Official-source watchlist
A concise, dated view of the EU AI Act milestones that affect practical governance work in 2026 and beyond. Each point links to the official Commission or EUR-Lex source used for the review.
Timeline baseline ; six-source review
Dates below are a working governance reference. The Commission guidance and the Regulation remain the authoritative sources, and implementation guidance can change.
Active since 2 February 2025
As amended by the Omnibus, providers and deployers must support the development of AI literacy for staff and others operating systems on their behalf. They are not required to guarantee a specific individual attainment level.
Active since 2 August 2025
General-purpose AI model obligations and governance milestones have applied on the Commission timeline since August 2025, with specific duties depending on the actor and model.
Active since 2 August 2026
A transition until 2 December 2026 applies to Article 50(2) for relevant systems marketed before 2 August 2026. Providers must address direct-interaction notices and detectable machine-readable marks for in-scope generated or manipulated content. Deployers have separate labelling duties for specified uses, including deepfakes and certain public-interest text.
Enacted Omnibus timeline
The enacted Omnibus sets 2 December 2027 for Chapter III Sections 1-3, except Article 6(5), for systems classified under Article 6(2) and Annex III. Other provisions and transitional rules have separate dates.
Enacted Omnibus timeline
The enacted Omnibus sets 2 August 2028 for Chapter III Sections 1-3, except Article 6(5), for systems classified under Article 6(1) and Annex I. Check product scope and transitional rules.
Always check the use case
Classification depends on the system, purpose, actor, deployment context, affected people, and applicable sector obligations. A label alone is not an assessment.
From watch item to evidence
The watchlist is useful only when it changes what a team records, reviews, and monitors. These are the practical PALO responses for a working file.
| Watch point | PALO response | Evidence to keep |
|---|---|---|
| AI literacy | Identify people who operate, supervise, procure, or review the system; define role competencies and test practical application after learning. | Role-competence matrix, learning record, competence assessment, observed-practice result, refresh trigger. |
| Article 50 transparency | Separate provider notices and machine-readable marking from deployer labelling, then test each supported modality and transformation path. | Actor/applicability record, notice test, marking and detector result, label record, provenance verification, exception approval. |
| GPAI obligations | Determine provider, downstream-provider and deployer roles; route applicable transparency, copyright, safety and security evidence through the GPAI pack. | Role assessment, technical and downstream information, copyright policy, training-content summary, systemic-risk evaluation, Code or equivalent route. |
| High-risk timeline | Use Risk Tiering early, then preserve the rationale and open questions instead of waiting for a final implementation date. | Classification rationale, affected-person analysis, control plan, source snapshot. |
| Article 27 context | Route public-authority, public-service, credit, and insurance deployment contexts to a contextual FRIA check. | FRIA scope decision, rights impact notes, mitigation and consultation record. |
| Changing guidance | Assign an owner and review trigger so the governance record is revisited when official guidance or the system changes. | Watch log, source links, version, decision log, next review date. |
Classify
Start with purpose, actor, use, and affected people.
Assess
Keep the Article 27 scope decision and rights impact evidence together.
Evidence
Route the work and export a versioned local evidence bundle.
Agents
Extend the assessment to delegated action, authority, and autonomy.
Regulation (EU) 2026/1744: adopted Digital Omnibus on AI, in force from 27 July 2026.
Use the following sources to verify dates and obligations before a governance decision is made.
PALO FRAMEWORK