EU AI Act Implementation Timeline

The EU AI Act entered into force on 1 August 2024. Its obligations do not all apply from that date. The Act applies in four distinct phases, staggered across three years, with different rules becoming enforceable at different points depending on the type of AI system and the role of the organisation responsible for it.

Article 113 of the Act sets out the application dates. The structure reflects a legislative judgement that different parts of the framework require different lead times: prohibited practices were sufficiently clear to apply immediately, while high-risk system obligations required time for standards to develop and businesses to prepare.

The phased structure does not mean the Act is a future problem. Three phases are already in force. Only one remains pending as of May 2026.

The table below gives the full picture before each phase is explained in detail.

Phase	Date	What applies	Who is affected
Phase 1	1 August 2024	Act enters into force. Governance structure established. AI Office operational	All operators. Governance bodies
Phase 2	2 February 2025	Prohibited practices banned. AI literacy obligation applies	All providers and deployers
Phase 3	2 August 2025	GPAI model obligations. Authorised Representative for GPAI providers. Codes of practice	GPAI model providers. Non-EU GPAI providers
Phase 4	2 August 2026	High-risk AI system obligations. Authorised Representative for high-risk AI providers	Providers and deployers of high-risk AI. Non-EU high-risk AI providers
Transitional	2 August 2027	Annex I embedded systems. Pre-August 2025 GPAI models	Product manufacturers. Legacy GPAI providers

EU AI Act Phase 1: Entry into Force

Date: 1 August 2024

The Act entered into force on 1 August 2024, twenty days after its publication in the Official Journal of the European Union on 12 July 2024. Entry into force is legally distinct from applicability. The Act became binding law on 1 August 2024, but most of its substantive obligations did not become enforceable on that date.

What did take effect immediately was the institutional architecture. The European AI Office was established within the European Commission as the central supervisory body for general-purpose AI models. The AI Board, the Advisory Forum, and the Scientific Panel of Independent Experts were constituted. National competent authorities began designating market surveillance authorities for high-risk AI enforcement.

Article 64 established the AI Office with authority to supervise GPAI model providers, develop guidelines, facilitate codes of practice, and enforce GPAI obligations across the EU. This body was operational from entry into force, not from any later application date.

What applied from 1 August 2024	Legal basis
Act legally binding across all EU member states	Article 113
European AI Office established and operational	Article 64
AI Board constituted	Article 65
Scientific Panel of Independent Experts constituted	Article 68
Advisory Forum established	Article 67
National market surveillance authority designation process begins	Article 70
Member states required to establish AI regulatory sandboxes	Article 57

---

EU AI Act Phase 2: Prohibited Practices and AI Literacy

Date: 2 February 2025

The most significant obligations in Phase 2 are the prohibition of eight categories of AI practice under Article 5, and the AI literacy requirement under Article 4. Both have applied since 2 February 2025.

Prohibited Practices

Article 5 bans eight categories of AI outright. These prohibitions apply to every operator in the EU, and to non-EU operators whose AI systems affect people in the EU. There is no conformity assessment process, no exemption procedure, and no transitional arrangement for systems already on the market. A system that meets the description of a prohibited practice was required to cease operating by 2 February 2025.

Prohibited practice	Legal basis
Subliminal manipulation techniques causing harm	Article 5(1)(a)
Exploitation of vulnerability due to age, disability, or economic situation	Article 5(1)(b)
Social scoring by public authorities	Article 5(1)(c)
Real-time remote biometric identification in public spaces for law enforcement	Article 5(1)(d)
Biometric categorisation to infer sensitive attributes	Article 5(1)(e)
Emotion recognition in workplace and education settings	Article 5(1)(f)
Untargeted scraping to build facial recognition databases	Article 5(1)(g)
Predictive criminal profiling based solely on individual profiling	Article 5(1)(h)

The penalty for operating a prohibited AI system is a fine of up to EUR 35,000,000 or 7% of total worldwide annual turnover under Article 99(3), whichever is higher. For SMEs, fines are capped at the lower of the applicable percentage or fixed amount.

AI Literacy and EU AI Act

Article 4 states: “Providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in.”

This obligation applies to every provider and deployer, regardless of the risk tier of the AI systems they use or build. A business using only minimal-risk AI tools is still subject to Article 4. The obligation is assessed against what is reasonably achievable given the nature of the staff and the systems involved, not against an absolute technical standard.

What AI literacy requires in practice	Who must comply
Staff understand what AI systems they are working with	All providers and deployers
Staff understand the risk classification of the systems they use	All providers and deployers
Staff understand the organisation’s obligations under the Act	All providers and deployers
Training is documented and updated when new systems are adopted	All providers and deployers

Commission Guidelines on Prohibited Practices

Article 96 required the Commission to publish guidelines on prohibited AI practices by 2 May 2025. The Commission published these guidelines as required, providing legal explanations and practical examples to assist operators in determining whether their systems fall within the prohibited categories. The guidelines are not legally binding but carry significant interpretive weight in regulatory and enforcement proceedings.

EU AI Act Phase 3: General-Purpose AI Model Obligations

Date: 2 August 2025

Phase 3 brought into force the obligations applicable to providers of general-purpose AI models under Chapter V of the Act, Articles 51 to 56. These obligations apply to providers of GPAI models placed on the EU market from 2 August 2025. Providers of GPAI models placed on the market before that date have until 2 August 2027 under the transitional provisions in Article 111.

Who Is a GPAI Model Provider

Article 3(63) defines a general-purpose AI model as “an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications.”

This definition captures large language models, multimodal foundation models, and other models capable of broad task performance. It does not capture narrowly trained models designed for a single specific task.

Standard GPAI Model Obligations

Obligation	What is required	Legal basis
Technical documentation	Prepare and maintain technical documentation as specified in Annex XI	Article 53(1)(a)
Copyright transparency	Make available information about training data covered by copyright law	Article 53(1)(c)
Model card	Publish a sufficiently detailed summary of the content used for training	Article 53(1)(b)
Downstream provider cooperation	Provide information and documentation to downstream providers integrating the model	Article 53(1)(e)
Policy on copyright	Implement a policy for complying with Union copyright law	Article 53(1)(c)

GPAI Models with Systemic Risk

Article 51(1) states: “A general-purpose AI model shall be classified as a general-purpose AI model with systemic risk if it has high-impact capabilities evaluated on the basis of appropriate technical tools and methodologies, including indicators and benchmarks.” The primary quantitative indicator is training compute exceeding 10^25 floating-point operations. The AI Office may designate models below this threshold if their capabilities warrant it.

Additional obligation for systemic risk models	What is required	Legal basis
Adversarial testing	Conduct model evaluations including adversarial testing before and after market placement	Article 55(1)(a)
Incident reporting	Report serious incidents to the AI Office without undue delay	Article 55(1)(b)
Cybersecurity measures	Implement appropriate cybersecurity protections for the model and its physical infrastructure	Article 55(1)(c)
Energy efficiency reporting	Report energy consumption of the model to the AI Office	Article 55(1)(d)

Authorised Representative for GPAI Providers

Non-EU providers of GPAI models placed on the EU market from 2 August 2025 must appoint an EU-established Authorised Representative before market placement. Article 54(1) states: “Prior to placing a general-purpose AI model on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union.”

A UK-established entity does not qualify. The representative must be established in an EU member state.

GPAI Code of Practice

The AI Office facilitated development of a code of practice for GPAI model providers through a multi-stakeholder process running from late 2024 through to mid-2025. The code became the primary compliance reference for GPAI obligations from 2 August 2025. Adherence to an approved code creates a presumption of conformity with the corresponding obligations under Articles 53 and 55. Providers not adhering to any approved code must demonstrate compliance through alternative means and remain subject to direct AI Office supervision.

Open-Source GPAI Models

Providers of open-source GPAI models benefit from partial exemptions under Article 53(2), which states that providers of GPAI models that are released under a free and open-source licence that allows access, use, modification, and distribution of the model are exempt from the technical documentation and downstream provider cooperation obligations, provided they publish the required information. The exemption does not apply to open-source models classified as posing systemic risk.

Phase 4: High-Risk AI System Obligations

Date: December 2027

Phase 4 is the largest and most operationally demanding phase of the Act. It brings into force the obligations applicable to providers and deployers of high-risk AI systems under Chapters II and III of the Act.

High-risk AI systems are defined by two pathways under Article 6. The first covers AI systems that are safety components of Annex I regulated products or are themselves such products. The second covers AI systems used in the eight domains listed in Annex III: biometric identification, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice.

High-Risk Provider Obligations

Obligation	What is required	Legal basis
Risk management system	Establish, implement, document, and maintain a risk management system for the entire AI system lifecycle	Article 9
Data governance	Implement data governance and management practices for training, validation, and testing data	Article 10
Technical documentation	Prepare technical documentation as specified in Annex IV before market placement	Article 11
Record-keeping	Enable automatic logging of events during system operation	Article 12
Transparency to deployers	Provide deployers with sufficient information to implement the system correctly	Article 13
Human oversight	Design systems to enable effective human oversight during operation	Article 14
Accuracy and robustness	Achieve appropriate levels of accuracy, robustness, and cybersecurity	Article 15
Quality management system	Implement a quality management system covering all obligations	Article 17
Documentation keeping	Retain technical documentation and quality management records for 10 years	Article 18
Corrective actions	Take corrective action where the system does not conform	Article 20
Cooperation with authorities	Cooperate with competent authorities upon request	Article 21
Conformity assessment	Carry out conformity assessment before market placement	Article 43
CE marking	Affix CE marking to high-risk AI systems before market placement	Article 48
Declaration of Conformity	Draw up an EU Declaration of Conformity	Article 47
Registration	Register the system in the EU database before market placement	Article 49
Post-market monitoring	Establish a post-market monitoring system	Article 72
Serious incident reporting	Report serious incidents to national authorities without undue delay	Article 73

Deployer Obligations from 2 August 2026

Obligation	What is required	Legal basis
Human oversight	Implement appropriate human oversight measures during operation	Article 26(1)
Follow provider instructions	Use the system in accordance with the provider’s instructions for use	Article 26(3)
Staff competence	Assign operation to sufficiently competent staff	Article 26(4)
Monitoring	Monitor the system for risks during operation and report issues to providers	Article 26(5)
Log retention	Retain automatically generated logs for at least six months	Article 26(6)
Individual notification	Inform individuals subject to a high-risk AI system of its use	Article 26(8)
Fundamental Rights Impact Assessment	Conduct a FRIA before deploying a high-risk AI system listed in Annex III	Article 27
Data protection coordination	Coordinate with data protection obligations where personal data is processed	Article 26(9)

Authorised Representative for High-Risk AI Providers

Non-EU providers of high-risk AI systems must appoint an EU-established Authorised Representative before placing their systems on the EU market. This obligation applies from 2 August 2026. Article 22(1) states: “Prior to making their high-risk AI systems available on the Union market, providers established in third countries shall, by written mandate, appoint an authorised representative which is established in the Union.”

The representative carries direct obligations under Article 22(3), including verifying technical documentation, retaining records for 10 years, cooperating with authorities, and terminating the mandate and notifying authorities if the provider acts contrary to the Act.

EU AI Act Transitional Arrangements

Date: 2 August 2027

Article 111 of the Act sets out transitional provisions for AI systems that were already placed on the market or put into service before the relevant obligations became applicable. These provisions give operators additional time to bring existing systems into compliance, but they do not create permanent exemptions.

Systems Covered by Transitional Provisions

System category	Transitional deadline	What is required by deadline
High-risk AI systems placed on market before 2 August 2026 that undergo substantial modification after that date	2 August 2026	Substantial modification triggers full compliance obligations from the date of modification
High-risk AI systems already placed on market or in service before 2 August 2026 without substantial modification	2 August 2027	Full compliance with all provider and deployer obligations
GPAI models placed on market before 2 August 2025	2 August 2027	Full compliance with GPAI obligations under Articles 51 to 56
High-risk AI systems that are safety components of Annex I products (embedded systems)	2 August 2027	Full compliance with high-risk AI obligations

What Substantial Modification Means

Article 3(23) defines substantial modification as “a change to the AI system after its placing on the market or putting into service which is not foreseen or planned by the provider in the original conformity assessment and as a result of which the compliance of the AI system with the requirements set out in Chapter III, Section 2 is affected or results in a modification to the intended purpose for which the AI system has been assessed.”

A substantial modification triggers full provider obligations from the date of the modification, regardless of when the original system was placed on the market. Operators who modify legacy systems to add new capabilities, change the intended use, or alter the system’s behaviour in a way that affects its risk classification should assess whether the modification is substantial before proceeding.

What the Transitional Provisions Do Not Cover

The transitional provisions apply only to high-risk AI system obligations under Chapters II and III, and to GPAI model obligations under Chapter V. They do not apply to:

Obligation	Transitional provision available
Prohibited practices (Article 5)	No. Prohibition applied from 2 February 2025 with no transitional period
AI literacy (Article 4)	No. Obligation applied from 2 February 2025 with no transitional period
GPAI obligations for models placed on market from 2 August 2025	No. Obligations apply immediately on market placement
High-risk AI obligations following substantial modification	No. Modification triggers immediate compliance requirement

EU AI Act Digital Omnibus Timeline Adjustments

In February 2025, the European Commission published the Digital Omnibus package, which proposes amendments to several EU digital regulations including the AI Act. The most relevant proposal for the implementation timeline concerns the high-risk AI obligations in Phase 4.

The Commission has proposed adjusting the application of high-risk AI rules to allow a maximum of 16 months from the point at which relevant harmonised standards are available, rather than the fixed date of 2 August 2026. The stated rationale is that harmonised standards, which create presumptions of conformity for high-risk systems, have developed more slowly than the legislative timeline anticipated.

Digital Omnibus proposal	Current rule	Proposed change	Status
High-risk AI timeline	Fixed date of 2 August 2026	Maximum 16 months from standards availability	Under negotiation, not adopted
SME proportionality	Fines capped at lower of percentage or fixed amount	Additional protections for micro and small enterprises	Under negotiation, not adopted
AI system definition	Current OECD-based definition	Proposed narrowing to exclude certain traditional software	Under negotiation, not adopted
GPAI obligations	Applied from 2 August 2025	No change proposed	No change
Prohibited practices	Applied from 2 February 2025	No change proposed	No change

Planning on the assumption that the Digital Omnibus will move the August 2026 deadline is not a sound compliance approach. Even if the proposals are adopted in a form that adjusts the timeline, the work required to meet high-risk AI obligations takes months. Providers beginning conformity assessment, technical documentation, and quality management system work in 2026 are already operating with insufficient lead time under the current rules.

Timeline Summary Table

Obligation	Status (May 2026)	Deadline
Governance structure and AI Office	In force	1 August 2024
Prohibited practices (Article 5)	In force	2 February 2025
AI literacy (Article 4)	In force	2 February 2025
Commission guidelines on prohibited practices	Published	2 May 2025
GPAI technical documentation	In force	2 August 2025
GPAI copyright transparency	In force	2 August 2025
GPAI systemic risk obligations	In force	2 August 2025
GPAI Code of Practice	In force	2 August 2025
Authorised Representative for GPAI providers	In force	2 August 2025
High-risk AI provider obligations	Pending	2 August 2026
High-risk AI deployer obligations	Pending	2 August 2026
Authorised Representative for high-risk AI providers	Pending	2 August 2026
Transitional period ends for legacy high-risk systems	Pending	2 August 2027
Transitional period ends for Annex I embedded systems	Pending	2 August 2027
Transitional period ends for pre-August 2025 GPAI models	Pending	2 August 2027

Frequently Asked Questions

The Act entered into force in August 2024. Does that mean all obligations applied from that date?

No. Entry into force and applicability are legally distinct concepts. The Act became binding law on 1 August 2024, but the substantive obligations apply on a staggered schedule set out in Article 113. The governance structure and institutional bodies became operational from entry into force. The prohibited practices and AI literacy obligation applied from 2 February 2025. GPAI obligations applied from 2 August 2025. High-risk AI obligations apply from 2 August 2026.

We placed our high-risk AI system on the EU market in early 2026. Do we have until August 2026 to comply?

No. Article 113 requires providers of high-risk AI systems to comply with the obligations in Chapters II and III before placing their systems on the market or putting them into service. If you placed a system on the market in early 2026, you should have been preparing for compliance from the point the Act entered into force. The August 2026 date is the universal application date, not a grace period that begins on that date.

Our legacy system was placed on the market before August 2026. Can we rely on the transitional provisions until August 2027?

Only if the system has not undergone a substantial modification after 2 August 2026. Article 111(2) states that systems already on the market before the application date must comply by 2 August 2027, but Article 3(23) provides that a substantial modification triggers full compliance obligations immediately. If you modify a legacy system after August 2026, assess whether the modification is substantial before concluding that the 2027 transitional deadline applies.

We provide a GPAI model that was placed on the market in January 2025. When do our obligations apply?

Your obligations apply from 2 August 2027 under the transitional provisions in Article 111(3). GPAI models placed on the market before 2 August 2025 benefit from the extended transitional period. However, if your model is classified as posing systemic risk, the AI Office has authority to engage with you before that date and may require cooperation under Articles 91 to 93 regardless of the transitional deadline.

Does the AI literacy obligation in Article 4 apply to us if we only use minimal-risk AI tools?

Yes. Article 4 applies to all providers and deployers of AI systems, regardless of risk tier. The scope of what AI literacy requires in practice is calibrated to the systems in use and the technical background of the staff concerned, but the obligation itself is universal. A business using only AI-powered spam filters or recommendation engines is still required to ensure that staff dealing with those systems have a sufficient level of understanding of what those systems do.

We are a non-EU business selling AI software to EU enterprise customers. Which deadlines apply to us?

If your software is a high-risk AI system under Article 6, your provider obligations apply from 2 August 2026 and you must appoint an EU-established Authorised Representative before that date. If your software is a GPAI model placed on the EU market from 2 August 2025, GPAI obligations and the Authorised Representative requirement applied from that date. If your software is minimal or limited risk, you are not subject to the high-risk or GPAI frameworks but remain subject to Article 4 (AI literacy) and Article 50 (transparency obligations) where applicable.

We modified our existing AI system significantly in March 2026. Does this affect our timeline?

Yes. If the modification meets the definition of substantial modification in Article 3(23), meaning it affects the system’s conformity with the Act’s requirements or changes its intended purpose, the modified system is treated as a new system. Full provider obligations apply from the date of the modification. You cannot rely on the August 2026 application date as the start of your compliance period for a substantially modified system.

What happens to systems that are prohibited under Article 5 if they were already on the market before February 2025?

There are no transitional provisions for prohibited practices. Article 5 prohibitions applied from 2 February 2025 with no grace period for systems already on the market. Any system meeting the description of a prohibited practice was required to cease operating by that date. The transitional provisions in Article 111 apply only to high-risk AI system and GPAI model obligations, not to prohibited practices.

When do notified body requirements apply?

Notified body requirements under Articles 28 to 39 apply in connection with the conformity assessment obligations for high-risk AI systems. Since conformity assessment must be completed before market placement, and high-risk AI system obligations apply from 2 August 2026, notified body assessments for systems requiring third-party conformity assessment must be completed before that date for new market placements. For legacy systems relying on the transitional provisions, third-party conformity assessment must be completed before 2 August 2027.

This guide reflects the text of Regulation (EU) 2024/1689 as published in the Official Journal on 12 July 2024, the Digital Omnibus proposals published in February 2025, and applicable guidance issued by the European AI Office through May 2026. It is published for general informational purposes and does not constitute legal advice.