The EU AI Act: Where Do We Stand on Europe’s Artificial Intelligence Law?

Standfirst: Europe wrote the world’s first horizontal AI law. In 2026 it chose to postpone the heart of it. The real contest is about trust.

Where do we stand with Europe’s law on artificial intelligence? The question sounds technical, yet it touches anyone who communicates, sells, hires, or makes decisions with the help of an algorithm. The AI Act, the regulation meant to give Europe a first-mover advantage, changed pace in the summer of 2026, and the way it did so says a great deal about how the continent intends to govern technology.

Five years to build a rule

The journey began in 2021, when the European Commission presented its proposal: the world’s first attempt to regulate AI horizontally and by levels of risk. December 2023 brought the political agreement, after long and hard-fought negotiations among the Commission, Parliament, and Council (the so-called trilogues). In August 2024 the regulation entered into force, with a phased application calendar running to 2028, subject to specific exceptions for certain systems already placed on the market.

The mechanism is gradual by design. February 2025 saw the bans on unacceptable practices take effect, from social scoring to untargeted facial scraping, together with AI literacy obligations. August 2025 was the turn of general-purpose models, governance, and national authorities. The bulk of the obligations on high-risk systems was set for 2 August 2026, and it is around that date that the debate of recent months has centred.

The 2026 postponement

When the deadline arrived, the harmonised technical standards that would have made the rules easier to apply were still missing, and the Commission chose the path of simplification. The result is Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, in force since 27 July 2026 after the political agreement in May and final approval by Parliament and Council.

The postponement is substantial. The obligations for “standalone” high-risk systems under Annex III, those weighing on personnel selection, access to credit, education, and essential services, have moved to 2 December 2027. Systems embedded in already-regulated products, such as machinery and toys under Annex I, have shifted to 2 August 2028.

AI literacy remains an obligation for providers and deployers of AI systems. What changes is the approach: a uniform “sufficient” level for every person is no longer required, while the AI Board (the committee bringing together the national authorities) is tasked with adopting supporting recommendations. Some simplifications designed for SMEs now extend to mid-sized companies as well.

What stands firm

The postponement has a precise perimeter, and several safeguards remain fully operational. This is worth recalling, because the idea has already spread that pushing back the deadlines amounts to a general green light, a belief that departs from reality.

Transparency on AI-generated content, set out in Article 50, applies from 2 August 2026: providers of systems that generate synthetic content must ensure that deepfake audio, images, video, and text are recognisable as artificially generated or manipulated. For systems placed on the market before 2 August 2026 the marking obligation runs from 2 December 2026, while for text content disclosure is required when it is published to inform the public on matters of general interest.

The bans introduced in 2025 and the rules on general-purpose models also remain in force. The underlying direction stays the one set in 2024, and what changes most is the pace at which the rules become operational.

The real stake is trust

This is where the most relevant question for communicators arises: a rule that slips before it even applies puts its own credibility at stake. Europe had built enormous reputational capital on the idea of being the first serious regulator of AI, and postponing for lack of standards raises a legitimate question about how well that narrative holds.

The debate is open and sharp. The Commission defends the choice in the name of competitiveness: by its own estimates, the simplification will save businesses at least 5 billion euros in administrative costs by 2029. On the opposite side, the privacy watchdogs have voiced caution. The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) acknowledged the value of administrative simplification, while warning that some choices risk weakening the protection of rights, particularly on the registration of high-risk systems, the use of sensitive data, and the role of supervisory authorities. Civil society has made its voice heard too: EDRi, the main European network of digital rights associations, challenges a process it sees as too tilted toward listening to industry. Meanwhile the twin package covering data and the GDPR remains under negotiation.

Italy, for its part, has taken a concrete step. Law 132/2025, in force since 10 October 2025, had set the national principles, introduced a specific offence for harmful deepfakes, and delegated the implementing decrees to the Government. That delegation has now been exercised: Legislative Decree No. 179 of 7 October 2026, published in Official Gazette No. 234 of 8 October 2026, has been in force since 23 October 2026. The decree gives the Agency for Digital Italy (AgID) the role of notifying authority and the National Cybersecurity Agency (ACN) market surveillance, while Banca d’Italia, Consob, and IVASS keep oversight of high-risk systems in their respective sectors. Alongside the sanctions regime, the text establishes the regulatory sandbox for companies and startups and strengthens human oversight of decisions affecting employment. The national framework is taking shape as the European one resettles.

The takeaway

So where do we stand? The AI Act exists, is operational, and continues to apply in phases. The most demanding obligations, those on high-risk systems, will become operational between 2027 and 2028. For companies the consequence is concrete: the time gained should be used to build compliance, map the systems in use, and prepare the marking of synthetic content now, bearing in mind the differentiated deadlines for new systems and systems already on the market. The deadline has moved, while the responsibility to comply stays intact.

For communicators, the lesson is broader. The real stake is trust among institutions, businesses, and people, more than any date on the calendar. Rules on AI are worth as much as the consistency with which they are applied.