AI Act17 May 2026DILAIG

EU AI Act Timeline: Every Key Deadline from 2024 to 2031 (Updated June 2026)

The EU AI Act applies in phases, not all at once. This guide maps every enforcement deadline by date and risk tier- including the confirmed Digital Omnibus postponements- so you know exactly what applies to your organisation and when.

Article written with the help of artificial intelligence — learn more about Article 50

Last updated: June 2026 · Reading time: 8 minutes

The AI Act Does Not Apply All at Once

One of the most common mistakes companies make is treating the EU AI Act as a single compliance deadline. It is not. The regulation uses a phased implementation structure spread over seven years, with different provisions entering into force at different dates.

This matters practically: your compliance priority depends not only on your risk level but on where you stand in the timeline right now.

Digital Omnibus update (September 2026): Regulation (EU) 2026/1744, published in the EU Official Journal on 24 July 2026 and in force since 27 July 2026, has formally postponed two key AI Act deadlines. The full high-risk framework for Annex III standalone systems now applies from 2 December 2027 (postponed from 2 August 2026). The framework for Annex I product-embedded systems now applies from 2 August 2028 (postponed from 2 August 2027). The FRIA obligation (Article 27) is not removed- only its deadline shifts with the same postponement. Fine amounts are unchanged. The table below reflects these confirmed dates.

The Master Timeline at a Glance

Date	What Applies	Status
1 August 2024	AI Act enters into force	✅ In force
2 February 2025	Prohibited AI practices banned · AI literacy obligations	✅ Enforced
2 May 2025	GPAI Code of Practice finalised	✅ Published 10 July 2025
2 August 2025	GPAI model obligations · AI Office operational · Penalty provisions	✅ In force
2 February 2026	Commission high-risk classification guidelines	✅ Published
2 August 2026	Transparency obligations (Article 50) for limited-risk systems	✅ In force
2 December 2027	Full high-risk framework- Annex III standalone systems (postponed from 2 August 2026 by the Digital Omnibus) · AI Office enforcement powers for Annex III	✅ Confirmed
2 August 2027	Legacy GPAI compliance deadline	Upcoming
2 August 2028	Full high-risk framework- Annex I product-embedded systems (postponed from 2 August 2027 by the Digital Omnibus) · First Commission evaluation	✅ Confirmed
2 August 2030	High-risk AI systems used by public authorities must comply	Upcoming
31 December 2030	Large-scale EU IT systems (Schengen, Eurodac, etc.) final deadline	Upcoming
2 August 2031	Full enforcement assessment	Upcoming

Each Deadline in Detail

DILAIG automates this step- free AI Act audit in 20 min, FRIA generation, Annex IV Technical Documentation and EU Declaration of Conformity included. Start the audit →

1 August 2024- Entry into Force

The AI Act (Regulation (EU) 2024/1689) was published in the Official Journal of the EU on 12 July 2024 and entered into force twenty days later. This date starts the clock on all subsequent deadlines. No obligations applied yet for most organisations- this was purely the legal birth of the regulation.

2 February 2025- Prohibited Practices and AI Literacy

What entered into force:

Prohibited AI practices (Article 5) became enforceable. Any AI system that falls into one of the banned categories must have been taken off the EU market or discontinued by this date. The banned systems include:

Subliminal manipulation systems
Systems exploiting vulnerabilities of specific groups
Social scoring by public authorities
(Most) real-time remote biometric identification in public spaces
Emotion inference in workplaces and schools
Facial image scraping for recognition databases
Predictive policing based on personal characteristics

AI literacy obligations (Article 4) also entered into force. Providers and deployers must ensure their staff who work with AI systems have sufficient AI literacy- understanding of AI capabilities, limitations, and the regulatory framework.

Why this matters now: If you are deploying any of the above in the EU, you are already in violation. The fine is up to €35 million or 7% of global annual turnover.

2 May 2025- GPAI Code of Practice Finalised

The General-Purpose AI Code of Practice- the voluntary compliance framework for LLM and foundation model providers- had to be finalised by this date. It was published on 10 July 2025 and endorsed by the European Commission.

Adherence to the Code creates a presumption of compliance with Articles 53 and 55 for GPAI providers. Non-signatories face greater regulatory scrutiny.

2 August 2025- GPAI Rules and Governance

What entered into force:

GPAI model obligations (Articles 51–56): all providers of general-purpose AI models on the EU market must comply with documentation, transparency, copyright, and (for systemic-risk models) red-teaming and incident reporting requirements
AI Office becomes operational with its governance and supervisory functions
Penalty provisions become applicable- fines can now be imposed for GPAI violations
Member States must have designated their national competent authorities
Notified bodies framework activated for conformity assessments

Who is affected: Any company providing an LLM, foundation model, or multimodal model to EU customers or through EU-based downstream providers.

2 February 2026- Commission High-Risk Guidelines

The European Commission must publish guidelines clarifying the implementation of Article 6 (high-risk classification rules) and post-market monitoring requirements. These guidelines help organisations determine whether their system qualifies as high-risk, particularly for edge cases not explicitly addressed in Annex III.

2 August 2026- Transparency Obligations (Article 50)

What enters into force: Transparency obligations under Article 50 for limited-risk systems- chatbots, deepfakes, AI-generated content labelling- apply from this date and are unaffected by the Digital Omnibus.

Who is affected: Any provider or deployer of a system covered by Article 50 transparency rules, regardless of whether the system also qualifies as high-risk.

2 December 2027- Full High-Risk Framework, Annex III (Confirmed)

This is the most significant deadline for most businesses. It was postponed from 2 August 2026 to 2 December 2027 by the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026).

What enters into force:

All obligations for high-risk AI systems (Articles 9–49): risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, conformity assessment, EU Declaration of Conformity, and registration
AI Office full enforcement powers for Annex III systems: the AI Office can conduct investigations, impose fines, and require market withdrawals for high-risk system violations
Article 26 deployer obligations and Article 27 FRIA fully applicable- the FRIA obligation was not removed by the Digital Omnibus, only its deadline shifted with the rest of the Annex III framework

Who is affected: Any provider or deployer of a high-risk AI system as defined in Annex III.

Note: Systems placed on the market before 2 December 2027 that have not been substantially modified are not automatically required to comply- but any substantial modification triggers full compliance.

2 August 2027- Legacy GPAI Compliance

Legacy GPAI models: General-purpose AI models placed on the market before 2 August 2025 must be compliant by this date. This gives earlier GPAI providers a two-year runway to bring existing deployments into compliance. This deadline is unaffected by the Digital Omnibus.

2 August 2028- Full High-Risk Framework, Annex I (Confirmed)

Article 6(1): High-risk AI systems that are safety components of, or are themselves, products covered by EU harmonisation legislation (Annex I- medical devices, machinery, aviation, motor vehicles, toys, etc.) must comply from this date. This is the provision that brings AI embedded in physical products within scope of the AI Act. It was postponed from 2 August 2027 to 2 August 2028 by the Digital Omnibus.

This date also marks the Commission's first evaluation of the AI Office's functioning.

2030–2031- Long-Tail Deadlines

2 August 2030: High-risk AI systems used by public sector bodies must be compliant.

31 December 2030: Large-scale EU IT systems (Eurodac, Schengen Information System, Entry/Exit System, etc.) must comply. These systems are covered by specific EU legislation and were given an extended runway.

2 August 2031: The Commission publishes a full evaluation report on the AI Act's functioning, including whether the AI Office is working effectively and whether any amendments are needed.

Timeline by Risk Tier

Dates below reflect confirmed law, including the Digital Omnibus postponements in force since 27 July 2026.

Risk Tier	Deadline	What You Must Do
Prohibited	2 February 2025 ✅	Discontinue immediately- already enforced
Limited risk	2 August 2026	AI disclosure obligations (chatbots, deepfakes)
High risk- Annex III (providers + deployers)	2 December 2027 (postponed from 2 August 2026)	Full compliance framework (Art. 9–49), FRIA (Art. 27)
High risk- Annex I products	2 August 2028 (postponed from 2 August 2027)	Conformity assessment under product law + AI Act
GPAI- new models	2 August 2025 ✅	Art. 53–55 obligations- already enforced
GPAI- legacy models	2 August 2027	Art. 53–55 obligations
Public sector high-risk	2 August 2030	Full compliance framework

What You Should Be Doing Right Now (as of autumn 2026)

If you have not started your compliance process, here is where the urgency sits:

Immediate: Verify you are not running any prohibited AI practice (Article 5). If you are, stop immediately- enforcement has been active since February 2025.

Critical (deadline: 2 December 2027): If you operate a high-risk AI system under Annex III, your full compliance framework (risk management, technical documentation, conformity assessment, EU Declaration of Conformity, EU database registration, FRIA) must be in place by 2 December 2027, the confirmed deadline under the Digital Omnibus. The AI Office gains full enforcement powers for Annex III systems from that date. The extended runway is not a reason to wait- conformity assessments and documentation take months to prepare properly.

Planning (deadline: 2 August 2028): If your AI is embedded in a physical product (medical device, machinery, vehicle), the Article 6(1) deadline is now 2 August 2028. Conformity assessments through notified bodies take months to schedule regardless of the extended timeline.

Overdue- GPAI: If you provide a GPAI model (LLM, foundation model), obligations under Articles 53–55 have applied since August 2025. If you have not aligned, prioritise this immediately- the Digital Omnibus did not affect GPAI deadlines.

How DILAIG Keeps You on Track

Compliance is not a one-time event. Regulations update, guidelines are published, and your AI systems evolve- the Digital Omnibus postponement is the most recent example. DILAIG's audit is designed to be re-run whenever your system or the regulatory timeline changes- and re-audits after modifications are included in the platform.

The audit determines your risk tier, maps your applicable obligations to specific articles, and generates a prioritised action plan anchored to the timeline above. For high-risk systems, it then produces the mandatory documents required before the applicable deadline.

If you are tracking compliance across multiple AI systems or multiple clients, each with its own timeline, DILAIG also offers an AI agent connection via MCP. A consultant or compliance team can connect an agent (Claude, ChatGPT, Le Chat) to pre-fill audits from internal documents- the draft still requires human review before submission. Learn more about the MCP connection →

→ Start your free AI Act audit- 20 minutes, no credit card required.

View pricing

FAQ: EU AI Act Timeline

Is the 2 December 2027 deadline hard?

Yes. The Digital Omnibus (Regulation (EU) 2026/1744) has been formally adopted, published in the EU Official Journal on 24 July 2026, and entered into force on 27 July 2026. 2 December 2027 is now the legally binding application date for the full high-risk framework under Annex III, including provider obligations (Art. 9–49), deployer obligations (Art. 26), and the FRIA (Art. 27), replacing the original 2 August 2026 deadline.

Does the AI agent/MCP connection affect my audit timeline?

No, it is an optional way to prepare an audit faster if you manage several systems or clients. The agent reads your internal documents to draft answers to the 50-question audit, but it cannot see your score, submit the audit, or generate documents- a human always reviews and validates the draft before submission.

Do the deadlines apply to AI systems already on the market?

Partially. Systems placed on the market before the relevant deadline and not substantially modified benefit from a transition period. But "substantial modification" is defined broadly- a significant change to intended purpose, risk level, or technical architecture triggers full compliance.

What counts as a "substantial modification"?

The AI Act defines it as a change that affects the system's compliance status or alters its risk level. The Commission's guidelines (due February 2026) will provide further clarity. In practice, retraining on new data, adding new use cases, or changing the target population are likely to qualify.

Do the GPAI deadlines apply to open-source models?

Partially. Open-weight models under free licences are exempt from documentation and downstream information obligations (Article 53(1)(a) and (b))- but not if the model is also classified as having systemic risk. The August 2025 deadline applied to all GPAI providers, including open-source.

Key Takeaways

The AI Act is a phased regulation: not all obligations apply at once
Prohibited practices have been enforceable since 2 February 2025
GPAI obligations apply since 2 August 2025- unaffected by the Digital Omnibus
Full high-risk framework for Annex III now applies from 2 December 2027, following the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026)- the most critical deadline for most businesses
Annex I products now have until 2 August 2028 (postponed from 2 August 2027); legacy GPAI models still have until 2 August 2027 (unchanged)
The FRIA (Article 27) obligation was not suppressed by the Digital Omnibus- only its deadline shifted
If you are in Annex III territory, the postponement is not a reason to wait: conformity assessments and documentation take months to prepare