AI governance, privacy and the EU AI Act timeline

Key takeaways

1The EU's Digital Omnibus on AI, in force since 27 July 2026, moved the main high-risk obligations to 2 December 2027 (stand-alone systems) and 2 August 2028 (systems embedded in regulated products).
2Prohibited practices, AI literacy and general-purpose model obligations already apply, and most transparency duties apply from 2 August 2026.
3NIST's AI Risk Management Framework and ISO/IEC 42001 are the frameworks auditors and customers ask about.

The EU AI Act, as amended

The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. The Digital Omnibus on AI (Regulation (EU) 2026/1744) deferred the high-risk deadlines because harmonised standards and national authorities were not ready.

2 February 2025: prohibited practices banned; AI literacy duties apply.
2 August 2025: obligations for general-purpose AI models.
2 August 2026: most transparency obligations under Article 50, with a grace period to 2 December 2026 for watermarking systems already on the market.
2 December 2027: high-risk systems listed in Annex III, such as credit scoring, recruitment and access to essential services.
2 August 2028: high-risk AI embedded in products covered by EU product law (Annex I).

Frameworks auditors use

NIST AI Risk Management Framework 1.0 (2023), with its Generative AI Profile (NIST AI 600-1, 2024): govern, map, measure and manage AI risk.
ISO/IEC 42001:2023: a certifiable AI management system standard, increasingly requested in procurement.
For banks: existing model risk management expectations extend to AI models, including explainability and ongoing validation.

Using AI on sensitive data

Most AI risk in a regulated firm is a data question: what reaches the model, who sees what comes back, and whether you can prove both. Several techniques help, each with trade-offs.

Confidential computing: processing inside hardware-isolated, attested environments (for example on modern server CPUs and data-centre GPUs), so data stays protected in use, even from the cloud operator.
Data minimisation and redaction: removing or tokenising personal and secret data before it reaches a model.
Secure multi-party computation (MPC) and fully homomorphic encryption (FHE): computing on data without revealing it. Powerful, but still costly; practical for narrow, high-value workloads.
Differential privacy: limiting what any output can reveal about an individual in the training or query data.
Access controls on retrieval: making sure retrieval-augmented systems only fetch documents the asking user is allowed to see.

Sources

General information, not legal or regulatory advice. Standards and deadlines move; check the primary source before relying on a date.

AI governance, privacy and the EU AI Act timelineAIgovernance,privacyandtheEUAIActtimeline