Update from the book
The state of regulation
AI Act, Italian law, the United States framework: what is already applicable, what arrives when, and what changes for those who use AI at work.
The book explains the risk-tier logic and the test for working out whether a rule applies to you: that part does not age. This page holds the article numbers, the dates and the state of applicability, which is the part that moves with postponements, delegated acts and implementing decrees.
The AI Act timeline
There is only one regulation, but it does not all arrive at once. Each block has its own date: until that date comes, that obligation cannot be enforced against you.
| Date | What starts to apply | At 3 Oct 2026 |
|---|---|---|
| 1 August 2024 | Entry into force of Regulation (EU) 2024/1689 | in force |
| 2 February 2025 | Definitions, the AI literacy obligation (Art. 4) and the prohibitions (Art. 5) | applicable |
| 2 August 2025 | Obligations for general-purpose AI models. European governance, designation of the national authorities, national penalty regimes | applicable |
| 2 August 2026 | The bulk of the regulation: transparency obligations (Art. 50) and measures in support of innovation. Enforcement begins, national and European, on general-purpose AI models, prohibitions, transparency and AI literacy | applicable |
| 2 December 2026 | Prohibition of systems that generate non-consensual intimate sexual content and child sexual abuse material. The transitional deadline of Art. 50(2) expires for systems generating synthetic content already placed on the market before 2 August 2026 | not yet |
| 2 August 2027 | Every Member State must have at least one AI regulatory sandbox in operation | not yet |
| 2 December 2027 | High-risk systems under Annex III: biometrics, critical infrastructure, education, employment, essential services, migration, asylum, borders, justice. It was 2 August 2026; the Omnibus moved it | not yet |
| 2 August 2028 | High-risk embedded in products regulated under Annex I: machinery, lifts, toys. It was 2 August 2027 | not yet |
The timeline takes account of the changes introduced by the digital omnibus on AI, that is Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force since the 27th.
In force, applicable, enforced: these are three different things, and confusing them is the quickest way to misread a deadline.
In force means the text exists and is Union law: the AI Act has been since 1 August 2024. Applicable means that from that day an obligation can be demanded of you. Enforced means there is an authority with the powers to check it and impose penalties.
For two years the three were out of step, which is why you could hear at the same time that the AI Act was in force and that it did not yet concern anyone. Since 2 August 2026 they coincide on prohibitions, transparency, general-purpose AI models and AI literacy.
Article 4, the one that concerns you
This is the article on AI literacy, applicable since 2 February 2025, and it falls on anyone who provides or uses AI systems in the course of a professional activity. The Omnibus rewrote it, and the new wording applies from 27 July 2026.
| Period | What the rule asks for |
|---|---|
| 2 Feb 2025 - 26 Jul 2026 | Ensure a sufficient level of AI literacy among your own staff |
| From 27 July 2026 | Adopt measures aimed at supporting the development of AI literacy among staff. The text adds that the obligation "does not require providers or deployers to ensure a specific level of AI literacy for any person" |
The obligation remains, and it remains on the employer. What changes is what you have to be able to show if someone asks: before, a level reached; now, the measures you have taken so that the level grows. This is a practical reading, not a sentence of the regulation, and it is worth keeping separate from the text.
Alongside the lightening, the Omnibus gives the Commission and the Member States a stronger role in promoting AI literacy: part of the weight shifts from the company to the public institution.
The penalties: two different ceilings
The figure that always circulates on its own is the higher one, and for that reason it often ends up attached to the wrong rule. Article 99 provides for two.
| What is being breached | Rule | Ceiling |
|---|---|---|
| The prohibited practices of Art. 5 | Art. 99(3) | €35 million or 7% of total worldwide annual turnover |
| The obligations of providers (Art. 16), those of deployers (Art. 26), transparency (Art. 50) | Art. 99(4) | €15 million or 3% of total worldwide annual turnover |
In both cases, where the offender is an undertaking the higher of the fixed sum and the percentage applies. The exception is SMEs and startups, for which the lower of the two applies (Art. 99(6)). Since 27 July 2026, as a result of the Omnibus, the lower also applies to small mid-cap enterprises, limited to the ceilings in paragraphs 4 and 5 (Art. 99(6a)). When you find the €35 million quoted in connection with high-risk obligations or transparency, the number is true and the article is a different one.
Italy
The national law is Law No. 132 of 23 September 2025. It entrusts governance to two agencies that already existed: the Agency for Digital Italy (AgID) as notifying authority, the National Cybersecurity Agency (ACN) as market surveillance authority.
The part that matters for anyone who has to apply it is the implementing decrees, and of the two the Council of Ministers approved on 4 August 2026 one has come out.
Legislative Decree No. 160 of 9 September 2026 was published in the Official Gazette, General Series No. 214, of 15 September 2026, and has been in force since 30 September 2026. It covers the use of AI in policing and biometric recognition, and civil and criminal liability: it introduces Article 437-bis of the Criminal Code on the failure to adopt security measures, extends the administrative liability of organisations under Legislative Decree 231/2001 to AI-related offences, and on the civil side presumes the causal link when the obligations of the AI Act have been breached, with a direct action against the insurer.
The second decree is the one that touches most of the people reading this page: national governance, administrative penalties, regulatory sandboxes with a fast track for SMEs and startups. As at 2 October it does not appear to have been published: I went through the contents pages of the Official Gazette, General Series, one by one from 16 September to 2 October, and none of the acts concerns AI. The absence is measured on that perimeter. The delegation in Article 24 of the law expires on 10 October 2026.
Final approval and publication in the Official Gazette remain two distinct steps, and that is why on 14 August this page did not write a date of entry into force. For No. 160, six weeks passed between the two, from 4 August to 15 September. For the other decree, as at 2 October, more than eight have passed.
What has changed
3 October 2026 · revision
Legislative Decree No. 160 has been in force since 30 September. The second decree, the one with governance, penalties and sandboxes, was still not in the Official Gazette as at 2 October: I went through the contents pages of the General Series from 16 September to 2 October and it is not there. The delegation expires on 10 October 2026.
The AI Act calendar has not moved. The next deadline is still 2 December 2026. In the table only the date of the last column changes.
An exception on penalties was missing. For SMEs and startups the lower of the fixed sum and the percentage applies, and since 27 July 2026, with the Omnibus, the same holds for small mid-cap enterprises on the ceilings in paragraphs 4 and 5 of Article 99. I have also corrected a count: for No. 160, six weeks passed between approval and the Official Gazette, where the page said five.
18 September 2026 · revision
The first Italian implementing decree has come out, and it enters into force on 30 September. On 14 August this page wrote that there was no date of entry into force because the text had not been published. Now there is one: Legislative Decree No. 160 of 9 September 2026, in the Official Gazette on 15 September. It covers policing and biometrics, civil and criminal liability. The second decree, the one with governance, penalties and sandboxes, has not come out yet, and the delegation expires on 10 October.
The AI Act calendar has not moved. No deadline falls between 14 August and today: the next one is 2 December 2026, with the ban on non-consensual sexual images and the end of the transitional period of Article 50. The rows of the table are the same; what changes is the day I looked at them.
14 August 2026 · first publication
Since 2 August transparency can be enforced. Anyone who puts an automated assistant in front of a customer, and anyone who publishes generated text, images or audio, has from that day an obligation to inform the recipient with a penalty behind it. The Commission announced on 31 July that from 2 August it would begin applying the rules. For systems that generated synthetic content and were already on the market before that date, the deadline to comply is 2 December 2026.
High-risk has slipped by sixteen months. The Annex III systems - staff selection, school assessment, access to essential services, biometrics - were due to fall under the obligations on 2 August 2026 and now fall under them on 2 December 2027. The obligations are the same: data quality, traceability, documentation, human oversight. If you have a project of this kind you have more time to prepare it, and no reason to wait, because harmonised technical standards arrive slowly and compliance is built beforehand.
The prohibitions go from eight to nine. The Omnibus added one that targets the generation of sexual images of people who have not consented and child sexual abuse material, including the applications that strip someone in a photograph. The other eight have applied since February 2025, this one from 2 December 2026.
The Commission's official timeline →
What is still missing here. The Council of Europe treaty is not on this page, and it is not anywhere else either. The United States, China and the United Kingdom are: the acts in force, with their dates, are in the table "The acts in force, country by country" on librovivoia.it/en/r/countries, alongside the investment programmes.
Keeping them on one page is a choice: an American executive order can be signed and revoked between two updates, and two pages telling the same story diverge at the first revision that touches one and not the other.
Sources
- Regulation (EU) 2024/1689 of 13 June 2024 (AI Act), Articles 4, 5, 16, 26, 50, 99 and 113.
- Regulation (EU) 2026/1744 of 8 July 2026, digital omnibus on AI. EUR-Lex, record of the act consulted on 14 August 2026: published in the Official Journal on 24 July 2026, entered into force on 27 July 2026. Text reread on 3 October 2026 (Art. 1, points 22, 38, 39 and 40).
- European Commission, "AI Act", policy page, last updated 3 August 2026, consulted on 14 August 2026 and reread on 3 October 2026: last update unchanged.
- European Commission, "AI Omnibus enters into force", 27 July 2026, consulted on 14 August 2026.
- European Commission, AI Act Service Desk, AI Act implementation timeline, consulted on 14 August 2026 and again on 3 October 2026: unchanged.
- European Commission, press release of 31 July 2026 on the start of enforcement and the new transparency requirements.
- Law No. 132 of 23 September 2025.
- Presidency of the Council of Ministers, press release No. 185 of 4 August 2026, final approval of the first two legislative decrees aligning Italian law.
- Legislative Decree No. 160 of 9 September 2026, Official Gazette of the Italian Republic, General Series No. 214 of 15 September 2026, editorial code 26G00179. Record of the act reread on 3 October 2026: in force since 30 September 2026.
- Official Gazette of the Italian Republic, General Series, contents pages from No. 215 of 16 September to No. 229 of 2 October 2026, consulted on 3 October 2026.