The implementation timeline for the European Union's Artificial Intelligence Act (Regulation (EU) 2024/1689) changed this summer. The amending regulation known as the "AI Omnibus" entered into force on 27 July 2026 and postponed the most talked-about item: the start date of the rules for high-risk AI systems.
For Turkish companies that sell products or services on the EU market, generate AI-assisted output for customers in the EU, or have affiliates operating in the EU, this timeline is a direct planning matter. In this article, based on primary sources, we summarize what has changed, what has not, and where preparation can begin.
This article is for general information only and does not replace legal advice. For your own situation, rely on the current text of the legislation and the opinion of your legal counsel.
How did the change come about?
The change was made through Regulation (EU) 2026/1744 of the European Parliament and of the Council, dated 8 July 2026. The text was published in the Official Journal of the European Union on 24 July 2026 and, under its own provisions, entered into force on the third day following publication. According to the Commission, the proposal was part of the digital omnibus package presented on 19 November 2025, and its aim was a targeted simplification of the AI rules while preserving safeguards.
The recitals of the regulation also state the reason for the postponement explicitly: the delay in the standards and tools meant to support the implementation of the high-risk obligations, together with difficulties in setting up national competent authorities, did not justify keeping 2 August 2026, the original application date.
The new timeline: which date covers what?
Reading the Commission's implementation timeline and the amending text together, the picture is as follows:
- 2 February 2025: The general provisions (definitions and AI literacy) and the prohibited practices started to apply.
- 2 August 2025: The rules on general-purpose AI models and the governance structure came into effect.
- 2 August 2026: Most of the rules began to apply and enforcement started; the transparency rules (Article 50) have applied since this date.
- 2 December 2026: The new prohibitions added by the Omnibus take effect. They concern systems that generate or manipulate intimate images of a person without that person's explicit consent, and systems that generate child sexual abuse material. The same date is also the deadline for compliance with Article 50(2) for providers of systems that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026.
- 2 December 2027: The rules for high-risk systems in the areas listed in Annex III begin to apply (the previous date was 2 August 2026).
- 2 August 2028: The rules for high-risk systems under Annex I, that is, systems embedded in products subject to EU harmonization legislation, begin to apply.
In short, it is the high-risk section that has been postponed. The timeline for the prohibitions, the general-purpose model rules and the transparency rules continues to run.
Which use cases count as high risk?
Annex III lists the areas of use that count as high risk. For corporate executives, the most familiar ones are: job-ad targeting, application screening and candidate evaluation in recruitment; systems that influence decisions on promotion, termination of employment contracts, task allocation or performance monitoring; systems that assess the creditworthiness of natural persons or generate credit scores (except financial fraud detection); and risk assessment and pricing for natural persons in life and health insurance. The list also covers other areas such as biometrics, critical infrastructure and education.
On the Annex I side, there is an important detail for the machinery sector. By moving the EU Machinery Regulation (Regulation (EU) 2023/1230) from Section A to Section B of Annex I, the Omnibus switched to a sectoral approach: from now on, the essential AI-related requirements will be reflected in the Machinery Regulation through delegated acts to be adopted by the Commission, and these acts are expected to apply by 2 August 2028 at the latest. Manufacturers that export machinery to the EU will need to follow this process through their own sector legislation.
Why might Turkish companies fall within scope?
The Act's scope provision (Article 2) also covers companies outside the EU. According to the source text, the regulation applies to providers that place AI systems on the market in the EU, regardless of whether they are established in the EU or in a third country. Providers and deployers established in a third country also fall within scope if the output produced by the system is used in the EU. The Omnibus did not change this part of the article.
In addition, providers of high-risk systems established in a third country must, before making their systems available on the EU market, appoint an authorized representative established in the EU by written mandate (Article 22). Whether a given Turkish company is actually within scope depends on its role in relation to the system (provider or deployer), the system's intended purpose and where the output is used. This assessment must be made case by case.
On the penalty side, the maximum administrative fine for prohibited practices is EUR 35 million or 7% of the company's total worldwide annual turnover for the preceding financial year, whichever is higher. The Omnibus also added to the text a requirement to take the interests and economic viability of SMEs and small mid-cap companies (SMCs) into account when penalties are set.
What else changed besides the postponement?
According to the Commission's summary, the Omnibus extends certain SME simplifications to small mid-cap companies, expands the use of regulatory sandboxes and introduces an EU-level sandbox, and reduces the burden of registration in the EU database.
The AI literacy provision (Article 4) was also rewritten. Under the new text, providers and deployers must take measures to develop AI literacy among their staff and among the people who operate systems on their behalf; however, this obligation does not require guaranteeing a specific level of literacy. The Commission has been tasked with publishing practical examples on compliance.
For high-risk systems designed to be used by public authorities, there is a separate transitional provision: the providers and deployers of these systems must comply with the obligations by 2 August 2030.
What can be done to prepare?
The postponement of the timeline does not mean the work itself can be postponed. Based on the dates in the sources, the following steps offer a reasonable starting framework:
- Take inventory. List the AI systems used within your organization and in your products, including supplier tools, and note which of them produce output that is used in the EU.
- Determine your role. For each system, identify whether your organization is a provider, a deployer, an importer or a distributor; obligations vary by role.
- Compare against Annex III and Annex I. Separately flag systems in areas such as recruitment, performance management and credit assessment, as well as software embedded in products sold to the EU.
- Don't miss the near-term dates. The transparency rules have applied since 2 August 2026; for older systems that generate synthetic content, the 2 December 2026 deadline is approaching.
- Make AI literacy ongoing. Use short, role-based training so that your teams' use of AI can be documented.
Conclusion
The AI Omnibus has opened a preparation window running into 2027 and 2028 for high-risk systems, but the prohibitions, transparency rules and general-purpose model rules keep their place in the timeline. For Turkish companies that do business with the EU, this period is an opportunity to complete the system inventory and risk classification at a calm pace.
From Orient Global's perspective, the most effective way to start is to treat compliance not as a separate project but as part of the AI roadmap. If the inventory and role determination are done today, the legal assessment and technical preparation will move much faster in the next phase.
This is also where operational experience pays off. Among Orient Global's consultants is a senior executive with more than 30 years in operations, logistics and supply chain, who has run nationwide warehouse and transport operations and large-scale distribution networks. The AI Act itself allocates responsibilities along the AI value chain, from provider and importer to distributor and deployer, much as a physical supply chain does, and the habits that keep a logistics network under control (full visibility of what comes in from suppliers, clear ownership at every hand-off, and records that stand up to audit) are the same habits this preparation calls for.
#interimmanagement #forwarddeployedengineering