Summarize this article with:
The Digital Omnibus pushed back the AI Act's high-risk rules, not the rest. Here is what already applies to your AI app, and what you must do before 2 December 2026.
If you read that the AI Act was delayed, you only read half of the story.
The Digital Omnibus on AI, in force since 27 July 2026, pushed the AI Act's rules for high-risk systems back to December 2027 and August 2028. Everything else stayed on schedule. AI literacy has applied since February 2025, transparency rules since August 2026, and on 2 December 2026, two more obligations kick in. Fines for the most serious breaches reach €35 million or 7% of worldwide turnover.
This guide is for teams that build products on AI APIs. It covers what already applies to you, what changes in 30 days, and what to start preparing for 2027.
First, what is your role under the AI Act?
The AI Act sets different obligations depending on what you do with AI. Most teams that build on an API play two roles at once: provider of their own AI product, and deployer when they use AI internally.
| Role | Who | Main obligations |
|---|---|---|
| Provider of a general-purpose AI model | OpenAI, Anthropic, Google, Mistral AI and other model makers | Technical documentation, copyright policy, information for the companies building on the model |
| Provider of an AI system | You, if you put an AI product or feature on the market under your name: a chatbot, an AI feature in your SaaS | Transparency built into the product, marking of generated content, high-risk duties if your use case is listed |
| Deployer | You, when you use an AI system in your own business | AI literacy, disclosure of deepfakes and published AI text, high-risk duties as a user |
The AI Act calendar after the Omnibus
| Date | What applies | It concerns you if |
|---|---|---|
| 2 Feb 2025 | Prohibited practices, AI literacy | You build or use any AI system |
| 2 Aug 2025 | Obligations for general-purpose AI models | You train or release a general-purpose model |
| 2 Aug 2026 | Transparency (Article 50), AI Office enforcement and fines for model providers | Your product talks to people or generates content |
| 2 Dec 2026 | Machine-readable marking for products launched before 2 Aug 2026, new bans on intimate deepfakes and child abuse material | Your product generates images, audio, video or text |
| 2 Aug 2027 | Compliance for general-purpose models released before Aug 2025, national regulatory sandboxes | You rely on an older model |
| 2 Dec 2027 | High-risk systems in Annex III | You use AI in hiring, education, credit, insurance or other listed areas |
| 2 Aug 2028 | High-risk systems in Annex I | Your AI is part of a product already regulated, such as a medical device or a toy |
| 2 Aug 2030 | AI systems intended for use by public authorities | You sell to the public sector |
What already applies to your AI app
- AI literacy: the people who build or use AI systems in your company need enough training to use them responsibly. Since the Omnibus, you must show reasonable, documented efforts rather than guarantee a level. Keep a record of who was trained on what.
- No prohibited practices: since February 2025, the AI Act bans manipulative techniques, social scoring, emotion recognition at work or at school, untargeted scraping of facial images and a few other uses. Check that no feature of your product falls into one of them.
- Tell people they are talking to an AI: if your product interacts directly with people, such as a chatbot or a voice agent, users must be informed, unless it is obvious.
- Label deepfakes and published AI text: AI-generated images, audio or video that look real, and AI-generated text published to inform the public, must be disclosed. Our guide on AI Act labelling rules covers the details.
- Ask your model providers for their documentation: providers of general-purpose AI models must give the companies building on them the information they need to meet their own obligations. If you rely on GPT, Claude, Gemini or Mistral, that documentation exists. Ask for it and file it.
2 December 2026: what to do this month
Two obligations start on 2 December 2026.
1. Machine-readable marking for existing products. Since 2 August 2026, AI systems that generate synthetic audio, images, video or text must mark their outputs in a machine-readable, detectable way. Products already on the market before that date had a grace period. It ends on 2 December.
In practice, check whether the models you use already embed a marker, such as C2PA metadata or Google's SynthID watermark, and make sure your own pipeline does not strip it when you resize, compress or re-encode files.
2. New bans on intimate deepfakes and child abuse material. The Omnibus added two practices to the list of prohibited uses: AI systems that generate realistic intimate images of identifiable people without their consent, such as "nudifier" apps, and systems that generate child sexual abuse material. The ban also covers systems where such output is reasonably foreseeable because they lack effective safeguards. If your product generates images or videos of people, review your safeguards now: prompt filtering, output moderation and abuse reporting.
High-risk AI: December 2027 comes faster than it looks
The rules for high-risk systems are delayed, not cancelled. From 2 December 2027, they apply to AI used in the areas listed in Annex III of the AI Act, including:
- hiring and work management, such as CV screening or performance evaluation;
- education, such as admissions, grading or exam monitoring;
- access to essential services, such as credit scoring or life and health insurance pricing;
- biometrics, critical infrastructure, law enforcement, migration and justice.
AI embedded in products already covered by EU safety law, listed in Annex I, follows on 2 August 2028.
If your use case is on the list, the obligations are substantial: risk management, data governance, automatic logging, human oversight, accuracy and robustness, technical documentation and a conformity assessment. Logging and documentation take the longest to put in place, so they are the place to start.
The AI Act is not GDPR
The two texts are often confused. The AI Act regulates how AI systems are built and used, according to their risk. It does not require you to host AI in Europe. GDPR governs personal data, including where it goes and who processes it.
Most teams in Europe need to think about both. If your prompts contain personal data, where the model runs and what the provider keeps still matter. Our guides on the EU AI endpoint and on using OpenAI, Claude and Gemini in Europe without GDPR risk cover that side.
Where Eden AI helps
No API makes you compliant on its own. What Eden AI does is make the controls and the evidence easier to put in place, across every model you use.
- A record of who served each request: every response says which model and which provider handled it, so you can log it.
- Organization-wide policies: in Settings > Compliance, you can require zero data retention and restrict the regions your AI calls run in, for every member and every API key. A request can add a restriction, never remove one.
- No silent rerouting: a model that does not meet your rules is refused with a clear error, rather than replaced by another one without you knowing.
- Provider policies in one place: our provider data policies page lists each provider's contracting country, training policy and retention period.
- Freedom to switch: if a provider's terms change, moving to another model is a change of one string, not a new integration. Many signatories of the EU's General-Purpose AI Code of Practice, including OpenAI, Anthropic, Google, Mistral AI, Amazon and Microsoft, are available through Eden AI.
In this example, the request goes through the EU endpoint, requires zero data retention, and keeps a trace of which model and provider answered:
import datetime, json
from openai import OpenAI
client = OpenAI(api_key="YOUR_EDENAI_API_KEY", base_url="https://api.eu.edenai.run/v3")
response = client.chat.completions.create(
model="gemini-3.8-flash",
messages=[
{"role": "system", "content": "You are an AI assistant. Always make clear that you are an AI."},
{"role": "user", "content": "Can you help me write a reply to a customer complaint?"},
],
extra_body={"routing": {"zero_data_retention": True}},
)
# keep a trace of which model and provider served each request
record = {
"request_id": response.id,
"time": datetime.datetime.now(datetime.timezone.utc).isoformat(),
"model": response.model,
"provider": response.provider,
}
print(json.dumps(record))We ran it on 2 November 2026: the request was served by Vertex AI in the EU, and the assistant introduced itself as an AI. With a model whose retention is not verified, Mistral Medium, the same call was refused with an explicit error instead of being routed elsewhere.
What to keep in mind
- This is not legal advice: the AI Act applies differently depending on your product, your sector and your role. Check your situation with your DPO or legal team.
- Guidance is still coming: the Commission and national authorities keep publishing guidelines, and harmonised standards for high-risk systems are still in progress.
- The fines are real: up to €35 million or 7% of worldwide turnover for prohibited practices, up to €15 million or 3% for most other obligations, including transparency, and up to €7.5 million or 1% for supplying incorrect information. For SMEs, the lower of the two amounts applies.
FAQ
Was the EU AI Act delayed?
Only in part. The Digital Omnibus on AI, in force since 27 July 2026, moved the rules for high-risk systems to 2 December 2027 and 2 August 2028. Prohibited practices, AI literacy, the rules for general-purpose AI models and the transparency obligations were not delayed.
What changes on 2 December 2026?
AI systems that generate synthetic content and were already on the market before 2 August 2026 must mark their outputs in a machine-readable way. On the same date, new bans apply to AI systems that generate non-consensual intimate images of real people or child sexual abuse material.
Does the AI Act apply if I only use an API like OpenAI's?
Yes. The model provider has its own obligations, but you have yours as the provider of your product or as a deployer: transparency towards users, AI literacy, prohibited practices, and high-risk obligations if your use case is listed in Annex III.
What are the fines under the AI Act?
Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs and start-ups, the lower of the two amounts applies.
Does the AI Act require hosting AI in Europe?
No. The AI Act does not impose a hosting location. Where your data is processed is a GDPR question. Eden AI's EU endpoint keeps requests on providers cleared for EU data residency when you need it.
