EU AI Act Compliance Timeline & FAQ

Key dates

1. 2024-07-12
   Publication in the Official Journal
   Regulation (EU) 2024/1689; every later deadline counts from here.
   Key provisionsArt 113
2. 2024-08-01
   AI Act enters into force
   Twenty days after publication; no obligations apply yet.
   Key provisionsArt 113
3. 2025-02-02
   Prohibited AI practices and AI-literacy duties apply
   Social scoring, untargeted facial-image scraping, workplace emotion recognition and the other banned uses; AI-literacy duties for providers and deployers.
   Key provisionsArt 5·Art 4·Art 113
4. 2025-05-02
   Codes of practice due from the AI Office
   The GPAI Code of Practice was finalised in July 2025.
   Key provisionsArt 56
5. 2025-08-02
   GPAI model obligations; notified bodies; governance; penalties
   Commission GPAI guidelines and the training-content summary template issued in July 2025.
   Key provisionsArt 53·Art 99·Art 113
6. 2025-08-02
   Grace period starts for GPAI models already on the market
   Full compliance due by 2 August 2027.
   Key provisionsArt 111(3)
7. 2026-02-02
   Commission guidelines on practical high-risk classification due
   Draft classification guidance published in May 2026.
   Key provisionsArt 6(5)·Art 96
8. 2026-07-27
   Digital Omnibus on AI in force: Regulation (EU) 2026/1744
   Defers the high-risk regime, adds two prohibitions, narrows the safety-component test and adds Article 4a on bias detection.
   Key provisionsArt 113
9. 2026-08-02
   Transparency duties apply; general application of the Act
   Labelling of AI-generated content, chatbots and deepfakes. The Article 50(2) machine-readable marking is deferred for systems already on the market.
   Key provisionsArt 50·Art 113
10. 2026-08-02
    Legacy high-risk systems: in scope only upon significant design changes
    Systems used by public authorities must comply by 2 August 2030 in any event.
    Key provisionsArt 111(2)
11. 2026-12-02
    New prohibitions apply; Article 50(2) marking for legacy generative systems
    Bans on AI-generated child sexual abuse material and non-consensual intimate imagery; deferred marking duty for generative systems placed on the market before 2 August 2026. Both set by the Digital Omnibus.
    Key provisionsArt 5(1)(ba), (bb)·Art 111(4)·Art 113
12. 2027-08-02
    End of the GPAI grace period
    GPAI models placed on the market before 2 August 2025 must comply.
    Key provisionsArt 111(3)
13. 2027-12-02
    High-risk AI: Annex III use cases
    Recruitment, credit scoring, biometrics and the other Annex III use cases. Deferred from 2 August 2026 by the Digital Omnibus.
    Key provisionsArt 6(2)·Annex III·Art 113
14. 2028-08-02
    High-risk AI: Annex I product-embedded systems
    AI that is a safety component of, or itself, a product under the Annex I harmonisation legislation. Deferred by the Digital Omnibus.
    Key provisionsArt 6(1)·Annex I·Art 113
15. 2030-08-02
    High-risk systems used by public authorities must be compliant
    Regardless of when they were placed on the market.
    Key provisionsArt 111(2)
16. 2030-12-31
    Legacy large-scale EU IT systems (Annex X)
    AI components placed on the market before 2 August 2027; the longstop for legacy public-sector systems.
    Key provisionsArt 111(1)·Annex X

Frequently asked

Who does the AI Act apply to?

Providers that place AI systems or general-purpose AI models on the EU market or put AI systems into service in the EU, wherever they are established; deployers established or located in the EU; providers and deployers in third countries where the system's output is used in the EU; importers and distributors; product manufacturers that place an AI system on the market together with their product under their own name; authorised representatives of non-EU providers; and affected persons in the EU (Article 2(1)). The obligations differ by role, so the first step is to establish which role an organisation holds for each system (Article 3(3), Article 3(4)).

What is outside the scope of the AI Act?

AI systems used exclusively for military, defence or national security purposes (Article 2(3)); systems and models developed solely for scientific research and development (Article 2(6)); research, testing and development before a system is placed on the market, except testing in real-world conditions (Article 2(8)); use by natural persons in a purely personal, non-professional activity (Article 2(10)); and AI released under free and open-source licences, unless it is placed on the market as a high-risk system or falls under the prohibitions of Article 5 or the transparency duties of Article 50 (Article 2(12)). Data protection law continues to apply in full to any personal data processed (Article 2(7)).

When is an AI system high-risk?

Two routes. First, the system is a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I and that product must undergo third-party conformity assessment (Article 6(1), Annex I). Since the Digital Omnibus, systems used solely for non-safety aspects such as user assistance, performance optimisation or convenience do not count as safety components, unless their failure would endanger health and safety (Article 6(1a), (1b)). Second, the system falls within a use case listed in Annex III (Article 6(2)), unless it does not pose a significant risk of harm because it performs a narrow procedural task, improves the result of a completed human activity, detects patterns without replacing human assessment, or carries out a preparatory task (Article 6(3)). Profiling of natural persons is always high-risk. A provider relying on the exception must document the assessment before placing the system on the market and register it (Article 49(2)).

Does the AI Act apply to AI already in use in a company?

Yes, but with transitional rules. Prohibited practices apply to every system from their application dates. High-risk systems placed on the market before the high-risk application dates fall into scope only if their design changes significantly from then on; systems used by public authorities must comply by 2 August 2030 regardless (Article 111(2)). General-purpose AI models on the market before 2 August 2025 must comply by 2 August 2027 (Article 111(3)). Generative systems on the market before 2 August 2026 must implement the machine-readable marking of Article 50(2) by 2 December 2026 (Article 111(4)).

What is an "AI system" under the AI Act?

A machine-based system designed to operate with varying levels of autonomy, that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments (Article 3(1)). The inference element distinguishes AI systems from conventional software that applies rules defined solely by natural persons; the Commission's guidelines on the definition of an AI system (February 2025) illustrate the boundary.

Who is a "provider" and who is a "deployer"?

A provider develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts the system into service under its own name or trademark, whether for payment or free of charge (Article 3(3)). A deployer uses an AI system under its own authority, except in a personal non-professional activity (Article 3(4)). A deployer can become a provider, for example by putting its name on a high-risk system, by substantially modifying one, or by changing the intended purpose of a system so that it becomes high-risk (Article 25(1)).

What is a "general-purpose AI model", and when does it carry systemic risk?

An AI model, including one trained with large amounts of data using self-supervision at scale, that displays significant generality, can competently perform a wide range of distinct tasks regardless of how it is placed on the market, and can be integrated into a variety of downstream systems; models used only for research, development or prototyping before being placed on the market are excluded (Article 3(63)). A model has systemic risk where it has high-impact capabilities, presumed when the cumulative training compute exceeds the threshold in Article 51, or where the Commission so designates it (Article 52); such providers carry the additional duties of Article 55.

Which AI practices are prohibited?

Article 5 bans manipulative or deceptive techniques that materially distort behaviour and cause significant harm, exploitation of vulnerabilities due to age, disability or social or economic situation, social scoring with unjustified detrimental treatment, risk assessments predicting criminal offences based solely on profiling, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education institutions except for medical or safety reasons, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in public spaces for law enforcement outside narrow exceptions. The Digital Omnibus added two prohibitions applying from 2 December 2026: AI systems that generate or manipulate non-consensual intimate imagery of identifiable persons (Article 5(1)(ba)) and AI systems that generate child sexual abuse material (Article 5(1)(bb)). For these two, the placing on the market is prohibited only where such generation is the system's intended purpose or a reasonably foreseeable and reproducible outcome without adequate safeguards (Article 5(1a)).

When did the EU AI Act enter into force?

On 1 August 2024, twenty days after publication in the Official Journal on 12 July 2024 (Article 113). Its obligations then apply in phases through 2030.

When do the AI Act's prohibitions apply?

The core prohibited practices have applied since 2 February 2025. Two further prohibitions added by the Digital Omnibus, on AI-generated child sexual abuse material and non-consensual intimate imagery, apply from 2 December 2026 (Article 113(a), Article 5(1)(ba), (bb)).

When do high-risk AI obligations apply?

After the Digital Omnibus: 2 December 2027 for systems that are high-risk under Annex III (use cases such as recruitment, credit scoring or biometrics) and 2 August 2028 for systems that are high-risk under Annex I (embedded in regulated products), instead of 2 August 2026 (Article 113(c)).

Do existing high-risk systems have to comply?

Systems placed on the market or put into service before the high-risk application dates fall into scope only once their design changes significantly (Article 111(2)). High-risk systems intended for use by public authorities must comply by 2 August 2030 in any event.

When did general-purpose AI (GPAI) rules start?

On 2 August 2025 (Article 113(b)). GPAI models already on the market before that date must be compliant by 2 August 2027 (Article 111(3)).

Do transparency rules apply in 2026?

Yes. The transparency duties of Article 50 for chatbots, generative systems, emotion recognition, biometric categorisation and deepfakes apply from 2 August 2026. One carve-out from the Omnibus: generative systems already on the market on that date have until 2 December 2026 to implement the machine-readable marking of Article 50(2) (Article 111(4)).

What must providers of high-risk AI systems do?

Meet the requirements of Chapter III, Section 2, and demonstrate it: a risk management system (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency and instructions for deployers (Article 13), human oversight (Article 14), accuracy, robustness and cybersecurity (Article 15); plus a quality management system (Article 17), conformity assessment (Article 43), the EU declaration of conformity and CE marking (Articles 47 and 48), registration in the EU database (Article 49), post-market monitoring (Article 72) and reporting of serious incidents (Article 73). The provider duties are listed in Article 16.

What must deployers of high-risk AI systems do?

Use the system in line with the instructions for use, assign human oversight to competent and trained persons, ensure input data under their control is relevant and representative, monitor operation, inform the provider and the market surveillance authority of risks and serious incidents, keep the automatically generated logs for at least six months, and inform workers' representatives and affected workers before using a high-risk system at the workplace (Article 26). Public bodies, private entities providing public services and deployers of credit-scoring and life- and health-insurance systems must also carry out a fundamental rights impact assessment before first use (Article 27).

What must providers of general-purpose AI models do?

Keep technical documentation for the AI Office and national authorities, provide downstream providers with the information they need to integrate the model, adopt a copyright policy that respects rights reservations under the DSM Directive, and publish a sufficiently detailed summary of the training content using the AI Office template (Article 53(1)). Free and open-source models with publicly available parameters are exempt from the first two duties unless they carry systemic risk (Article 53(2)). Providers of models with systemic risk must additionally evaluate the model, assess and mitigate systemic risks, report serious incidents and ensure cybersecurity (Article 55). Adherence to the GPAI Code of Practice is a recognised route to demonstrate compliance (Article 56).

What do the transparency duties require?

Providers must design systems that interact with people so that people know they are dealing with AI, unless that is obvious ( Article 50(1)), and must mark the output of generative systems in a machine-readable format so it is detectable as artificially generated (Article 50(2)). Deployers must inform people exposed to emotion recognition or biometric categorisation (Article 50(3)), disclose deepfakes, and disclose AI-generated text published to inform the public on matters of public interest unless it has undergone human editorial review (Article 50(4)). The information must be clear and provided at the latest at the first interaction or exposure (Article 50(5)).

What are the penalties?

Up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher, for prohibited practices; up to EUR 15 million or 3% for breaches of the provider, importer, distributor, deployer, notified-body and transparency obligations; up to EUR 7.5 million or 1% for supplying incorrect or misleading information to authorities (Article 99(3)–(5)). For SMEs, including start-ups, the lower of the two amounts applies (Article 99(6)); the Digital Omnibus extended that cap to small mid-caps for the second and third tiers (Article 99(6a)). Providers of general-purpose AI models face fines of up to EUR 15 million or 3% imposed by the Commission (Article 101).

May special categories of personal data be processed to detect bias?

Yes, within limits. The Digital Omnibus added Article 4a: providers of high-risk systems may exceptionally process special categories of personal data to detect and correct bias where that cannot be achieved with other data, including synthetic or anonymised data, subject to technical limits on re-use, pseudonymisation and security measures, no onward transfer, deletion once the bias is corrected, and a documented justification in the records of processing. The GDPR continues to apply alongside these conditions.