The EU AI Act in 2026: What Applies Now and What Moved to 2027

By Metridata Editorial Team  ·  Updated October 2026  ·  7 min read  ·  AI Testing & Evaluation

---

When the EU delayed parts of its AI Act, many teams heard “we have more time” and stopped paying attention. That is only half right. The rules for high-risk systems moved back. The transparency rules that touch most chatbots and content tools did not. If your AI product reaches users in the EU, here is what applies now and what does not.

This is a plain-language summary for business owners and product teams, not legal advice. Check your own position with a lawyer who handles EU technology law.

What changed

The Commission proposed the Digital Omnibus on AI in November 2025 because implementation was running behind. According to one 2026 summary, the European Parliament endorsed it on 16 June 2026 and the Council gave final approval on 29 June. The key moves:

• Obligations for stand-alone high-risk systems, such as recruitment, credit scoring and education tools, moved from 2 August 2026 to 2 December 2027.
• Obligations for AI built into regulated products, such as medical devices and machinery, moved to 2 August 2028.
• The Article 50 transparency obligations stayed on 2 August 2026.

What applies now: Article 50

Article 50 is the part most small teams will run into first. In broad terms it requires that people are told when they are interacting with an AI system, and that AI-generated content is marked in a machine-readable way. Providers of generative systems that were already on the market before 2 August 2026 have until 2 December 2026 to meet the marking requirement.

Help is available. The Commission published guidelines on Article 50 on 20 July 2026, and a voluntary code of practice on marking AI-generated content came out on 10 June 2026. Infringements of the transparency rules can carry fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, according to one industry summary. Check the regulation itself for the exact figures that apply to you.

Does it apply to you if you are outside the EU?

Possibly. The Act reaches providers outside the EU when they put a system on the EU market or when the output of their system is used in the EU. A Nairobi startup with customers in Germany, a US chatbot vendor serving French clients and a UK agency building tools for Dutch companies can all be in scope. If you are unsure, ask your lawyer to look at where your users and customers are.

Where testing fits

Testing does not make you compliant on its own, and nobody who tests your system can certify compliance. What it gives you is evidence, which is useful in three places.

Transparency checks now. Does the disclosure that the user is talking to an AI actually appear, in every channel, including WhatsApp and voice? Does your content marking work and survive the way files are exported or shared? These are easy to assume and easy to get wrong.

Accuracy and robustness for later. If your system might fall into a high-risk category, the 2027 and 2028 dates are a runway, not an exemption. Systematic test results, repeatable and dated, are far easier to build over a year than to produce in a rush.

A baseline for change. A saved test set lets you show what the system did before and after a model or prompt change. We describe how to build one in our chatbot testing checklist.

A sensible order of work

List every AI feature you run, including ones built by suppliers. Note which reach EU users. Check each against Article 50 and fix disclosure and marking first, since those dates have arrived or are close. Then decide, with legal advice, whether any system could be high-risk, and if so start a dated test log now. Finally, make retesting part of every release.

Frequently Asked Questions