU whose vendor, customer, or data sits inside it. It is not a determination that your system is high-risk. That is a legal question. The operator question is whether the contract names a date.
What is already on
The Service Desk says transparency rules in Article 50 started to apply on August 2, 2026, along with enforcement for those rules, for prohibitions already in force, for general-purpose AI, and for AI literacy. On December 2, 2026 two further things arrive. New prohibitions cover AI systems that generate non-consensual sexual deepfakes and child sexual abuse material. And providers of certain generative systems that were already on the market before August 2, 2026 hit the end of the transition for the Article 50(2) machine-readable marking duty.
So “the AI Act was delayed” is the wrong sentence in a renewal. The delay the Council adopted is the high-risk application date. Transparency, and the December marking deadline for systems already shipping, were not given that same extra year.
What a vendor will try to collapse
A pitch that says “high-risk is 2027, so we are fine” may be describing Annex III stand-alone systems, the employment, education, credit, and essential-service uses the delay covers. It may also be describing a chatbot, a synthetic image, or a feature inside a suite you already license. Those are not the same article of the regulation. Ask the vendor to name the article, the annex, and the date, in the order form or in a schedule. If they cannot, you do not have a compliance claim. You have a slogan.
A delay of the high-risk chapter is not a delay of the duty to say that a person is talking to a machine.
What to write down this month
List every AI feature you have turned on, or that a vendor turned on inside a product, that a customer or employee in the EU can reach. Next to each one, write whether the output is synthetic, whether a person is told, and whether the vendor’s marking deadline is December 2, 2026 or a later high-risk date. Keep the Council timeline and the Service Desk timeline in the packet. When they disagree with a salesperson, the public timeline wins until counsel says otherwise.
Four dates, in the order a contract will scramble them
Put the dates on one page and refuse a vendor slide that uses only the furthest one.
- August 2, 2026. Article 50 transparency is already in application. The Service Desk groups enforcement for those transparency rules with prohibitions already in force, general-purpose AI, and AI literacy. This date was not the one the Council moved.
- December 2, 2026. New Article 5 prohibitions on non-consensual intimate imagery and on generation of child sexual abuse material. The same day ends the machine-readable marking transition for certain generative systems that were already on the market before August 2, 2026.
- December 2, 2027. Stand-alone Annex III high-risk systems. This is the delay people mean when they say the Act slipped. It is not a delay of the two dates above.
- August 2, 2028. High-risk systems embedded in products under Annex I. Later still, and still not a excuse for a chatbot that never tells a person it is a machine.
Where the Council’s public timeline and the Service Desk disagree, including on sandboxes, prefer the Service Desk wording if it is the one that says it includes the Digital Omnibus. Then ask counsel. Do not let a salesperson pick the source that flatters the demo.
What Gartner posted, and what it does not add
On September 19, Gartner’s account posted that AI literacy requirements under the EU AI Act were “now in effect,” and used the post to point at a webinar. Treat that as Gartner’s claim, made in public, on top of a timeline the Commission had already published. The Service Desk already places AI literacy with the August 2, 2026 package. The post does not create a new legal instrument, and it does not spell out a checklist. This briefing will not invent literacy mechanics the post does not contain. Read the Service Desk timeline for what the Commission has actually dated.
For a buyer, literacy is the awkward middle item. It is not the high-risk chapter that moved to 2027. It is also not a marking pixel on a generated image. It is the question of whether the people who turn the feature on, and the people who are subject to it, have been told enough to use it without pretending the law is still pending. Ask the vendor what they provide — training, a notice, a configuration — and ask your own team who attended. A webinar invitation from an analyst firm is not your record.
A company outside the EU still writes the dates down when a vendor, a customer, or the data sits inside the Union. The contract should name the article, the annex if there is one, and the date. “We will comply with the AI Act” names none of the three.
Sources
- Council of the European Union, Artificial Intelligence Act timeline (high-risk dates recorded after the June 29, 2026 Council decision)
- European Commission, AI Act Service Desk, implementation timeline (includes the Omnibus amendments)
- Regulation (EU) 2024/1689, the Artificial Intelligence Act, EUR-Lex
- Gartner on X, AI literacy requirements “now in effect,” September 19, 2026
Operator pages: What Article 50 asks a buyer and A one-page AI use rule. Earlier briefing: When compliance is the product.