AI rules changed a lot in 2026, and the dates keep moving. The European Union delayed part of its AI Act, Colorado replaced its AI law before it took effect, and the US federal government has been pushing against state AI laws. If you only use AI tools rather than build them, it is hard to tell which of these changes touch you.
This article gives a dated summary of what the sources we read say, and then turns it into practical questions for tool users. It covers the EU, the US and, briefly, where to look next. It is general information, not legal advice. Ask a qualified lawyer about your own situation.
Key takeaways
- The EU Digital Omnibus on AI was published on 24 July 2026 and entered into force on 27 July 2026, according to one law firm summary. It moved the main high-risk AI deadline from 2 August 2026 to 2 December 2027.
- EU transparency duties, such as telling people they are talking to an AI and labelling deepfakes, were reported as not delayed and apply from 2 August 2026.
- Colorado signed a replacement AI law on 14 May 2026. It takes effect on 1 January 2027 and focuses on notice to consumers when AI is used in consequential decisions.
- A December 2025 US executive order directed the creation of a DOJ task force to challenge state AI laws, but it cannot itself overturn them.
- For most tool users the practical job is the same in every region: know which AI tools you use, what they decide, and what you tell people about it.
Summary
Three themes run through the 2026 news. First, deadlines slipped. The EU pushed back its rules for high-risk AI systems, and Colorado pushed its law back and then rewrote it. Second, transparency survived. Duties to tell people when AI is involved were reported as staying on schedule in the EU, and Colorado’s rewritten law is built around notice. Third, the US picture is contested, with a federal executive order, a court case and state laws pulling in different directions.
We have tried to report only what the sources state, with dates. Where a source was a law firm summary of a proposal rather than a final text, we say so. We did not read the legal texts themselves, so treat the table dates as pointers to check, not as final answers.
Timeline of 2026 changes
The table below lists dated events found in the sources we opened. The right column names where the date comes from.
| Date | Event | Source type |
|---|---|---|
| 1 January 2026 | California SB 53 (Transparency in Frontier AI Act), Texas TRAIGA and Illinois HB 3773 listed as taking effect | Law firm summary, February 2026 |
| March 2026 | Colorado governor’s AI Policy Work Group published a proposed framework to narrow the Colorado AI Act, add a cure period and move the date to 1 January 2027 | Law firm summary, May 2026 |
| 9 April 2026 | xAI sued in federal court to block the Colorado AI Act | Law firm summary, May 2026 |
| 27 April 2026 | Court order staying enforcement of the original Colorado law | Law firm summaries |
| 6 May 2026 | Provisional political agreement on the EU Digital Omnibus on AI | Law firm alert, 27 May 2026 |
| 14 May 2026 | Colorado SB 26-189 signed, replacing the original law | Law firm summary |
| 24 July 2026 | EU Digital Omnibus on AI published in the Official Journal | Law firm article |
| 27 July 2026 | Digital Omnibus on AI entered into force | Law firm article |
| 2 August 2026 | EU transparency obligations apply, per the sources | Law firm alert and article |
| 2 December 2026 | Two new EU prohibitions apply, and a grace period for some machine-readable marking duties ends | Law firm alert and article |
| 1 January 2027 | Colorado’s replacement law takes effect | Law firm summary |
| 2 December 2027 | New date for stand-alone high-risk AI systems in the EU | Law firm alert and article |
| 2 August 2028 | New date for high-risk AI built into regulated products in the EU | Law firm alert and article |
The EU AI Act after the omnibus
What was delayed
The AI Act entered into force on 1 August 2024, according to the Gibson Dunn alert we read. Its rules were meant to phase in over several years. A package known as the Digital Omnibus on AI changed some of that timetable. According to a K&L Gates article, it was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.
The same article says stand-alone high-risk systems, the Annex III category, move from 2 August 2026 to 2 December 2027. High-risk AI embedded in regulated products such as medical devices, machinery and toys moves to 2 August 2028. The Gibson Dunn alert, written in May while the deal was still being finalised, gave the same two dates.
What was not delayed
The K&L Gates article says transparency obligations were not delayed. From 2 August 2026 it lists disclosure that a person is interacting with an AI system, labelling of deepfakes and certain AI-generated content, and notification for emotion recognition and biometric categorisation. It also says a four-month grace period applies to some machine-readable marking requirements for generative AI systems that were already on the market before 2 August 2026. Gibson Dunn dates that grace period to 2 December 2026.
Rules for general-purpose AI models, which apply to the companies that build large models, were described as continuing on their original timetable. Gibson Dunn says those obligations applied from 2 August 2025.
New prohibitions and enforcement powers
Both sources describe two new banned practices: AI systems that generate or manipulate realistic intimate imagery without consent, and systems that generate child sexual abuse material. They apply from 2 December 2026. The K&L Gates article also says the EU AI Office can impose periodic penalty payments of up to 5 percent of average daily turnover for continuing infringements. Gibson Dunn also says the AI literacy duty in Article 4 was to be softened. We did not find enough detail to say how.
Why this matters if you are not in the EU
The sources describe the EU rules in terms of systems placed on the EU market or used in the EU. We did not verify exactly how the Act reaches non-EU businesses, so ask a lawyer if you sell into Europe. A practical point is that transparency labelling will show up in the products you use, whatever your own location.
US states
Colorado
Colorado’s original AI Act (SB 24-205) was due to take effect on 30 June 2026 after an earlier delay. According to a law firm summary dated 1 May 2026, xAI sued on 9 April, the US Department of Justice later intervened, and on 27 April a magistrate judge approved a joint request to stay enforcement. The Attorney General’s office said it would not adopt rules or enforce the Act until the legislative session and any rulemaking were complete.
A McDermott summary says the legislature then passed SB 26-189, signed on 14 May 2026, which repeals and re-enacts the law. It is effective 1 January 2027. In that summary:
- Consumers must be told when AI or automated decision-making technology is used in a consequential decision.
- Impact assessments and disclosures to the Attorney General are eliminated, and the algorithmic discrimination obligation is removed.
- Deployers must provide notice at the point of interaction, a plain-language explanation within 30 days of an adverse outcome, data correction and human review.
- Developers that materially influence such decisions must give deployers technical documentation.
- A 60-day notice-and-cure period applies before enforcement and sunsets three years after the effective date.
The same summary says xAI and the Department of Justice were expected to challenge the new law too. We did not find a later ruling, so the status could have changed.
California, Texas and Illinois
A February 2026 Baker Botts summary, republished by JD Supra, lists several state laws that took effect on 1 January 2026. They include California SB 53, Texas TRAIGA (HB 149) and Illinois HB 3773, which amends the state Human Rights Act to cover AI in employment decisions. It also lists California SB 942, the AI Transparency Act, for 2 August 2026, with platform provenance labelling from 1 January 2027. We did not check whether those dates have since changed.
| Jurisdiction | Law or action | Date reported | Main idea |
|---|---|---|---|
| EU | AI Act, as changed by the Digital Omnibus on AI | In force 27 July 2026 | Risk-based rules, later dates for high-risk systems, transparency from 2 August 2026 |
| Colorado | SB 26-189 | Effective 1 January 2027 | Notice, explanation and review for consequential AI decisions |
| Illinois | HB 3773 | 1 January 2026 | AI in employment decisions under the Human Rights Act |
| California | SB 53 and SB 942 | 1 January 2026 and 2 August 2026 | Frontier AI transparency, and AI content transparency |
| Texas | TRAIGA (HB 149) | 1 January 2026 | State AI law, details not covered in our sources |
US federal action
The Baker Botts summary says an executive order titled “Ensuring a National Policy Framework for Artificial Intelligence” was issued on 11 December 2025. It directed the creation of a DOJ AI Litigation Task Force to challenge state AI laws, plus a Commerce Department evaluation and an FTC policy statement due 11 March 2026. The summary notes that an executive order cannot itself overturn state law, which would take an act of Congress or a court ruling. A separate law firm summary describes the Colorado case as the first time the federal government moved to invalidate a state AI law under that order.
The summary also notes that the TAKE IT DOWN Act, signed on 19 May 2025, gave covered platforms until 19 May 2026 to set up notice-and-removal processes. This matters mainly to platforms, not to ordinary tool users.
Are you a provider or a deployer?
Most AI laws split duties between the company that builds a system and the company that uses it. Colorado’s text uses the words developer and deployer. The EU Act uses provider and deployer. Most readers of this site are deployers: you use someone else’s tool.
- If you buy a chatbot or writing assistant and use it internally, you are likely a deployer, with lighter duties.
- If you put an AI tool in front of customers, transparency labelling may apply to you.
- If an AI tool helps decide who gets hired, a loan, housing or insurance, the stricter rules in several laws are the ones to read first.
- If you fine-tune or rebrand a model and sell it, you may count as a provider. Check with a lawyer.
Our guide on writing an AI use policy for your team is a practical place to record which tools your team uses and for what.
What it means for tool buyers
None of this means you must stop using AI tools. It does mean a few questions are now worth asking vendors, in writing, before you sign.
Questions to put to a vendor
- Does the product label AI-generated content, and can you switch the label on for your own outputs?
- Does the vendor publish documentation you could hand to a regulator or customer about how the tool works?
- If the tool supports decisions about people, what human review does it support?
- Where is data processed, and does the vendor offer EU data residency if you need it?
- How does the vendor tell customers about legal or product changes?
The privacy side of these questions is covered in how to evaluate AI tool vendors on privacy, and how to document AI-assisted decisions helps with the record-keeping that notice-based laws reward.
Keep a simple register
A one-page list of tools, owners, purposes and data types is a sensible first step under any of these regimes. It answers the first question any regulator, customer or auditor is likely to ask.
What to watch next
- Whether Colorado’s replacement law is challenged in court, as the McDermott summary says was expected.
- Whether the DOJ task force brings cases against other state laws.
- The 2 December 2026 EU date for the new prohibitions and the end of the marking grace period.
- How AI Act enforcement unfolds in practice once the AI Office uses its penalty powers.
- Any Congress action on a single national standard. We found no statute in our sources.
Frequently asked questions
Does the EU AI Act apply to me if I only use ChatGPT-style tools?
Possibly, but the duties for users of general tools are lighter than for builders or high-risk uses. Transparency duties, such as labelling deepfakes, are the most likely to touch ordinary users. Check with a lawyer for your case.
Was the EU AI Act cancelled?
No. Based on the sources we read, some dates moved and a few rules were added or softened. The transparency duties and general-purpose model rules were described as staying on their timetable.
Is the Colorado AI Act in force?
The original law was replaced by SB 26-189 on 14 May 2026. The replacement takes effect on 1 January 2027, according to a law firm summary. We did not find a later ruling on the legal challenge.
Can a US executive order cancel state AI laws?
Not by itself. The summary we read says that would take an act of Congress or a court ruling. The order directed a DOJ task force to challenge state laws in court.
What should a small business do first?
List the AI tools in use, note what each one does and what data goes in, and check vendor terms. Then decide who reviews decisions that affect people.
Is this legal advice?
No. It is a summary of public sources as of 11 November 2026, and laws and dates change.
Conclusion
The 2026 story is delay, rewriting and legal conflict, with transparency as the steady thread. For tool users the sensible response is practical, not panicked: know your tools, ask vendors good questions, and keep notes. Start with how to protect company data when using AI tools and what to look for if your AI tool trains on your data, and read AI copyright basics for creators if you publish AI-assisted work. This is general information, not legal advice.
Sources
- Gibson Dunn, EU AI Act Omnibus Agreement, 27 May 2026, accessed 11 November 2026
- National Law Review (K&L Gates), EU Digital Omnibus on AI enters into force, accessed 11 November 2026
- Privacy World (Squire Patton Boggs), The Colorado AI Act hits a wall, May 2026, accessed 11 November 2026
- McDermott Will & Schulte, Colorado AI law in flux, accessed 11 November 2026
- JD Supra (Baker Botts), US AI law update, 2 February 2026, accessed 11 November 2026
