The complete EU AI Act timeline
The Act was published in the Official Journal of the European Union on July 12, 2024, and entered into force 20 days later. Obligations then activate on a staggered schedule keyed to that entry-into-force date. Here is every milestone in order.
February 13, 2024
Political agreement between Parliament and Council
The European Parliament and Council of the EU reached political agreement on the final text of the EU AI Act after trilogue negotiations. This date marks the end of legislative drafting and the beginning of formal adoption procedures.
August 1, 2024
EU AI Act enters into force
The Act was published in the Official Journal on July 12, 2024, and entered into force on August 1, 2024, 20 days after publication. All staggered obligation dates are measured from this date. The EU AI Office was established and began operations.
February 2, 2025
Prohibited AI practices become binding (Chapter II, Art. 5)
Six months after entry into force. The prohibitions on unacceptable-risk AI systems are now enforceable. Prohibited systems include subliminal manipulation of persons, exploitation of vulnerabilities (age, disability), social scoring by public authorities, real-time remote biometric identification in public spaces without authorization, and untargeted scraping of biometric data from the internet. Companies must have ceased operating any prohibited systems by this date.
August 2, 2025
GPAI model obligations binding (Chapter V); EU AI Office begins supervision; notified body accreditation opens
Twelve months after entry into force. General-purpose AI model obligations under Chapter V apply. Providers of GPAI models (including large language models and multimodal foundation models) must have technical documentation, transparency information for downstream operators, a copyright compliance policy, and an acceptable-use policy. GPAI providers must have Codes of Practice in place or demonstrate compliance via other means. The EU AI Office begins active supervision of GPAI providers. Notified bodies can begin accreditation for high-risk conformity assessments.
February 2, 2026
Commission reviews systemic risk thresholds for GPAI models
The European Commission reviews whether the 10^25 FLOPs training-compute threshold for systemic-risk GPAI models remains appropriate and may update it. This affects which GPAI providers face the additional obligations under Article 51, including adversarial testing, incident reporting, and cybersecurity measures.
August 2, 2026
MAIN ENFORCEMENT DATE — general applicability of the Act
The Act is "fully applicable" for most companies from this date. Binding obligations: General-purpose AI (Chapter V) enforcement authority is fully active. Article 50 transparency obligations for chatbots, voice agents, and AI-generated content are binding. Article 49 registration for providers in the EU AI Act database. Chapter III Section 4 (notified bodies) and enforcement mechanisms in Chapter VIII are fully operational. National Market Surveillance Authorities have full penalty authority, with fines reaching 7% of global annual turnover for prohibited AI violations.
December 2, 2027
Annex III high-risk AI systems become fully binding
Per the Digital Omnibus proposal (a legislative deferral, not an exemption), Annex III high-risk AI system obligations are extended to this date. Annex III categories include: biometric identification and categorization, critical infrastructure management, education and vocational training decisions, employment decisions (hiring, promotion, task allocation, monitoring), access to essential private and public services, law enforcement, migration and border management, and administration of justice. Full conformity assessments, quality management systems, registration, and post-market monitoring obligations apply from this date. Begin preparation now as conformity assessment documentation typically takes 3-6 months to complete properly.
August 2, 2030
Annex I product safety high-risk systems
AI systems that are safety components of products already covered by EU product safety legislation listed in Annex I (medical devices, machinery, civil aviation, toys, lifts, and others) become subject to the EU AI Act's high-risk provisions at this date, when existing product-specific legislation is updated to reference the AI Act. This is the longest tail in the Act's compliance timeline.
What's binding on August 2, 2026
Here is the complete list of what applies from the main enforcement date:
- Prohibited practices (Chapter II): Already in force since Feb 2, 2025, but full enforcement authority including maximum penalties is now active.
- GPAI obligations (Chapter V): Full enforcement against providers of general-purpose AI models including technical documentation, transparency summaries, copyright policies, and (for systemic-risk models) adversarial testing and incident reporting.
- Article 50 transparency disclosures: Every AI system that interacts with natural persons, including chatbots, voice agents, and AI-generated content systems, must disclose its AI nature clearly before the interaction begins. Not buried in the terms of service. Not after the fact.
- Article 49 EUDR registration: Providers of high-risk AI systems must register in the EU AI Act database maintained by the European AI Office.
- Enforcement authority (Chapter VIII): National Market Surveillance Authorities are fully operational. Penalties up to 7% of global annual turnover for prohibited AI, 3% for most other violations, 1.5% for providing false information to authorities.
What's deferred to December 2, 2027
Annex III high-risk AI categories face a legislative deferral to December 2, 2027, per the Digital Omnibus proposal. This covers AI used in biometric identification and categorization, critical infrastructure (energy, water, transport), education and vocational training decisions, employment decisions (hiring, promotion, task allocation, monitoring), access to essential services (credit scoring, insurance, housing), law enforcement (crime risk assessment, profiling, evidence evaluation), migration and border management, and administration of justice. The deferral is a proposal to extend the application date, not an exemption from the law. Companies in these categories must begin conformity assessment preparation now, since the documentation and assessment process takes 3-6 months and enforcement will begin immediately on December 2, 2027.
What you need to do before August 2, 2026
Pre-August 2, 2026 action list
Complete your AI system inventory. Map every AI component you build or deploy that touches EU persons. Without an inventory you cannot classify risk or demonstrate compliance to an authority.
Add Article 50 transparency disclosures to every chatbot, voice agent, and AI-generated content system. Disclosure must appear before the interaction starts, not in the terms of service.
Complete GPAI compliance package if you develop or fine-tune a general-purpose AI model. Technical documentation, transparency summary, copyright compliance policy, and (if applicable) systemic risk assessment and adversarial testing.
Appoint an EU representative if you're a non-EU company placing AI on the EU market. Article 22 requires this by August 2, 2026.
Begin Annex III conformity assessment preparation now if any of your systems fall in high-risk categories. The December 2027 deadline is closer than it looks once you factor in 3-6 months of assessment lead time.
EU AI Act Resource Hub
- Free EU AI Act Risk Classifier — classify your AI system in 90 seconds
- EU AI Act Compliance Deadline 2026 — what you must do now
- EU AI Act Key Dates and Timeline — every deadline from 2024 to 2030
- EU AI Act Annex III High-Risk Checklist — full requirements breakdown
- EU AI Act for Fintech and AI Companies — sector-specific guidance
- EU AI Act Penalties and Fines — what enforcement looks like
- EU AI Act vs GDPR — key differences explained
- EU AI Act for Non-EU Companies — are you in scope?
- EU AI Act Checklist for SaaS and Startups — step-by-step
- The Better Societies EU AI Act Compliance Package — assessment from €1,000