The EU AI Act timeline

What applies, from when, and to whom.

Read it as a calendar of duties. For each date: who it binds, what it requires, and an example you will recognise.

1. 2 Feb 2025 Applies today
   WhoEvery organisation that uses AI at work — any sector, any size.

   WhatTwo duties. The prohibited uses of AI may not be used at all. And the AI-literacy duty: you must take measures to support the development of AI literacy among the people who operate AI on your behalf. Regulation (EU) 2026/1744 clarified that this is an obligation of effort — you are not required to guarantee any particular level of AI literacy in any individual.

   For exampleYou may not run emotion-recognition on staff, or rank people through “social scoring”. And an HR team using a CV-screening tool should be equipped to read its output critically — not treat it as a verdict.
2. 2 Aug 2025 Applies today
   WhoTwo audiences: the makers of the large AI models — and, through the penalties, you.

   WhatThe large “foundation” models behind tools like ChatGPT or Claude carry transparency and documentation duties. And the penalty rules become applicable: each Member State has to have designated who enforces the Act and what the sanctions are.

   For exampleThe model-maker must publish a summary of its training data. For you, the point is the enforcement machinery — though a duty to designate an authority is not the same as a designation actually made. See what is still unsettled, below.
3. 2 Aug 2026 Applies today — the widest row
   WhoEveryone in scope. This was the Act’s general application date — and it has now passed.

   WhatThe bulk of the Regulation became applicable, and this is the row most often understated. The Article 50 transparency duties: people must be told when they are dealing with an AI system, and AI-generated or manipulated content must be disclosed as such. Post-market monitoring and serious-incident reporting — which read like high-risk duties, but sit in a different chapter of the Act and were not deferred with the rest. The conformity-assessment and registration machinery (Articles 40 to 49) — also not deferred. Individuals may complain to a market surveillance authority. And the European Commission may now fine the providers of general-purpose AI models.

   For exampleA customer-service chatbot has to make clear it is not a person. A synthetic image or video your organisation publishes has to be disclosed as AI-generated. And if a system you provide causes a serious incident, the reporting duty is live now — not in 2027.
4. 2 Dec 2026 Coming — added by the Omnibus
   WhoProviders of generative AI — plus a new prohibition that binds everyone.

   WhatA new prohibition on AI that creates non-consensual intimate imagery or child sexual abuse material (the “nudifier” applications). And the end of a four-month transitional window: generative-AI systems already placed on the market before 2 August 2026 must by this date mark their output in machine-readable form, as Article 50(2) requires.

   For exampleA tool that fabricates fake nude images of real people is prohibited outright. And the content-generation tool your team already uses has to mark what it produces as AI-made — the duty sits with whoever supplies it.
5. 2 Dec 2027 Coming — the principal date for employers
   WhoProviders and deployers of “high-risk” AI: recruitment, performance management, access to credit, education and essential services.

   WhatThe substantial obligations — the requirements themselves, and who has to meet them. If you deploy such a system: keep a competent human in control, run a fundamental-rights impact assessment (a documented check of who the system could unfairly affect), keep logs, and use it only as intended. Providers — those who build, brand or substantially change the system — carry the design, data-governance and documentation requirements. What is not deferred to this date is the assessment and registration machinery itself (Articles 40 to 49): that has applied since 2 August 2026. Formally applicable, but dependent on requirements that are not yet applicable themselves.

   For exampleIf you use AI to screen, rank or score job candidates, this is the date your governance has to be in place. Note the consequence: the system you deploy today is the one you will have to account for then — see “does it even reach your system?” below.
6. 2 Aug 2028 Coming
   WhoMakers of regulated products with AI inside — machinery, medical devices, toys, lifts and the like.

   WhatThe same high-risk obligations, for AI built into products already regulated under other EU law.

   For exampleA scanner that uses AI to flag tumours: the maker must meet the high-risk rules before the device can be placed on the market.

Two questions decide how much of the high-risk row applies to you: is your system actually high-risk, and are you its provider or its deployer? Both are easier to get wrong than you would think — see deployer or provider? and the AI Act, explained.

Does it even reach your system?

A calendar tells you when a duty starts. It does not tell you whether that duty reaches the system you are already running — and for anything you put in service before the date, that is the question that decides everything. The Act answers it separately, and the answer is less generous than it first appears.

So there are two questions, not one: when does the duty apply, and does it reach this system? Answer only the first and you will plan against the wrong date.