AI Act, CRA and NIS2: what the EU now asks of AI products

Key dates

The whole picture on one page. Every date below is fixed in adopted law; the proposals still under negotiation have no dates yet and are covered further down.

AI Act

The AI Act entered into force in August 2024 and is being switched on in stages. The bans and the AI literacy duty have applied since February 2025, the rules for general-purpose models since August 2025, and most of the rest since August 2026. The part everyone was waiting for, the rules for high-risk systems, has just moved.

The AI Omnibus moved the high-risk deadlines

The Commission proposed a package of amendments on 19 November 2025, arguing that the harmonised standards and national authorities were not ready. The co-legislators agreed on 7 May 2026, Parliament approved it on 16 June (423 in favour, 57 against, 174 abstentions), the Council on 29 June, and the Omnibus entered into force on 27 July 2026. What it changes:

• The high-risk rules no longer start in August 2026. They start on 2 December 2027 for stand-alone systems (Annex III: hiring, credit scoring, education, law enforcement and so on) and on2 August 2028 for AI built into regulated products (Annex I: machinery, medical devices, toys, lifts).
• Two new bans, from 2 December 2026: AI generation of non-consensual intimate imagery and of child sexual abuse material (CSAM).
• The SME simplifications now also cover small mid-caps, and the AI literacy duty is lighter.
• Special categories of personal data may be processed to detect and correct bias, but only where strictly necessary.
• The AI Office gets more oversight powers, including over AI embedded in very large online platforms and search engines.
• Machinery leaves the direct scope of the AI Act and is handled through the Machinery Regulation instead.

Breaking the bans remains the most expensive mistake available: fines reach€35 million or 7% of global annual turnover, whichever is higher.

Cybersecurity is written into the law (Art. 15)

High-risk systems must reach an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle. Article 15 is unusually concrete about it and names the attacks you are expected to prevent, detect and respond to:

• data poisoning
• model poisoning
• adversarial examples / model evasion
• confidentiality attacks
• model flaws

In other words, the law describes a red-teaming programme without using the word. A policy document will not satisfy it; only tests on the real system will.

General-purpose AI models

• A model trained with more than 10²⁵ FLOP is presumed to carry “systemic risk”.
• Providers of those models must evaluate them, including adversarial testing, report serious incidents, and secure the model and its infrastructure.
• The AI Office can fine up to 3% of global annual turnover or €15 million, whichever is higher.
• The GPAI Code of Practice is voluntary. Its Safety & Security chapter names four specific systemic risks: CBRN (chemical, biological, radiological, nuclear), loss of control, cyber offense, and harmful manipulation.

Transparency (Art. 50)

The final Code of Practice on marking and labelling AI-generated content is out. It has one section for providers, on machine-readable marking and detection, and one for deployers, on labelling deepfakes and AI-generated text about matters of public interest. The Commission and the AI Board have confirmed that following it is an adequate way to show compliance, which makes it the shortest route to the 2 December 2026 deadline.

Standards

Meeting a harmonised standard gives a “presumption of conformity” with the Act. The first one arrived on 22 July 2026: EN 18286:2026, on quality management systems. The standards on cybersecurity, robustness, bias (prEN 18283) and logging are still being written by the CEN-CENELEC committee JTC 21, one of the reasons the high-risk deadlines slipped.

Cyber Resilience Act

If the AI Act is the law everyone talks about, the CRA is the one that already asks for something this month. It covers any hardware or software “product with digital elements” sold on the EU market, which includes software that contains AI.

Reporting, in force since 11 September 2026

Manufacturers must report actively exploited vulnerabilities and severe incidents through ENISA’sSingle Reporting Platform, which went live the same day. The clock is tight:

• 24 hoursEarly warning
• 72 hoursFull notification
• 14 days / 1 monthFinal report: 14 days after a fix is available (vulnerabilities), or 1 month after the 72-hour notification (severe incidents)

Fines: up to €15 million or 2.5% of global annual turnover, whichever is higher, for breaching the essential requirements. Micro and small enterprises are spared fines for missing the 24-hour deadline, but not the deadline itself. Everything else applies in full from 11 December 2027.

NIS2

NIS2 regulates organisations, not products. It covers “essential” and “important” entities in sectors such as energy, health, digital infrastructure, ICT service management and cloud, and requires risk-management measures, supply-chain security included, and incident reporting within 24 hours, 72 hours and one month.

That is how it reaches AI: an AI system run by an organisation in scope, or supplied to one, becomes part of that organisation’s risk management and of its suppliers’ due diligence. If you sell AI to a hospital or a utility, expect their NIS2 questionnaire before you expect a regulator.

Transposition is late

• The deadline was 17 October 2024.
• The Commission sent formal warnings (“reasoned opinions”) to 19 Member States on 7 May 2025.
• In July 2026 it referred Ireland, Spain, France and the Netherlands to the EU Court of Justice.
• Italy and Belgium have transposed it.

Changes proposed on 20 January 2026

• A new mid-cap category, which the Commission expects to lower compliance costs for about 22,500 companies.
• Clearer rules on which country has jurisdiction.
• Better data collection on ransomware.
• Submarine cables explicitly covered.
• A stronger coordinating role for ENISA.

Still in negotiation

Two proposals will matter for AI security but are not law yet. Worth watching, not yet worth building for.

Cybersecurity Act 2 Negotiating

2026/0011 (COD) · proposed 20 January 2026

• ENISA’s budget grows by more than 75%.
• Certification schemes due within one year, and extended to the cyber posture of whole organisations, not just products.
• A framework to limit “high-risk” third-country suppliers in critical ICT supply chains.
• It is meant to work alongside the upcoming Cloud and AI Development Act.
• Status: Council working-party stage; the supply-chain chapter was under discussion in July 2026; no agreement yet.

Digital Omnibus: data, GDPR and incident reporting Negotiating

2025/0360 (COD) · separate from the AI Omnibus

• GDPR “legitimate interest” as a legal basis for training AI, with an unconditional right to object.
• Simpler cookie consent.
• A single ENISA entry point for incident reporting under NIS2, GDPR, DORA, the Critical Entities Resilience Directive and the eIDAS digital identity rules: one report instead of five.
• Status: the Council vote on its negotiating position, planned for 26 June 2026, was cancelled; Parliament committees received more than 1,750 amendments by 15 July 2026; no deal yet.

Related rules

Three more laws complete the picture, each from a different angle.

Product Liability Directive Upcoming

Directive (EU) 2024/2853 · transposition by 9 December 2026

• Software and AI systems now count as “products”.
• Manufacturers are liable for defects caused by updates, or by an AI system’s continued learning, while it stays under their control.
• The separate AI Liability Directive has been withdrawn: this directive is the route now.

Machinery Regulation Upcoming

Regulation (EU) 2023/1230 · applies from 20 January 2027

After the AI Omnibus, this is the main route for AI inside machinery.

DORA Past

Regulation (EU) 2022/2554 · applies since 17 January 2025

ICT and third-party risk rules for banks, insurers and other financial firms. If you supply AI to them, you are one of those third parties.

What to do now

If you build AI products for the EU market, these are the dates that should already be in your plan:

• NowCRA vulnerability and incident reporting
• NowArt. 50 transparency (2 December 2026 for systems already on the market)
• 02 Dec 2026New AI Act content bans
• 09 Dec 2026Product Liability Directive transposition
• 11 Dec 2027CRA full application
• Dec 2027 / Aug 2028High-risk AI rules

If you do one thing, do the CRA work properly. It is the obligation that is already live, and thanks to Article 12 it is also the cheapest way to meet the AI Act’s cybersecurity requirements. One security programme, two laws covered.

Then test the system the way the AI Act describes: poisoning, evasion, confidentiality attacks. None of that happens in a spreadsheet. It happens in the code, the pipelines and the logs of the product itself, which is exactly where we work: it is what our AI Safety & Red Teaming service is for.