EU AI Act Timeline: Every Key Deadline and Compliance Date (2024–2028)

EU AI Act Timeline at a Glance (Status September 2026)

The EU AI Act was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024, 20 days after publication, as set out in Regulation (EU) 2024/1689. Entry into force is not the same as application: obligations apply on a staggered schedule set in Article 113.

In July 2026 the EU amended that schedule. The Digital Omnibus postponed the high-risk obligations, shortened the grace period for content marking, pushed the deadline for national regulatory sandboxes and added a new prohibition. It did not postpone the prohibitions, AI literacy, the GPAI rules or the general Article 50 date. The Commission's AI Act Service Desk timeline has been updated to the amended dates.

Master Implementation Timeline

Entry into Force vs. Application: Why the Distinction Matters

Under EU law, 'entry into force' means a regulation is legally valid. 'Application' means a specific obligation binds the people it addresses. For the AI Act the two are years apart, and the Omnibus widened the gap for high-risk AI. When auditors or procurement teams ask whether you comply, the right answer depends on which obligations are in application on that date.

Prohibited AI Practices and AI Literacy (2 February 2025)

In short

Since 2 February 2025, eight categories of AI practice are banned under Article 5 and providers and deployers must take AI literacy measures under Article 4. A ninth ban, added by the Digital Omnibus, applies from 2 December 2026.

2 February 2025 was the first application date, six months after entry into force. Article 5 of Regulation (EU) 2024/1689 lists practices banned as incompatible with EU fundamental rights. The Commission's AI Act Service Desk confirms that enforcement powers of national authorities apply from 2 August 2026.

The Prohibited AI Practices Under Article 5

• 1. Manipulative or deceptive techniques that materially distort behaviour and cause or are likely to cause significant harm.
• 2. Exploitation of vulnerabilities related to age, disability or a specific social or economic situation.
• 3. Social scoring that leads to detrimental or unfavourable treatment in unrelated contexts or out of proportion to the behaviour.
• 4. Predicting criminal offences based solely on profiling or personality traits.
• 5. Untargeted scraping of facial images from the internet or CCTV footage to build facial recognition databases.
• 6. Emotion recognition in workplaces and education, except for medical or safety reasons.
• 7. Biometric categorisation to infer sensitive attributes such as race, political opinions, trade union membership, religious beliefs or sexual orientation.
• 8. Real-time remote biometric identification in publicly accessible spaces for law enforcement, subject to narrow exceptions and prior authorisation.
• New from 2 December 2026: AI systems that generate non-consensual intimate material or child sexual abuse material, added by Regulation (EU) 2026/1744.

AI literacy under Article 4, as amended

Article 4 has applied since 2 February 2025. The Digital Omnibus reworded it: providers and deployers must now "take measures to support the development of AI literacy" of their staff and others operating AI systems on their behalf, considering their knowledge, experience, education and context. The original requirement to ensure a sufficient level of AI literacy was removed, so no particular level has to be guaranteed for each individual. Keeping records of training and guidance remains the practical way to show what you did. See the Commission's AI literacy Q&A.

Most enterprise AI systems fall outside the prohibited categories, but HR, workplace analytics and security tools deserve a close look under points 6 and 7. The EU AI Act compliance checklist starts with this screening. CIOs sourcing external advisers can compare best ai governance consultants for cios.

GPAI Model Obligations (2 August 2025)

In short

Since 2 August 2025, providers of general-purpose AI models must meet Chapter V obligations. The AI Office's enforcement powers apply from 2 August 2026, and models placed on the market before 2 August 2025 must comply by 2 August 2027.

Chapter V of the AI Act applies to providers of general-purpose AI (GPAI) models: models trained on large amounts of data that can perform a wide range of tasks and are integrated into other systems. The rules apply to providers placing such models on the EU market, wherever they are established. The same date brought the governance chapter and the penalty regime into application.

Two Tiers of GPAI Obligation

• All GPAI models (Article 53): technical documentation, information for downstream providers, a policy to comply with EU copyright law, and a public summary of training content.
• GPAI models with systemic risk (Articles 51 and 55): presumed when cumulative training compute exceeds 10²⁵ FLOPs. Additional duties: model evaluations including adversarial testing, systemic-risk assessment and mitigation, serious-incident reporting to the AI Office, and cybersecurity protection.

GPAI dates to track

• 2 August 2025: obligations apply to new models placed on the market.
• 2 August 2026: the AI Office's enforcement powers apply, according to the AI Act Service Desk.
• 2 August 2027: GPAI models placed on the market before 2 August 2025 must comply (Article 111(3)).

Alice Labs practitioner team

What Applied on 2 August 2026: Article 50 and Enforcement Powers

In short

2 August 2026 is the general date of application. Article 50 transparency obligations apply and the enforcement powers of the AI Office and national authorities start. Annex III high-risk rules did not apply on this date; the Digital Omnibus moved them to 2 December 2027.

Under the original text, 2 August 2026 would also have brought Annex III high-risk obligations into application. The Digital Omnibus entered into force six days before that date and moved them. What did apply on 2 August 2026:

• Article 50(1): providers must ensure people are informed they are interacting with an AI system, unless that is obvious.
• Article 50(2): providers of generative AI systems must mark synthetic audio, image, video and text output in a machine-readable format. Systems placed on the market before 2 August 2026 have until 2 December 2026.
• Article 50(3): deployers of emotion recognition or biometric categorisation systems must inform the people exposed.
• Article 50(4): deployers must disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless it has been human-reviewed under editorial responsibility.
• Enforcement powers: the AI Office (for GPAI models) and national market surveillance authorities can enforce the rules that apply.

According to the Commission's Article 50 FAQ, content generated before 2 August 2026 does not need to be labelled retroactively.

Penalty Structure Under Article 99

• Prohibited practices (Article 5): up to €35 million or 7% of total worldwide annual turnover, whichever is higher.
• Most other obligations: up to €15 million or 3% of total worldwide annual turnover, whichever is higher.
• Incorrect, incomplete or misleading information to authorities: up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher.

For SMEs, including start-ups, each fine is capped at the lower of the two amounts. Fines for GPAI model providers are set by the Commission under Article 101.

High-Risk AI Obligations (Annex III): 2 December 2027

In short

After the Digital Omnibus, high-risk obligations for AI used in Annex III areas apply from 2 December 2027. They cover risk management, data governance, technical documentation, logging, human oversight, conformity assessment and registration.

Annex III lists uses of AI that are high-risk because of their impact on health, safety or fundamental rights. Regulation (EU) 2026/1744 moved the application date for these systems from 2 August 2026 to 2 December 2027.

Annex III: High-Risk Areas

• 1. Biometrics (where not prohibited under Article 5)
• 2. Critical infrastructure: safety components in critical digital infrastructure, road traffic and the supply of water, gas, heating and electricity
• 3. Education and vocational training: admission, assessment and proctoring
• 4. Employment and workers management: recruitment, CV screening, promotion, task allocation and performance monitoring
• 5. Access to essential private and public services: public benefits, creditworthiness, life and health insurance pricing, emergency call triage
• 6. Law enforcement
• 7. Migration, asylum and border control
• 8. Administration of justice and democratic processes

What High-Risk AI Providers and Deployers Must Do by 2 December 2027

Technical documentation and conformity assessment typically take the longest to prepare, so the extra time is best used to start them, not to wait. For a structured approach, see our EU AI Act compliance checklist and EU AI Act compliance guide.

Alice Labs practitioner team

Final Deadline: AI in Regulated Products (2 August 2028)

In short

High-risk AI that is a safety component of, or itself is, a product covered by EU harmonisation legislation in Annex I, such as machinery or medical devices, must comply from 2 August 2028 after the Digital Omnibus.

Annex I lists EU product legislation whose products already go through conformity assessment. AI that is a safety component of such a product, or is itself such a product, is high-risk under Article 6(1). The original date was 2 August 2027; Regulation (EU) 2026/1744 moved it to 2 August 2028. The Omnibus also amended the Machinery Regulation (EU) 2023/1230 and the EASA Regulation (EU) 2018/1139.

Examples of Annex I Product Legislation

• Medical devices and in vitro diagnostic devices: Regulations (EU) 2017/745 and 2017/746
• Machinery: Regulation (EU) 2023/1230
• Toys, radio equipment, lifts and pressure equipment
• Motor vehicles, civil aviation and agricultural vehicles

What Is Not Extended

The later dates apply only to the high-risk obligations. They do not extend the prohibitions (2 February 2025), AI literacy, the GPAI rules or Article 50. A product-embedded AI system that also involves a prohibited practice is banned today.

Who Supervises the AI Act in Sweden?

In short

Under a government decision of 4 June 2026 (Fi2026/01365), PTS, IMY, Finansinspektionen, Läkemedelsverket and Swedac are Sweden's national competent authorities until 31 December 2026. PTS is single point of contact and runs the AI sandbox.

The Swedish Government appointed five national competent authorities under Article 70 on 4 June 2026 (Fi2026/01365). The assignment is interim, running until 31 December 2026, while permanent legislation is prepared. General-purpose AI models are supervised at EU level by the Commission's AI Office.

For roles, GDPR and practical duties for Swedish companies, see EU AI Act for Swedish companies. Other Member States have chosen different structures; check the national authority where you operate.

What the Amended Timeline Means for Your Compliance Planning

In short

Act now on what already applies: prohibitions, AI literacy, Article 50 and vendor GPAI checks. Use the time to 2 December 2027 to inventory and classify AI systems and prepare high-risk documentation.

The Omnibus changed when high-risk rules apply, not what they require. A realistic sequence for most organisations:

Building an AI Governance Infrastructure

AI Act compliance overlaps with the broader AI governance most organisations need anyway: an AI inventory, a risk register, model documentation and a named owner. The enterprise AI strategy framework and AI implementation roadmap show where that work fits.

If you procure AI from vendors, you have deployer obligations of your own and need contractual assurance that vendors meet their provider obligations on the same dates. For external support, see our EU AI Act compliance consulting overview, AI governance consulting and AI implementation consultant pages.

Alice Labs practitioner team

Frequently Asked Questions: EU AI Act Timeline

In short

Key questions about EU AI Act deadlines after the Digital Omnibus, penalties and supervision, answered directly.

When did the EU AI Act enter into force?

On 1 August 2024, 20 days after publication in the Official Journal on 12 July 2024. Most obligations apply on later dates.

What is the Digital Omnibus on AI?

Regulation (EU) 2026/1744 amends the AI Act. It was published in the Official Journal on 24 July 2026 and has applied since 27 July 2026. It moved Annex III high-risk rules to 2 December 2027 and Annex I to 2 August 2028, set 2 December 2026 as the Art. 50(2) marking deadline for generative systems already on the market, added a ban on AI generating non-consensual intimate material and CSAM, moved the national sandbox deadline to 2 August 2027 and reworded Article 4.

When do high-risk AI obligations apply?

From 2 December 2027 for Annex III uses such as recruitment, credit scoring and education, and from 2 August 2028 for AI in regulated products under Annex I, such as machinery and medical devices.

When does Article 50 apply?

From 2 August 2026. Generative AI systems placed on the market before that date have until 2 December 2026 to add machine-readable marking under Article 50(2).

What happens on 2 December 2026?

The ban on AI systems that generate non-consensual intimate material or child sexual abuse material applies, and the Article 50(2) marking grace period for generative systems already on the market ends.

What does Article 4 on AI literacy require now?

Providers and deployers must take measures to support the development of AI literacy of their staff and others operating AI on their behalf. After the Digital Omnibus, no particular level has to be ensured for each individual.

What are the maximum fines under the EU AI Act?

Up to €35 million or 7% of global annual turnover for prohibited practices, €15 million or 3% for most other obligations, and €7.5 million or 1% for supplying incorrect information. The higher amount applies, except for SMEs, where the lower applies.

Is the EU AI Act in force now?

Yes. It has been in force since 1 August 2024. Prohibitions and AI literacy apply since 2 February 2025, GPAI rules since 2 August 2025, and general application, Article 50 and enforcement powers since 2 August 2026. High-risk rules follow on 2 December 2027 and 2 August 2028.

Who supervises the AI Act in Sweden?

Under a government decision of 4 June 2026, until 31 December 2026: PTS (single point of contact and AI sandbox), IMY, Finansinspektionen and Läkemedelsverket for market surveillance, and Swedac as notifying authority for most areas.

Does the EU AI Act apply to companies outside the EU?

Yes. Under Article 2 it applies to providers placing AI systems or GPAI models on the EU market, wherever they are established, and to providers and deployers outside the EU where the output of the AI system is used in the EU. Non-EU providers must appoint an authorised representative in the EU.