EU AI Act timeline after the Omnibus: BSI and EU dates

“BSI” points to two different organizations in EU AI Act work. BSI Group (the British Standards Institution) publishes an AI Act timeline and offers AI conformity assessment. Germany’s BSI (Bundesamt für Sicherheit in der Informationstechnik) has a defined role under Germany’s AI Act implementation law. Neither sets the dates. The dates are in the AI Act, as amended in July 2026 by Regulation (EU) 2026/1744. This page gives the dates from the Commission’s AI Act Service Desk and EUR-Lex, then what each BSI says.

The amending act

Regulation (EU) 2026/1744, the Digital Omnibus on AI, is dated 8 July 2026 and was published in the Official Journal on 24 July 2026. It enters into force on the third day following its publication in the Official Journal. The Commission’s Service Desk timeline says The timeline takes into account the AI Act amendments introduced by Digital Omnibus on AI. and that The EU’s AI Act legislation applies progressively, with a full roll-out of the main application milestones foreseen by 2 August 2028.

Planning documents written before July 2026, including some older vendor and certification-body brochures, show 2 August 2026 and 2 August 2027 for the high-risk rules. Those dates no longer apply.

The dates

The Service Desk timeline also marks the point when Enforcement of the AI Act starts at national and EU-level concerning general-purpose AI models, prohibitions, transparency rules and AI literacy.

Two other changes in 2026/1744 affect planning. The AI literacy duty in Article 4 was rewritten so that providers and deployers shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, and This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual. See EU AI Act Article 4: AI literacy. Member States must ensure at least one national AI regulatory sandbox, which shall be operational by 2 August 2027.

Harmonised standards

The first harmonised standard is now cited. On 14 October 2026 the Official Journal published Commission Implementing Decision (EU) 2026/2274, listing EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes. See EN 18286 and the first AI Act harmonised standard.

What BSI Group says

BSI Group’s press release on the Omnibus summarizes the main high-risk change as Original AI Act Timeline: 2 August 2026 New AI Omnibus Timeline: 2 December 2027. It notes transparency rules apply with only limited transitional relief of four months for certain systems already placed on the market before August 2026, and says The AI Omnibus should not be viewed as a rollback of the AI Act. BSI Group also published a one-page AI Act timeline graphic in October 2026; we cite the press release because its text can be checked.

On its own role, BSI Group says BSI are an accredited certification body for biometric AI systems under the EU AI Act. Its client guidance is for AI providers who intend to engage with BSI’s Artificial Intelligence Notified Body for conformity assessments. On EN 18286, its release says BSI is actively working towards obtaining accreditation for EN 18286.

We could not query the EU’s notified-body database on this pass, so we do not state a date or scope for BSI Group’s AI Act notification. Check the Commission’s database before relying on any notified body’s AI Act scope.

What Germany’s BSI does

Germany’s implementation law was published as BGBl. 2026 I Nr. 223 on 28 July 2026. Section 2(1) of the law text begins Die Bundesnetzagentur ist die für die Einhaltung der Verordnung (EU) 2024/1689 zuständige authority, naming the Bundesnetzagentur as the main market surveillance authority. The law says it tritt am Tag nach der Verkündung in Kraft (enters into force the day after promulgation). The Bundesamt für Sicherheit in der Informationstechnik has narrower tasks. For the interim notifying role for high-risk biometric AI systems under Annex III point 1, section 3(2) provides that nimmt das Bundesamt für Sicherheit in der Informationstechnik die in Satz 1 genannte Aufgabe wahr. (the BSI performs that task). The BSI does not publish its own AI Act timeline; the dates above apply in Germany as in every Member State.

Questions

When do the EU AI Act high-risk rules apply? As amended by Regulation (EU) 2026/1744: 2 December 2027 for Annex III systems, and 2 August 2028 for AI in Annex I products.

Did the Omnibus delay the GPAI model rules? No. Chapter V has applied since 2 August 2025. GPAI models already on the market before that date have until 2 August 2027.

Is BSI Group an AI Act notified body? BSI Group’s pages refer to its Artificial Intelligence Notified Body and call it an accredited certification body for biometric AI systems. We could not confirm the notification in the EU database on this pass.

What does Germany’s BSI do under the AI Act? Under Germany’s 2026 implementation law, the Bundesnetzagentur is the main market surveillance authority. The BSI has narrower roles, including interim notifying authority for high-risk biometric AI.