EU AI Act Timeline

Staged applicability schedule of the EU AI Act. Different obligations take effect at different dates from 2024 through 2027. Compliance planning depends on which obligations apply when.

Master schedule

What applies as of 2 February 2025

• Article 4 — AI literacy. Providers and deployers of AI systems shall take measures to ensure, to the extent reasonable, sufficient AI literacy of their staff and others operating AI on their behalf. Light obligation but real.
• Article 5 — Prohibited practices. Unacceptable-risk AI practices prohibited:
  • Subliminal / manipulative techniques causing significant harm
  • Exploitation of vulnerabilities causing significant harm
  • Social scoring by public authorities
  • Predictive policing based solely on profiling
  • Untargeted facial-image scraping for facial-recognition databases
  • Emotion recognition in workplace / education (with exceptions)
  • Biometric categorization to deduce protected attributes
  • Real-time remote biometric identification in public for law enforcement (with narrow exceptions and authorization requirements)

Penalties for Article 5 violations applicable from this date.

Enforcement note: governance bodies and penalty mechanisms become operational at 2 August 2025, so enforcement-capacity ramp-up for prohibited practices happens between 2 February 2025 and 2 August 2025.

What applies as of 2 August 2025

• Chapter V — GPAI obligations (Articles 51-56). General-purpose AI models obligations applicable.
  • Baseline GPAI obligations (Article 53)
  • GPAI with systemic risk obligations (Article 55)
  • Pre-existing GPAI models (placed on market before this date) have until 2 August 2027 to comply
• Chapter VII — Governance bodies (Articles 64-70). AI Office, AI Board, Scientific Panel, Advisory Forum operational. National competent authorities designated.
• Chapter X — Codes of conduct and guidelines (Articles 95-96). Voluntary codes for non-high-risk AI providers.
• Chapter XII — Penalties (Articles 99-101). Penalty framework operational.
• Article 78 — Confidentiality. Provisions on handling confidential information by authorities.

What applies as of 2 August 2026

• General date of application. The bulk of the regulation applies from this date, except the high-risk chapter, which the omnibus (Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 24.7.2026, in force 27 July 2026) moved.
• Not yet: Chapter III, Sections 1 to 3 (high-risk AI systems). Moved to 2 December 2027 (Annex III) and 2 August 2028 (Annex I) by Art 113(c) as amended; Art 6(5) is excepted. The list below is what applies at those dates:
  • Classification rules (Article 6)
  • Requirements for high-risk AI (risk management, data and data governance, technical documentation, record-keeping, transparency, human oversight, accuracy / robustness / cybersecurity, quality management)
  • Provider obligations
  • Deployer obligations
  • Distributor / importer / authorized representative obligations
  • Conformity assessment procedures
  • EU declaration of conformity
  • CE marking
  • Registration in EU database
• Chapter IV — Transparency obligations (Article 50). Limited-risk system transparency obligations:
  • AI interaction disclosure (chatbots, voice agents)
  • Synthetic content marking
  • Deepfake disclosure
  • Emotion recognition / biometric categorization notification
• Chapter VI — Measures in support of innovation (Articles 57-63). Regulatory sandboxes, real-world testing provisions, support for SMEs.
• Most market surveillance and enforcement provisions become fully operational.

What applies as of 2 August 2027

• Pre-existing GPAI models (placed on the market before 2 August 2025) must achieve compliance by this date (Art 111(3)).

What applies as of 2 December 2027 and 2 August 2028

• 2 December 2027: Annex III high-risk systems (Art 6(2)), Chapter III Sections 1 to 3 (Art 113(c)(i) as amended by Reg. 2026/1744).
• 2 August 2028: high-risk AI systems embedded in Annex I products (Art 6(1)), Art 113(c)(ii) as amended. These follow the longer transition because the underlying product-specific regulations have their own compliance frameworks.
• Legacy high-risk systems: systems placed on the market before these dates fall under the Regulation only after significant design changes (Art 111(2) as replaced).

Specific provisions outside the main schedule

• Article 111 — Transitional provisions for high-risk AI systems already on the market. Specific rules for systems placed on market before applicability dates.
• Article 112 — Evaluation and review. Commission shall assess and report regularly; first evaluation by 2 August 2028.
• Article 113 — Entry into force / application. Master applicability dates as above.

Compliance planning implications

For providers of AI systems

• Now (2026-05-12): review classifications, especially Article 6(3) exemption applicability. Plan compliance work for high-risk systems against the 2 December 2027 (Annex III) and 2 August 2028 (Annex I) dates (Art 113(c) as amended by Reg. 2026/1744).
• By 2 December 2027 (Annex III) or 2 August 2028 (Annex I): high-risk system obligations operational. Conformity assessment completed, technical documentation in place, CE marking applied where required, post-market monitoring active.
• Ongoing: transparency obligations for limited-risk systems where applicable. AI literacy provisions in place.

For deployers of AI systems

• Now: identify high-risk AI systems in use; understand deployer obligations (use according to instructions, ensure human oversight, monitor operation, log if applicable, inform workers if used in workplace).
• By 2 December 2027: deployer obligations for Annex III systems fully applicable.

For GPAI providers

• By 2 August 2025: baseline GPAI obligations applicable. Technical documentation, training data summary, copyright compliance, downstream-provider information.
• For GPAI with systemic risk: additional obligations applicable. Model evaluation, adversarial testing, incident reporting, cybersecurity.
• Pre-existing GPAI models: 2 August 2027 deadline.

For deployers consuming GPAI

• GPAI provider's compliance does not absolve deployer responsibilities. Deployer obligations apply based on use-case classification.

Enforcement ramp-up

• 2 February 2025: prohibited practices applicable; enforcement capacity still building.
• 2 August 2025: penalty framework operational, governance bodies operational. First enforcement activity plausibly visible 2025-2026.
• 2026-2027: enforcement activity ramping with high-risk obligations applicability.
• First substantial enforcement actions plausibly 2026-2027. Pattern likely similar to GDPR rollout: initial guidance focus, then enforcement on clearest violations.

What happens if a system was placed on market before applicability

Article 111 transitional provisions:

• Article 111(2), as replaced by Reg. 2026/1744: high-risk AI systems placed on the market or put into service before the date of application of Chapter III (2 December 2027 for Annex III, 2 August 2028 for Annex I) fall under the Regulation only if their designs change significantly after that date. High-risk systems intended for use by public authorities must comply by 2 August 2030 in any case.
• Article 111(4), added by Reg. 2026/1744: generative AI systems placed on the market before 2 August 2026 must comply with Art 50(2) (marking of synthetic content) by 2 December 2026.
• Article 111(3): pre-existing GPAI models must be compliant by 2 August 2027.

The transitional provisions create complexity — knowing whether a system is "placed on market" before the cutoff (and what counts as "significant change") matters.

Coordination with other applicability dates

• GDPR: continues to apply alongside AI Act. AI Act does not affect GDPR.
• DORA (financial services ICT resilience, applicable since 17 January 2025): AI systems in DORA scope have both obligations.
• NIS2 (cybersecurity for essential / important entities): AI systems in NIS2 scope have both obligations.
• Cyber Resilience Act (Regulation 2024/2847): digital products cybersecurity. Applicability mid-2027. AI-enabled products covered.
• Product Liability Directive (revised, applicable December 2026): liability for AI systems extended.

Quick reference table

See also

• cluster MOC · EU AI Act Risk Tiers · EU AI Act High-Risk Obligations · EU AI Act GPAI Obligations · EU AI Act Governance