Insights ·
EU AI Act in November 2026: what applies now and what moved to 2027
If you last looked at the EU AI Act in 2025, the dates you remember are out of date. The Digital Omnibus on AI entered into force on 27 July 2026 and pushed back the heaviest obligations. Some companies read that as permission to stop. It is not: several duties already apply, and the work that takes longest has not changed.
This is the position as of 12 November 2026. It is an engineering summary, and it does not replace legal advice.
What already applies
The regulation has been in force since 1 August 2024 and its obligations arrive in stages.
- Since 2 February 2025: the prohibited practices are banned, and the AI literacy duty applies. The people who operate or use AI systems for you need to understand what they are working with.
- Since 2 August 2025: the obligations for providers of general-purpose AI models, and the governance structure.
- Since August 2026: the transparency rules. People must be told when they are dealing with an AI system, and AI-generated content has to be identifiable as such.
What moved
The obligations for high-risk systems listed in Annex III, which covers uses such as recruitment, credit scoring, education and access to essential services, were due on 2 August 2026. They now apply from 2 December 2027. AI built into products that are already regulated (Annex I) moves to 2 August 2028.
The penalties did not move. They go up to €35 million or 7% of worldwide annual turnover for prohibited practices, and up to €15 million or 3% for most other breaches.
If you operate in Spain
The supervisory authority is AESIA, the Spanish Agency for the Supervision of Artificial Intelligence, based in A Coruña. Spain also has a regulatory sandbox, set up by Royal Decree 817/2023.
The Spanish bill on AI governance lapsed when the Cortes were dissolved in October 2026, so do not plan around it. The EU regulation applies directly in any case. Data protection law runs in parallel: the AEPD published guidance on agentic AI on 18 February 2026, and it is worth reading before you give an agent access to personal data.
If you operate in the UK
The UK has no equivalent of the AI Act and no government AI bill. Two things still matter. The EU regulation reaches UK companies that place AI systems on the EU market, or whose system output is used in the EU. And UK data protection law changed: the Data (Use and Access) Act 2025 replaced the rules on automated decision-making with new Articles 22A to 22D of the UK GDPR, in force since 5 February 2026.
What to do now
The delay bought time to do the documentation properly. It is no reason to skip it, because logging, human oversight and technical documentation are expensive to retrofit once a system is live.
- List every AI use in the company, including tools that teams adopted on their own.
- Classify each use and write down the reasoning. An auditor will ask how you reached the classification.
- Tell people when they are talking to an AI system, and label generated content.
- Train the people who operate these systems, by role.
- For anything that looks like Annex III, design the logs, the human review and the documentation into the system now.