EU AI Act vs the US AI executive order: a buyer's timeline

IT buyers, MSPs and compliance leads tracking AI regulation on both sides of the Atlantic are dealing with two systems that share neither a calendar, a scope, nor a basic design. Confusing them can mean freezing a project that is still lawful, or accepting a vendor's compliance claim that does not hold up. This guide sets out where the EU AI Act and the US AI executive order actually stand as of September 2026, what changed, and what to check before you sign anything.

What's already in force in the EU

The AI Act's transparency duties under Article 50 — disclosure requirements for chatbots and labelling for AI-generated content — have applied since 2 August 2026, and the European Commission's AI Office already has enforcement powers over general-purpose AI model obligations, which took effect a year earlier. Prohibited practices under Article 5 and the AI literacy duties in Article 4 have applied even longer, since February 2025. None of that changed when the 2026 Digital Omnibus was adopted.

What changed in 2026

What did change is the high-risk timeline. The EU's Digital Omnibus on AI, endorsed by the European Parliament on 16 June 2026 and approved by the Council on 29 June 2026, pushed back the substantive high-risk obligations. Annex III standalone systems — covering uses such as employment, education and biometrics — apply from 2 December 2027 instead of August 2026, and Annex I product-embedded systems move to August 2028.

The stated reason is that the harmonised technical standards needed to give high-risk systems a presumption of conformity were not ready. The substance of the rules did not change, only the date they start to bite.

What the US executive order actually does

The US took a different route. President Trump signed Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” on 2 June 2026. It applies to federal agencies rather than to private companies directly, and it frames AI primarily as a cybersecurity and innovation issue instead of a risk-tiered compliance regime.

The order directs agencies to prioritise cyber defence of civilian federal information systems within 30 days of signing, with CISA issuing guidance to speed that work, and it sets up an AI cybersecurity clearinghouse — coordinated by Treasury, the NSA and CISA — for sharing vulnerability and remediation information tied to AI systems. Separately, it creates a voluntary framework under which developers can share “covered frontier models” with the government for assessment before public release.

The order explicitly rules out mandatory licensing: Section 3(c) states that nothing in it authorises a mandatory government licensing, preclearance or permitting requirement for developing, publishing or distributing new AI models. That is a policy commitment made in this order, not a permanent legal bar, since a future order or law could still introduce one. It also has no Annex III-style classification system and no equivalent of the EU's high-risk deployer obligations.

What this means for a buyer

A vendor's US posture under EO 14409 says nothing about its EU AI Act readiness, and vice versa: the two regimes cover different subjects, for different actors, on different schedules. For European IT leaders, the order carries no direct legal force, but it does signal the environment US-based AI vendors operate in — voluntary rather than mandatory pre-release review, with cybersecurity obligations that fall on federal agencies rather than on vendors' commercial products.

Look for evidence that a vendor takes part in the voluntary frontier-model framework rather than assuming that amounts to an EU AI Act-equivalent review. Buyers already assembling NIS2 and DORA evidence can apply the same discipline to AI Act deadlines: Auris Comply provides NIS2/DORA compliance and audit trail support for that kind of paperwork.

What to do

Before treating a vendor's AI compliance claim as settled, work through a short checklist:

• Ask which specific article or annex the vendor claims to satisfy, and confirm the date that provision actually took effect — some EU deadlines moved, others did not.
• Treat the Annex III delay to December 2027 as extra runway, not an exemption: Article 50 transparency duties already apply regardless of when Annex III lands.
• For US vendors, ask whether they have shared models through the EO 14409 voluntary frontier-model framework rather than assuming a formal government review took place.
• Do not read “no mandatory licensing” in the US order as evidence of EU AI Act readiness; the orders address different regulatory questions entirely.
• Track the EU and US calendars separately in contracts and audit files, since a delay on one side does not move the other side's deadlines.

Sources: artificialintelligenceact.eu, The White House, Congressional Research Service.