The EU AI Act is the first comprehensive law regulating artificial intelligence, and its timeline changed in 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the main high-risk deadlines. This guide explains what boards need to know now: which obligations already apply, which dates moved and what directors should ask management.

This article is general information, not legal advice.

Why the EU AI Act is a board issue

The Act applies to companies that place AI systems on the EU market or use them in the EU, regardless of where the company is based. Penalties reach up to 35 million euros or 7% of worldwide annual turnover for prohibited practices. As Nasdaq's governance analysis puts it, accountability attaches to the organization and cannot be delegated away. Boards need assurance that AI systems are classified correctly, inventoried and supervised.

The 4 risk tiers in plain language

• Unacceptable risk (prohibited). Practices such as social scoring and certain manipulative or exploitative AI. Banned outright.
• High risk. AI used in areas such as employment, credit, education, critical infrastructure and access to essential services, plus AI in regulated products. Subject to risk management, data governance, documentation, human oversight and registration duties.
• Transparency risk. Chatbots, deepfakes and synthetic content must be disclosed or labeled.
• Minimal risk. Most other AI, with no specific obligations beyond general law.

The EU AI Act timeline after the Digital Omnibus

• 2 February 2025: Prohibited practices banned. AI literacy duty (Article 4) applies.
• 2 August 2025: Obligations for general-purpose AI model providers and governance structures apply.
• 27 July 2026: Digital Omnibus (Regulation (EU) 2026/1744) enters into force.
• 2 August 2026: Article 50 transparency duties apply: disclosure of chatbots, labeling of deepfakes and machine-readable marking of synthetic content.
• 2 December 2027: Obligations for stand-alone high-risk AI systems (Annex III), moved from 2 August 2026.
• 2 August 2028: Obligations for high-risk AI embedded in regulated products (Annex I).

Sources: Lewis Silkin and Jones Walker.

What the Digital Omnibus changed

• More time for high-risk systems. Stand-alone high-risk obligations now apply from December 2027, and product-embedded high-risk obligations from August 2028.
• A softer AI literacy duty. Organizations must take measures supporting AI literacy among staff rather than guarantee a sufficient level for each person. Documented training programs remain the expected evidence.
• New prohibitions. AI generating non-consensual intimate imagery and child sexual abuse material is banned.
• Simpler registration for systems self-assessed as not high-risk under Article 6(3).
• Machinery carve-out. AI in products under the Machinery Regulation is removed from direct AI Act high-risk scope.

Why boards should not treat the delay as a pause

The extra time helps only companies that use it. High-risk compliance requires an AI inventory, risk classification, data governance, technical documentation, human oversight design and post-market monitoring. Each takes months to build. Transparency duties already apply, and the prohibitions have been enforceable since February 2025. Boards that wait until late 2027 will compress 2 years of work into a few months.

10 questions boards should ask management about the EU AI Act

1. Do we have a complete inventory of AI systems we build, buy or use in the EU?
2. How have we classified each system, and who signed off on the classification?
3. Are we a provider, a deployer or both for each high-risk system?
4. Have we confirmed that no system falls into a prohibited category?
5. Are our chatbots and synthetic content disclosed and labeled as required since 2 August 2026?
6. What is our roadmap to December 2027 for Annex III systems, and is it funded?
7. How do we document AI literacy measures for staff who operate AI?
8. Which executive owns AI Act compliance, and how often does the board hear from them?
9. How do our general-purpose AI vendors meet their obligations, and what do our contracts require?
10. Has internal audit tested our AI Act controls?

For a broader list, see 25 Questions Every Board Should Ask Management About AI.

Linking EU compliance to global oversight

Many companies use one AI governance program to meet several regimes. The NIST AI Risk Management Framework and ISO/IEC 42001 provide structures that map well to EU requirements. US directors should also review their fiduciary duty for AI oversight, which applies whatever the EU timeline.

The board competence requirement behind compliance

Directors cannot oversee classification decisions or compliance roadmaps without understanding the technology. Building AI fluency across the board is the foundation. The board AI diagnostic assesses whether your board is ready to oversee AI Act compliance, and the AI Native Board curriculum includes regulation as a core module.

Frequently asked questions

Does the EU AI Act apply to US companies?

Yes, when they place AI systems on the EU market or when outputs of their AI systems are used in the EU.

When do high-risk AI obligations apply now?

2 December 2027 for stand-alone high-risk systems listed in Annex III, and 2 August 2028 for high-risk AI embedded in products covered by Annex I legislation.

What are the maximum fines?

Up to 35 million euros or 7% of worldwide annual turnover, whichever is higher, for prohibited practices. Lower tiers apply to other breaches.