Revised European Union AI Act: New deadlines and rules

The amendment adjusts the timeline for applying certain rules, introduces new prohibited AI practices, and amends several mechanisms under the EU AI Act. The most significant change for organisations is the extension of the deadlines for certain high-risk AI systems. 

New deadlines for high-risk AI systems 

The rules applying to AI systems classified as high-risk under Annex III will now take effect on 2 December 2027. These systems are used in areas such as biometrics, education, employment and recruitment, access to essential services, critical infrastructure, migration and border control. 

The relevant requirements will apply to AI systems integrated into products covered by EU harmonisation legislation and listed in Annex I from 2 August 2028. 

The extension does not change the regulatory framework applicable to these systems. The requirements relating to risk management, technical documentation, human oversight and conformity assessment remain in place; only the timeline for their implementation has changed. 

The new deadlines provide additional time to prepare the technical standards, guidance and tools needed to support implementation. 

New prohibited AI practices 

The revision introduces new practices under Article 5 of the EU AI Act, which outlines prohibited uses of artificial intelligence in the European Union. 

From 2 December 2026, the rules will cover AI systems designed to generate non-consensual intimate images of individuals, child sexual abuse material and content created using "nudification" applications or services that digitally remove clothing from images. 

However, the regulation provides exceptions for systems which, due to their technical characteristics and safeguards, cannot generate such content. This includes certain moderation and classification tools. 

Changes to transparency rules 

The transparency requirements under Article 50 are not postponed and have applied since 2 August 2026. 

The revision introduces a transitional provision for content-generating systems that were already placed on the market before 2 August 2026. In these cases, providers have until 2 December 2026 to ensure compliance with the requirement to mark content using machine-readable means. 

New deadline for AI regulatory sandboxes 

The timeline for AI regulatory sandboxes has been revised. Member States now have until 2 August 2027 to ensure that at least one operational sandbox is available at a national level. 

These sandboxes enable AI systems to undergo testing in a controlled environment under the supervision of the relevant authorities, thereby facilitating a more consistent and predictable implementation of the AI Act. 

Other changes 

The Digital Omnibus introduces adjustments aimed at simplifying the implementation of the EU AI Act. These include requirements applicable to small and medium-sized enterprises and small mid-cap companies, as well as registration procedures and supervision of certain models and systems. 

The revision also clarifies the interaction between the AI Act and other EU legislation applicable to specific sectors, reducing regulatory overlap and increasing legal certainty. 

New timeline for the EU AI Act 

Following the revision, the timeline now distinguishes more clearly between rules that are already in place and those that will take effect at a later date. 

Prohibited AI practices and AI literacy requirements have been in place since 2 February 2025, while the rules for general-purpose AI models have been in place since 2 August 2025. The transparency requirements under Article 50 have applied since 2 August 2026. 

The new prohibited practices and the transitional rule on marking content generated by systems already placed on the market will apply from 2 December 2026. Regulatory sandboxes must be operational by 2 August 2027. The rules for high-risk systems covered by Annex III will apply from 2 December 2027, while the rules for systems covered by Annex I will apply from 2 August 2028. 

What does this mean for organisations? 

While the revised EU AI Act does give organisations more time to prepare for the requirements applying to high-risk AI systems, it does not suspend the other obligations that are already in force. 

Those that develop, provide or use AI systems should therefore update their compliance timelines, distinguishing between requirements that are already in force, those with revised deadlines, and new prohibited practices. 

In Portugal, the EU AI Act is directly applicable, meaning it does not need to be transposed into national legislation. The revised European framework should therefore be reflected in the preparation and compliance processes of organisations within its scope. 

Overall, the amendment represents a revision of the timeline and certain rules under the European AI framework, while maintaining the objective of ensuring that artificial intelligence is used in a manner that supports safety, fundamental rights and innovation across the European Union. 

Find out more about this topic at https://digital.gov.pt/en/estrategia-digital/regulamentacao/ai-act