The EU AI Act timeline

What applies, from when, and to whom.

Read it as a calendar of duties. For each date: who it binds, what it requires, and an example you will recognise.

1. 2 Feb 2025 Applies today
   WhoEvery organisation that uses AI at work — any sector, any size.

   WhatTwo duties. The prohibited uses of AI may not be used at all. And the AI-literacy duty: you must take measures to support the development of AI literacy among the people who operate AI on your behalf. Regulation (EU) 2026/1744 clarified that this is an obligation of effort — you are not required to guarantee any particular level of AI literacy in any individual.

   For exampleYou may not run emotion-recognition on staff, or rank people through “social scoring”. And an HR team using a CV-screening tool should be equipped to read its output critically — not treat it as a verdict.
2. 2 Aug 2025 Applies today
   WhoTwo audiences: the makers of the large AI models — and, through the penalties, you.

   WhatThe large “foundation” models behind tools like ChatGPT or Claude carry transparency and documentation duties. And the penalty rules become applicable: each Member State has to have designated who enforces the Act and what the sanctions are.

   For exampleThe model-maker must publish a summary of its training data. For you, the point is simpler: from this date the Act is enforced by named national authorities.
3. 2 Aug 2026 Applies today
   WhoEveryone in scope. This was the Act’s general application date — and it has now passed.

   WhatThe bulk of the Regulation became applicable. The Article 50 transparency duties: people must be told when they are dealing with an AI system, and AI-generated or manipulated content must be disclosed as such. The enforcement architecture applies in full, and the European Commission may now fine the providers of general-purpose AI models.

   For exampleA customer-service chatbot has to make clear it is not a person. A synthetic image or video your organisation publishes has to be disclosed as AI-generated.
4. 2 Dec 2026 Coming — added by the Omnibus
   WhoProviders of generative AI — plus a new prohibition that binds everyone.

   WhatA new prohibition on AI that creates non-consensual intimate imagery or child sexual abuse material (the “nudifier” applications). And the end of a four-month transitional window: generative-AI systems already placed on the market before 2 August 2026 must by this date mark their output in machine-readable form, as Article 50(2) requires.

   For exampleA tool that fabricates fake nude images of real people is prohibited outright. And the content-generation tool your team already uses has to mark what it produces as AI-made — the duty sits with whoever supplies it.
5. 2 Dec 2027 Coming — the principal date for employers
   WhoProviders and deployers of “high-risk” AI: recruitment, performance management, access to credit, education and essential services.

   WhatThe substantial obligations. If you deploy such a system: keep a competent human in control, run a fundamental-rights impact assessment (a documented check of who the system could unfairly affect), keep logs, and use it only as intended. Providers — those who build, brand or substantially change the system — add formal conformity checks (a CE-style sign-off) and registration in an EU database.

   For exampleIf you use AI to screen, rank or score job candidates, this is the date your governance has to be in place. Note the consequence: the system you deploy today is the one you will have to prove compliant then.
6. 2 Aug 2028 Coming
   WhoMakers of regulated products with AI inside — machinery, medical devices, toys, lifts and the like.

   WhatThe same high-risk obligations, for AI built into products already regulated under other EU law.

   For exampleA scanner that uses AI to flag tumours: the maker must meet the high-risk rules before the device can be placed on the market.

Two questions decide how much of the high-risk row applies to you: is your system actually high-risk, and are you its provider or its deployer? Both are easier to get wrong than you would think — see deployer or provider? and the AI Act, explained.