What changed in the AI Act, and when: a dated timeline

1 August 2024 — entry into force

Regulation (EU) 2024/1689 entered into force twenty days after publication in the Official Journal. Nothing became enforceable on that date; it started the clock for every later stage.

• The regulation is binding in all EU member states without national implementation.
• Norway, as an EEA state, is not covered until the regulation is incorporated into the EEA Agreement.
• Source: Regulation (EU) 2024/1689 on EUR-Lex.

2 February 2025 — prohibitions and AI literacy

The prohibitions in Article 5 began to apply, together with the AI literacy duty in Article 4. This is the only stage that reaches every organisation regardless of role or risk class, because the literacy duty applies to anyone who provides or uses AI systems.

• Prohibited: social scoring, manipulative techniques, untargeted scraping for facial recognition databases.
• Prohibited: emotion recognition at work and in education, with narrow exceptions.
• Article 4 requires staff who work with AI to have adequate AI literacy.
• This stage was not changed by the Digital Omnibus.

2 August 2025 — general-purpose AI, governance and penalties

Obligations for providers of general-purpose AI models began to apply, along with the governance structure and the penalty regime. Fines reach up to 35 million euro or 7 per cent of global annual turnover for prohibited practices, whichever is higher.

• Providers of general-purpose AI models must document training data and capabilities.
• Member states had to designate their national competent authorities.
• The penalty framework became applicable.
• Models placed on the market before this date have until 2 August 2027 to comply.

2 August 2026 — transparency duties

The general application date arrived, and with it the transparency obligations in Article 50. People must be told when they are interacting with an AI system, and synthetic audio, image, video and text must be marked as artificially generated.

This is the stage most often misreported after the Digital Omnibus. The high-risk obligations moved; Article 50 did not.

• Chatbots must disclose that the user is talking to a machine.
• AI-generated or manipulated content must be labelled in a machine-readable way.
• Deep fakes must be disclosed as artificially generated.
• These duties applied from 2 August 2026 and were not deferred.

June 2026 — the Digital Omnibus moves the high-risk dates

The European Parliament endorsed the Digital Omnibus on AI on 16 June 2026 and the Council gave final approval on 29 June 2026. The package deferred the high-risk obligations, which had been the single largest compliance burden in the regulation.

• Annex III standalone high-risk systems: deferred to 2 December 2027.
• Annex I high-risk AI embedded in regulated products: deferred to 2 August 2028.
• Article 50 transparency duties: unchanged, applicable from 2 August 2026.
• The February 2025 prohibitions and the August 2025 GPAI rules: unchanged.

Norway — no date yet

None of the above is in force in Norway. The regulation must first be incorporated into the EEA Agreement, and the negotiations on EEA adaptations are unfinished. Nkom has stated an aim for the rules to apply in Norway from August 2026, but no Norwegian act has been adopted and the Government is now working towards a bill in spring 2027.

Treat the EU dates as the planning horizon, not as Norwegian deadlines. Norwegian organisations that supply the EU market are bound by the EU dates regardless of what Norwegian law says.

• The AI Act has not been incorporated into the EEA Agreement.
• A Norwegian act, referred to as KI-loven, has not been adopted.
• A bill is expected to reach the Storting in spring 2027.
• Norwegian suppliers to the EU market follow the EU dates today.