Last reviewed: April 9, 2026
Jurisdictions covered: EU
Reading time: 14 minutes
This is a living tracker. We update it monthly as new measures are published.
EU AI Act Implementation Tracker: What’s Delivered, What’s Missing
Count what’s missing. Zero harmonised standards published. Zero notified bodies designated for AI Act conformity assessment. Zero entries in the EU high-risk AI database, because the database does not exist yet. The Art. 6 classification guidelines are overdue since February. The FRIA template mandated by Art. 27(5) has not been published.
The EU AI Act became law in August 2024. Twenty months later, the infrastructure to operationalize it is mostly absent.
This is not an opinion — it is arithmetic. The AI Act requires approximately 50 secondary measures before it becomes fully operational: implementing acts, delegated acts, codes of practice, guidelines, and harmonised standards. Roughly 8 have been delivered. The rest are in progress, delayed, or not started.
The Digital Omnibus proposal — which would push the main August 2026 deadline to December 2027 for Annex III high-risk systems — is the political acknowledgment that the timeline does not work. The European Parliament adopted its position on March 26, 2026. A trilogue agreement is targeted for April 28, 2026.
This tracker monitors every piece of secondary legislation, every guideline, and every national implementation measure. For the full regulation framework, see our Annex III classification guide.
Key Takeaways
- ~8 of ~50 secondary measures published (~16%). The Commission has delivered guidelines and codes of practice but almost no implementing or delegated acts.
- 8 of 27 member states have designated national authorities. The deadline was August 2, 2025. Nineteen member states are non-compliant.
- Zero notified bodies designated for AI Act conformity assessment. Biometric AI systems requiring third-party assessment cannot complete the process.
- Zero harmonised standards cited in the Official Journal. prEN 18286 failed its vote. CEN-CENELEC has 48 standards in development but none near completion.
- The Digital Omnibus would push Annex III deadlines to December 2, 2027. Trilogue agreement targeted April 28, 2026. Parliament added: watermarking deadline November 2, 2026, and a ban on non-consensual AI intimate imagery.
What Has Been Delivered
Eight instruments are published and operational:
| # | Instrument | Date | Article | Status |
|---|---|---|---|---|
| 1 | Guidelines on prohibited AI practices | Feb 2025 | Art. 5 | Published. Covers all 8 prohibitions. |
| 2 | Guidelines on AI system definition | Feb 2025 (updated Jul 2025 as C(2025) 5053) | Art. 3(1) | Published. Defines what counts as an “AI system.” |
| 3 | GPAI Code of Practice | 10 Jul 2025 | Art. 55-56 | Published. Voluntary compliance pathway for GPAI providers. 24 signatories including Amazon, Anthropic, Google, Microsoft, OpenAI. |
| 4 | Commission GPAI Guidelines | 18 Jul 2025 | Art. 51-53 | Published. Model classification, obligations scope. |
| 5 | GPAI training data summary template | Jul 2025 | Art. 53(1)(d) | Published within the Code of Practice. |
| 6 | Guidelines on GPAI obligation scope | Jul 2025 | Art. 51-53 | Published alongside GPAI Guidelines. |
| 7 | Art. 50 Code of Practice (2nd draft) | 3 Mar 2026 | Art. 50 | In progress — 2nd draft published, final expected May-Jun 2026. |
| 8 | AI Pact (voluntary commitment) | 2024 | Pre-regulatory | 170+ companies signed; non-binding. |
The pattern: the Commission prioritized GPAI measures (enforceable August 2025) and prohibition guidelines (enforceable February 2025). The high-risk infrastructure — which is what most companies need — remains almost entirely unbuilt.
The Digital Omnibus: Will the Deadline Move?
Almost certainly yes. The trilogue is moving fast.
Timeline:
- November 19, 2025: Commission publishes proposal
- March 13, 2026: Council agrees negotiating position
- March 26, 2026: European Parliament adopts position (IMCO/LIBE committees)
- April 28, 2026: Second trilogue — agreement targeted (Cyprus presidency)
- May-June 2026: Plenary vote (if trilogue succeeds)
- Q3 2026: Entry into force (estimated)
What it changes:
- Annex III standalone high-risk AI: deadline pushes from August 2, 2026 to December 2, 2027
- Annex I embedded product AI: pushes from August 2, 2027 to August 2, 2028
- Conditional trigger: high-risk rules apply only after Commission confirms compliance tools are available
- SME relief: “small mid-caps” (<750 employees,
Parliament additions (March 26, 2026):
- Watermarking deadline: November 2, 2026 (earlier than Commission’s proposal)
- Ban on non-consensual AI intimate imagery added to Art. 5 prohibitions
- Reinstate AI system registration requirement
- Restore “strict necessity” for processing sensitive personal data
Our view: Plan for August 2026 but expect December 2027. The trilogue is targeting April 28 agreement — well before August. But even if adopted, the Omnibus delays enforcement, not the obligations themselves. Building compliance systems now is still the right move regardless of the timeline.
What This Means for Compliance Teams
The implementation gap creates a specific compliance environment:
1. You must comply with the law, not the infrastructure. The absence of guidelines, standards, and notified bodies does not suspend your obligations. If you operate high-risk AI systems after August 2, 2026 (or December 2027 if the Omnibus passes), you must meet Arts. 9-15 requirements. How you demonstrate compliance without harmonised standards is your problem — document your approach in your technical file.
2. The Digital Omnibus buys time, not certainty. Even if Annex III deadlines shift to December 2027, the obligations remain the same. Companies that wait 16 months to start will face the same compliance requirements compressed into less time. Start now.
3. Monitor this page. We update this tracker monthly. The implementation picture changes faster than any single article can capture. When new guidelines are published, when standards progress, when the Omnibus is formally adopted — this is where we log it.
4. The China comparison is instructive. While the EU has published 8 of 50 required measures, China has issued 7 binding AI regulations with active enforcement (796 filed services, 13,421 accounts penalized in February 2026). This is not a quality judgment — it reflects fundamentally different regulatory philosophies. But for dual-market companies, it means China compliance is the operational reality while EU compliance remains partly theoretical.
For related guidance, see our penalties breakdown article.
Sources
Official Sources
- EU AI Act — Regulation (EU) 2024/1689 — Last accessed April 9, 2026
- European Commission — AI Act Implementation Page — Last accessed April 9, 2026
- GPAI Code of Practice, July 10, 2025
- Art. 50 Code of Practice — 2nd Draft, March 3, 2026
- CEN-CENELEC JTC 21 Work Programme
- NANDO Database — Notified Bodies
- European Parliament — Digital Omnibus Position, March 26, 2026
Analysis & Commentary
- Lewis Silkin — Digital Omnibus Trilogue Analysis, April 1, 2026 — Parliament position details
- EP Think Tank — AI Act Enforcement Status, March 18, 2026
- IAPP — Art. 6 Guidelines Delay Analysis, February 2026
- artificialintelligenceact.eu — Standards Overview
Data Sources
- Secondary measures scorecard: ~8 of ~50 published. Source: cross-reference of Commission implementation page + implementing acts tracker.
- National authority designations: 8 of 27 confirmed. Source: aiacto.eu (March 25, 2026) + EP Think Tank.
- Harmonised standards: 0 of 10 areas cited in OJEU. Source: CEN-CENELEC + artificialintelligenceact.eu/ai-act-standards.com.
Disclaimer: This content is for informational purposes only and does not constitute legal advice. Organizations should consult qualified legal counsel for compliance planning. Reg Intel is not a law firm and does not provide legal services.