EU AI Act Tracker 2026/27: Implementation Status and What the Digital Omnibus Changes

The EU AI Act Implementation Tracker summarizes the binding implementation milestones of the AI Regulation (Regulation (EU) 2024/1689) for the years 2026 and 2027. The central anchors: The transparency obligations under Article 50 have applied since 2 August 2026. Generative systems that were already on the market before then must add machine-readable labeling by 2 December 2026. Following the Digital Omnibus, the Annex III high-risk obligations only take effect from 2 December 2027. All information is as of October 2026.

This article is set up as a living document. The AI Regulation is in the middle of its implementation phase. The so-called Digital Omnibus (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026, has been in force since 27 July 2026 and has postponed several deadlines with binding effect. Germany has had its implementing act since the end of July 2026; at that point, Austria had not yet presented a draft. We therefore flag what already applies and what is still open.

Three quick answers for decision-makers

• What is immediately relevant? Art. 50 transparency has applied since 2 August 2026. Generative systems that were already on the market before then must add machine-readable labeling by 2 December 2026. Anyone deploying chatbots, voice agents or generative AI in customer-facing settings is affected, regardless of high-risk status.
• What was postponed? Through the Digital Omnibus, in force since 27 July 2026, Annex III high-risk slips to 2 December 2027 and Annex I product safety AI to 2 August 2028. The new dates are binding.
• What was not postponed? Prohibitions (Art. 5) and AI literacy (Art. 4) since 2 February 2025, GPAI obligations since 2 August 2025, the fines regime. The Omnibus has, however, watered down Art. 4 in substance. The postponement is no license to defer AI governance.

The Implementation Tracker: date, obligation, status

The following table maps the central milestones of AI Regulation implementation for the 2026-2028 period. The status reflects the position as of October 2026, after the Digital Omnibus entered into force on 27 July 2026.

What the Digital Omnibus changes and what it does not

The Digital Omnibus is the most important implementation event of the year. The political agreement of 7 May 2026 was followed by formal adoption, and the Omnibus has been in force since 27 July 2026. It postpones the majority of the substantive high-risk obligations:

• Annex III (stand-alone high-risk systems), for example AI in HR (CV screening, performance evaluation), creditworthiness assessment, insurance pricing, education, critical infrastructure: from 2 August 2026 to 2 December 2027.
• Annex I (AI as a safety component of regulated products), for example medical devices, machinery, elevators: from 2 August 2027 to 2 August 2028. In addition, the Omnibus narrows the definition of "safety component".
• AI regulatory sandboxes: national authorities must establish these by 2 August 2027 (postponed from 2 August 2026).

Equally important is what the Omnibus does not postpone: the dates of application of Art. 5 (prohibitions) and Art. 4 (AI literacy), the GPAI obligations (Art. 51-55), Art. 50 transparency from 2 August 2026 and the fines regime. It did change some substance, though. Art. 4 now only requires measures to support AI literacy, no longer a specific level. Under Art. 50(2), generative systems that were on the market before 2 August 2026 get a transitional period until 2 December 2026; new systems must label from market entry. Leading law firms consistently warn against reading the postponement as an invitation to pause AI governance. Newly added are prohibitions on AI systems for generating non-consensual intimate content and AI-generated child sexual abuse material ("nudification apps"). They apply from 2 December 2026.

Art. 50: the transparency obligations in detail

For most DACH companies, and in particular for marketing agencies, Art. 50 is the operationally most relevant deadline in 2026, because it takes effect regardless of high-risk status. The Regulation sets out four obligations:

In practical terms this means: Anyone operating a chatbot or voice agent must ensure AI disclosure (the "obvious from the context" exception is interpreted narrowly: a human-sounding voice must disclose itself). Anyone serving generative content needs machine-readable labeling. For deepfake-style product or influencer videos, the deployer disclosure applies in full.

GPAI obligations: already live

The obligations for general-purpose AI models (Art. 51-55) have applied since 2 August 2025 and concern the model layer underneath practically every agent stack. Key dates: The GPAI fines (Art. 101, up to EUR 15 million or 3 percent) have been enforceable since 2 August 2026; the Omnibus did not postpone this date. Legacy models placed on the market before 2 August 2025 (such as GPT-4 class) have until 2 August 2027 to become fully compliant (Art. 111(3)).

The distinction between GPAI and GPAI-with-systemic-risk is based on compute: from 10 to the power of 25 FLOP of cumulative training effort, systemic risk is presumed (Art. 51(2)). Providers that sign the GPAI Code of Practice (published on 10 July 2025) can rely on it to demonstrate compliance with their obligations (Art. 53(4), Art. 55(2)). This does not create a statutory presumption of compliance. The Commission does, however, take the commitments made in the code into account when setting fines (Art. 101(1)).

A concrete practical example: voice agent in customer service

A DACH mid-sized company is planning a voice agent for its inbound service hotline for June 2027. Which deadlines are binding?

• Art. 50(1) since 2 August 2026: The agent must identify itself as AI at the start of the conversation. At go-live in June 2027, disclosure is mandatory from day one.
• Art. 4 since 2 February 2025: The company must take measures to support the AI literacy of the staff entrusted with the system. A documented training program is the best evidence. Art. 99 sets no fine tier of its own for Art. 4; whether a breach is penalized is up to the Member States (Art. 99(1)).
• Co-determination under national labor law: Before deployment, the works council must be involved (Germany: Section 87(1) no. 6 BetrVG; Austria: Sections 96 and 96a ArbVG). This typically adds 3-6 months to the rollout timeline. Art. 26(7) of the AI Act additionally requires informing workers' representatives and affected workers once the system qualifies as high-risk.
• High-risk assessment: As long as the agent performs pure triage/routing and makes no decisions about access to essential services, it remains outside Annex III. If it accesses HR or credit data, it can tip into Annex III(4) or III(5). In that case the full high-risk regime would apply from 2 December 2027.

The bottleneck is therefore co-determination, not the high-risk date in December 2027: for a go-live in June 2027, it must start by the end of 2026 at the latest. The Art. 50 disclosure obligation has applied since August 2026 anyway.

National implementation in DACH (as of October 2026)

• Germany: The AI Market Surveillance and Innovation Promotion Act (KI-MIG) entered into force on 29 July 2026. Since then, the Federal Network Agency (BNetzA) has been the market surveillance authority, central contact point and complaints body for the AI Regulation. In fully harmonized product areas, the established authorities remain competent, for example BaFin in the financial sector.
• Austria: At the end of July 2026, according to ORF, there was still no government bill for an implementing law and no designated market surveillance authority under Art. 70; the Federal Chancellery pointed to ongoing talks. The AI Service Center (KI-Servicestelle) at RTR has so far been advisory. The FMA provides sectoral support for the financial sector.
• Switzerland: No direct AI Act fine; FINMA (Guidance 08/2024) and Swissmedic remain sectorally competent. Since 1 April 2025, cyberattacks on critical infrastructure must be reported to the National Cyber Security Centre (NCSC, in German Bundesamt für Cybersicherheit, BACS). An implementing law for the Council of Europe AI Convention is due to go into consultation by the end of 2026. Under Art. 2(1)(c), Swiss companies whose AI outputs are used in the EU are covered.

Note: This editorial assessment does not replace legal advice. As of October 2026, the main open points are the Commission's final high-risk guidelines and Austria's implementation. Check both before any decision, at least once a quarter.

For agencies and B2B: operationalize compliance now

For marketing agencies, the most immediate obligation moves forward: Anyone building chatbots, voice agents or generative campaign assets for clients has shared the transparency responsibility since 2 August 2026. The 2 December 2026 date for machine-readable labeling only applies to generative systems that were already on the market before August 2026; new systems must label from market entry. In the white-label model, the "rebranding" trap of Art. 25 can trigger the full provider role. For B2B decision-makers, the rule is: the postponed high-risk deadlines are no reason to sound the all-clear, but a planning window. At Blck Alpaca, we support DACH companies in inventorying their agent estate, mapping deadlines per system, and setting up transparency, labeling and co-determination processes in good time. Talk to us for a structured compliance check before the 2027 high-risk deadlines apply.