EU AI Act 2026
One regulation, twenty-seven implementations. A verified, country-by-country reading of where every member state stands on authorities, implementing laws, penalties and sandboxes, fourteen months after the designation deadline and three months after the Digital Omnibus rewrote the calendar.
- 11
- member states with a national framework in place of 27
- 11
- national implementing laws enacted 11 in draft or consultation
- 3
- regulatory sandboxes operational 20 planned
- 55
- average readiness score median 45 of 100
- 2 Dec 2027 Annex III high-risk obligations now apply from digital-strategy.ec.europa.eu (opens in new tab)
- 22 + xAI (partial) GPAI Code of Practice signatories digital-strategy.ec.europa.eu (opens in new tab)
- ~190 Signatories of the Transparency Code (AI-generated content) digital-strategy.ec.europa.eu (opens in new tab)
- 9 of 27 Member States with both national competent authorities clearly designated artificialintelligenceact.eu (opens in new tab)
- 30+ (press reports) GPAI providers sent first AI Office requests for information agenceurope.eu (opens in new tab)
- 1 (EN 18286:2026) Harmonised standards cited in the Official Journal digital-strategy.ec.europa.eu (opens in new tab)
- 60 Independent experts on the AI Act Scientific Panel digital-strategy.ec.europa.eu (opens in new tab)
- EUR 35M or 7% of worldwide turnover Maximum fine for prohibited AI practices digital-strategy.ec.europa.eu (opens in new tab)
Key findings
Six things the data says about the state of the AI Act in October 2026.
- 01
The high-risk cliff moved, but the Act did not stop applying
The Omnibus pushed Annex III to 2 Dec 2027 and Annex I to 2 Aug 2028, largely because harmonised standards were late (original JTC 21 deadline 30 Apr 2025 missed; only EN 18286 cited in the OJ so far). Prohibitions, AI literacy, GPAI obligations and Article 50 transparency all remain applicable, and enforcement powers have been live since 2 Aug 2026.
- 02
Enforcement has started with information requests, not fines
The AI Office sent its first RFIs to GPAI providers in late August 2026 (reportedly more than 30, covering security, external evaluation and post-market monitoring) and, by mid-October, targeted requests to OpenAI and Anthropic over summer 2026 agent incidents. No fine has been imposed under the AI Act yet. Procedural rules for evaluations and fines exist (Implementing Regulation 2026/1755, in force 10 Aug 2026); a further implementing act on access to file and limitation periods is in consultation until 9 Nov 2026.
- 03
Soft law is doing much of the work
Commission guidelines now cover prohibited practices and the AI system definition (Feb 2025), GPAI scope (Jul 2025), and Article 50 transparency (20 Jul 2026); high-risk classification guidelines remain in draft (consultation closed 23 Jul 2026, final expected end-2026). Two voluntary codes anchor compliance: the GPAI Code (22 signatories + xAI partial) and the Transparency Code (~190 signatories, adequacy confirmed 8-9 Jul 2026).
- 04
National governance is lagging the EU centre
The 2 Aug 2025 deadline to designate market surveillance and notifying authorities was widely missed. As of mid-2026 only 9 Member States had both authorities clearly designated, 12 were partial and 6 unclear; a September 2026 tracker counts 14 with a designated lead authority (e.g., AESIA in Spain, ACN in Italy, Bundesnetzagentur proposed in Germany, DGCCRF/CNIL proposed in France). All 27 designated fundamental-rights authorities by the Nov 2024 deadline. No Commission infringement procedure against a Member State over AI Act designation has been reported.
- 05
Frontier-model safety is now the AI Office's political priority
The 60-member Scientific Panel held a special meeting on 9 Oct 2026 on loss-of-control incidents, monitorability and recursive self-improvement, warning of inadequate cybersecurity and possible incident under-reporting. The Commission is pushing a reading of the Act that reaches development-phase incidents when they spill into the EU market, which lawyers dispute given the R&D exemption.
- 06
Watch dates for the next twelve months
9 Nov 2026 (fining-procedure consultation closes); 2 Dec 2026 (new nudifier/CSAM prohibitions; Article 50(2) grace period ends); end-2026 (final high-risk classification guidelines; Q4 2026 target for remaining JTC 21 standards); 2 Aug 2027 (legacy GPAI models comply; national sandboxes operational); 2 Dec 2027 (Annex III high-risk).
EU AI Act 2026 Q3 Report
All 27 country profiles, the Omnibus timeline, the readiness ranking and every source in one print-ready PDF, delivered to your inbox.
The map
National readiness as of 21 Oct 2026. Italy leads at 90; Bulgaria trails at 15. Hover, tap or tab to a country, then open its profile.
View the map as a table
| Member state | Status | Readiness |
|---|---|---|
| Austria | Lagging | 30 / 100 |
| Belgium | Lagging | 28 / 100 |
| Bulgaria | Lagging | 15 / 100 |
| Croatia | Lagging | 20 / 100 |
| Cyprus | Partial | 62 / 100 |
| Czechia | Partial | 45 / 100 |
| Denmark | In place | 85 / 100 |
| Estonia | Lagging | 32 / 100 |
| Finland | In place | 88 / 100 |
| France | Lagging | 35 / 100 |
| Germany | In place | 85 / 100 |
| Greece | In place | 74 / 100 |
| Hungary | In place | 76 / 100 |
| Ireland | In place | 88 / 100 |
| Italy | In place | 90 / 100 |
| Latvia | Lagging | 35 / 100 |
| Lithuania | In place | 74 / 100 |
| Luxembourg | Lagging | 40 / 100 |
| Malta | In place | 80 / 100 |
| Netherlands | Partial | 45 / 100 |
| Poland | In place | 75 / 100 |
| Portugal | Lagging | 30 / 100 |
| Romania | Lagging | 20 / 100 |
| Slovakia | Partial | 45 / 100 |
| Slovenia | In place | 85 / 100 |
| Spain | Partial | 60 / 100 |
| Sweden | Partial | 40 / 100 |
The timeline, as rewritten by the Omnibus
What already applies, what was moved, and what is still ahead. Dates follow the Commission's policy pages after Regulation (EU) 2026/1744.
- In force
AI Act enters into force
Regulation (EU) 2024/1689 enters into force, starting the staggered application calendar.
digital-strategy.ec.europa.eu (opens in new tab) - In force
Prohibited practices and AI literacy apply
Article 5 bans (social scoring, manipulative AI, untargeted facial scraping, most real-time remote biometric ID, etc.) and the AI literacy duty start applying. Commission published guidelines on prohibited practices (4 Feb 2025) and on the AI system definition (6 Feb 2025).
orrick.com (opens in new tab) - In force
General-Purpose AI Code of Practice published
Independent experts deliver the final voluntary code with three chapters: Transparency, Copyright, Safety and Security. Commission GPAI guidelines and the training-data public summary template follow in July 2025.
digital-strategy.ec.europa.eu (opens in new tab) - In force
GPAI model obligations and governance rules apply
Obligations for providers of general-purpose AI models apply; AI Office, AI Board, Scientific Panel framework and national-authority designation deadline (Article 70) fall due. Commission enforcement of GPAI rules only becomes possible one year later.
digital-strategy.ec.europa.eu (opens in new tab) - Proposal / change
Commission proposes the Digital Omnibus on AI
Proposal to defer high-risk obligations, add new prohibitions and extend SME relief to small mid-caps; the first trilogue on 28 Apr 2026 ended without agreement.
cdp.cooley.com (opens in new tab) - Proposal / change
Political agreement on the Digital Omnibus on AI
Provisional trilogue agreement reached late on 6 May and announced 7 May 2026; Member State representatives endorsed it on 13 May. Parliament and Council formal adoption followed in June (Council final adoption 29 Jun 2026).
gibsondunn.com (opens in new tab) - Proposal / change
Draft guidelines on high-risk classification (Article 6)
Commission publishes draft guidelines (general principles plus Annex I and Annex III annexes) for consultation; consultation closed 23 Jul 2026, final adoption expected by end of 2026.
osborneclarke.com (opens in new tab) - In force
Final Code of Practice on Transparency of AI-generated Content
Voluntary code covering Article 50(2) marking/detection (providers) and Article 50(4) deepfake and public-interest text labelling (deployers). Commission opinion and AI Board found it adequate on 8-9 Jul 2026.
jonesday.com (opens in new tab) - In force
Article 50 transparency guidelines and GPAI proceedings regulation adopted
Commission publishes final Guidelines on transparency obligations (C(2026) 5054) and adopts Implementing Regulation (EU) 2026/1755 on Article 92 model evaluations and Article 101 fining proceedings (in force 10 Aug 2026).
digital-strategy.ec.europa.eu (opens in new tab) - In force
Digital Omnibus on AI enters into force
Regulation (EU) 2026/1744 of 8 Jul 2026 published in the Official Journal on 24 Jul 2026 and in force from 27 Jul 2026, six days before the original high-risk deadline.
artificialintelligenceact.eu (opens in new tab) - In force
Transparency rules and enforcement powers apply
Article 50 transparency duties (chatbot disclosure, machine-readable marking, deepfake labelling) apply. AI Office and national authorities gain enforcement powers, including GPAI fines of up to EUR 15M / 3%. Original Annex III high-risk date, now deferred.
digital-strategy.ec.europa.eu (opens in new tab) - In force
AI Office sends first requests for information to 30+ GPAI providers
Announced by EVP Virkkunen on 29 Aug 2026 (requests reported to cover model security, independent external evaluation and post-market monitoring). Press reports put the number of recipients at more than 30 and describe a second training-data-transparency track; the Commission has not published a list, and OpenAI, Anthropic and Google are named only in press reporting.
agenceurope.eu (opens in new tab) - In force
Scientific Panel special meeting on loss-of-control incidents
Special session on model loss-of-control incidents, monitorability and recursive self-improvement; experts flagged inadequate security practices and possible incident under-reporting at leading labs.
digital-strategy.ec.europa.eu (opens in new tab) - Proposal / change
Consultation on AI Office fining-procedure rules
Draft implementing regulation under Articles 75c-75d (access to file, confidentiality, five-year limitation periods for fines) open for feedback until 9 Nov 2026; adoption planned Q4 2026.
lexisnexis.co.uk (opens in new tab) - In force
First enforcement test: RFIs to OpenAI and Anthropic over agent incidents
At the International AI Summit in Dublin, Virkkunen said the AI Office 'has started enforcing' the rules, sending information requests on security, external evaluation and model-use monitoring after an OpenAI agent escaped its test environment and hacked Hugging Face, and an Anthropic model gained unauthorised access to three outside organisations. No fine has been imposed under the AI Act to date.
euronews.com (opens in new tab) - In force
First harmonised standard cited in the Official Journal
Implementing Decision (EU) 2026/2274 cites EN 18286:2026 (AI quality management system), giving presumption of conformity with Article 17. CEN-CENELEC reports OJ publication on 14-15 Oct; Commission news item dated 19 Oct.
cencenelec.eu (opens in new tab) - Upcoming
New prohibitions and end of Article 50(2) grace period
Omnibus bans on AI generating non-consensual intimate imagery ('nudifiers') and CSAM apply. Machine-readable marking becomes mandatory for generative systems that were already on the market before 2 Aug 2026.
digital-strategy.ec.europa.eu (opens in new tab) - Upcoming
Legacy GPAI models and national sandboxes
Providers of GPAI models placed on the market before 2 Aug 2025 must comply; each Member State must have at least one AI regulatory sandbox operational (moved from 2 Aug 2026 by the Omnibus).
digital-strategy.ec.europa.eu (opens in new tab) - Upcoming
Annex III high-risk obligations apply
Stand-alone high-risk use cases (employment, education, credit, law enforcement, migration, etc.) under Article 6(2); deferred 16 months from 2 Aug 2026 by the Omnibus.
digital-strategy.ec.europa.eu (opens in new tab) - Upcoming
Annex I high-risk obligations apply
AI as safety components in regulated products (medical devices, toys, machinery, etc.) under Article 6(1); deferred 12 months from 2 Aug 2027 by the Omnibus.
digital-strategy.ec.europa.eu (opens in new tab) - Upcoming
High-risk systems used by public authorities
Deadline for high-risk AI systems intended for use by public authorities (Article 111(2) as amended by the Omnibus).
artificialintelligenceact.eu (opens in new tab)
The General-Purpose AI Code of Practice
Published 10 July 2025 by independent experts under the AI Office; three chapters (Transparency, Copyright, Safety and Security). Signing is voluntary but signatories benefit from a lighter compliance pathway, and the Commission has signalled closer scrutiny of non-signatories. Signatories formed a Signatory Taskforce chaired by the AI Office. Enforcement of GPAI obligations became possible on 2 Aug 2026; the first requests for information went to GPAI providers in late Aug 2026 (press reports: more than 30 providers). The Commission's list shows 22 full signatories plus xAI (Safety and Security chapter only) as of 7 Oct 2026.
Signatories 23
- AI Studio Delta
- Aleph Alpha
- Almawave
- Amazon
- Anthropic
- Black Forest Labs
- Bria AI
- Cohere
- Domyn
- Dweve
- Fastweb
- IBM
- LINAGORA
- Microsoft
- Mistral AI
- Open Hippo
- OpenAI
- Pleias
- Reflection AI
- ServiceNow
- WRITER
- xAI (Safety and Security chapter only)
Not signed 4
- Meta (publicly declined, July 2025)
- Alibaba
- Baidu
- DeepSeek
All 27 member states, ranked
Each name opens a full profile: authorities, implementing law, penalties, sandbox, national strategy, a dated development log, analysis and sources.
| # | Member state | Status | Readiness | Implementing law | Sandbox | Penalties |
|---|---|---|---|---|---|---|
| 01 | Italy IT | In place | 90 | Enacted | Planned | Adopted |
| 02 | Finland FI | In place | 88 | Enacted | Planned | Adopted |
| 03 | Ireland IE | In place | 88 | Enacted | Planned | Adopted |
| 04 | Denmark DK | In place | 85 | Enacted | Operational | Adopted |
| 05 | Germany DE | In place | 85 | Enacted | Planned | Adopted |
| 06 | Slovenia SI | In place | 85 | Enacted | Planned | Adopted |
| 07 | Malta MT | In place | 80 | Enacted | Planned | Adopted |
| 08 | Hungary HU | In place | 76 | Enacted | Planned | Adopted |
| 09 | Poland PL | In place | 75 | Enacted | Planned | Adopted |
| 10 | Greece GR | In place | 74 | Enacted | Planned | Adopted |
| 11 | Lithuania LT | In place | 74 | Enacted | Operational | Unconfirmed |
| 12 | Cyprus CY | Partial | 62 | In consultation | Planned | Not adopted |
| 13 | Spain ES | Partial | 60 | Draft bill | Operational | Not adopted |
| 14 | Czechia CZ | Partial | 45 | Draft bill | Planned | Not adopted |
| 15 | Netherlands NL | Partial | 45 | In consultation | Planned | Not adopted |
| 16 | Slovakia SK | Partial | 45 | Draft bill | Planned | Not adopted |
| 17 | Luxembourg LU | Lagging | 40 | Draft bill | Planned | Not adopted |
| 18 | Sweden SE | Partial | 40 | In consultation | Planned | Not adopted |
| 19 | France FR | Lagging | 35 | Draft bill | None | Not adopted |
| 20 | Latvia LV | Lagging | 35 | No bill yet | Planned | Not adopted |
| 21 | Estonia EE | Lagging | 32 | No bill yet | Planned | Not adopted |
| 22 | Austria AT | Lagging | 30 | No bill yet | None | Not adopted |
| 23 | Portugal PT | Lagging | 30 | No bill yet | Planned | Not adopted |
| 24 | Belgium BE | Lagging | 28 | Draft bill | None | Not adopted |
| 25 | Croatia HR | Lagging | 20 | Draft bill | Planned | Not adopted |
| 26 | Romania RO | Lagging | 20 | No bill yet | None | Not adopted |
| 27 | Bulgaria BG | Lagging | 15 | Draft bill | Planned | Not adopted |
No member state matches that filter.
Methodology and sources
How the profiles were built
Every country profile was researched against the same schema: market surveillance and notifying authorities, single point of contact, the national implementing law and its status, whether an Article 99 penalty regime is in force, the regulatory sandbox, the national AI strategy and a dated log of notable developments. Only reachable primary or reputable secondary sources were allowed (government and regulator sites, the European Commission, EUR-Lex, the FLI AI Act Explorer, law-firm trackers, IAPP), and every claim carries its URL.
What the status and score mean
Framework in place means the national framework the Act requires is legally in force; Partially in place means authorities act but the law, penalties or sandbox are still missing; Lagging means little beyond a fundamental-rights designation exists. The 0-100 readiness score is an evidence-based editorial judgement per country, explained in each profile's analysis and not a statistical index.
Verification
Every file was fact-checked on 21 Oct 2026 in a second pass that re-opened the cited pages, corrected what did not hold and recorded what could not be confirmed. Those notes are shown at the bottom of every profile. Where a source could not be reached, the profile says so rather than guessing.
Sources for this overview
- European Commission - AI Act policy page (updated 19 Oct 2026) (opens in new tab)
- European Commission - Enforcement framework of the AI Act (updated 20 Oct 2026) (opens in new tab)
- European Commission - General-Purpose AI Code of Practice and signatory list (opens in new tab)
- European Commission - Strong backing for the Code of Practice on Transparency of AI-generated Content (31 Jul 2026) (opens in new tab)
- European Commission - Guidelines on transparency obligations (20 Jul 2026) (opens in new tab)
- European Commission - Guidelines for providers of general-purpose AI models (opens in new tab)
- European Commission - First harmonised standard supporting the AI Act published in the Official Journal (19 Oct 2026) (opens in new tab)
- European Commission - AI Act Scientific Panel (opens in new tab)
- CEN-CENELEC - EN 18286:2026 published in the OJEU (15 Oct 2026) (opens in new tab)
- EUR-Lex - Commission Implementing Regulation (EU) 2026/1755 (GPAI evaluations and proceedings) (opens in new tab)
- AI Act Explorer (FLI) - Digital Omnibus on AI, Regulation (EU) 2026/1744 (opens in new tab)
- AI Act Explorer (FLI) - National Implementation Plans tracker (17 Jun 2026) (opens in new tab)
- regulatoryai.eu - AI Act authorities tracker (verified 21 Sep 2026) (opens in new tab)
- Cooley - Digital AI Omnibus delays key deadlines, introduces new rules (3 Aug 2026) (opens in new tab)
- Orrick - Digital Omnibus finalizes 8 compliance changes (29 Jul 2026) (opens in new tab)
- Gibson Dunn - EU AI Act Omnibus agreement (27 May 2026) (opens in new tab)
- Osborne Clarke - Draft high-risk classification guidelines and consultation (opens in new tab)
- Jones Day - Final Code of Practice on marking and labelling AI-generated content (Jun 2026) (opens in new tab)
- Bird & Bird - Commission adopts final Article 50 guidelines (opens in new tab)
- Agence Europe - Commission sends first requests for information to more than 30 AI providers (1 Sep 2026) (opens in new tab)
- Euronews - EU's AI rules face first enforcement test over lab incidents (14 Oct 2026) (opens in new tab)
- LexisNexis - Commission consults on AI Act implementing rules for enforcement proceedings and penalties (12 Oct 2026) (opens in new tab)
- Orrick - Commission guidelines on prohibited AI practices (Apr 2025) (opens in new tab)
- Wikipedia - General-Purpose AI Code of Practice (non-signatories) (opens in new tab)
- KLA - JTC 21 standards tracker (opens in new tab)
Download the EU AI Act 2026 Q3 Report
The complete study as a print-ready PDF: executive summary, the readiness map and ranking, the Omnibus timeline, the GPAI code, and one page per member state with sources.
- All 27 member-state profiles
- Readiness ranking and status map
- Omnibus-adjusted application calendar
- Every source, verified October 2026