The EU AI Act does not switch on all at once. It phases in between 2025 and 2027. The short version: AI literacy and the outright bans are already in force, and the duties that matter most for the average organisation, the high-risk and transparency obligations, apply from 2 August 2026. Here is the whole timeline, in plain terms.
This is a readiness explainer, not legal advice. To see where you stand against these dates, take the free EU AI Act readiness check.
The timeline
- August 2024: the Act enters into force. The clock starts, but almost nothing applies yet.
- February 2025: bans and literacy. Prohibited practices (Article 5) are banned outright, and the AI literacy duty (Article 4) applies. Both are live now.
- August 2025: general-purpose AI. Obligations for providers of general-purpose AI models begin, along with the governance and penalty machinery. This is mostly a concern for model providers, not everyday deployers.
- 2 August 2026: the big one. The core obligations for high-risk AI apply: deployer duties (Article 26), fundamental-rights impact assessments where required (Article 27), and transparency (Article 50). If a date matters to you, it is probably this one.
- August 2027: AI inside regulated products. High-risk AI that is a safety component of an already-regulated product gets a longer runway, and general-purpose models on the market before August 2025 must be brought into line.
What this means if you use AI
If you are a deployer, someone who uses AI rather than builds and sells it, two clocks are already running and one big one is ahead:
- Now: make sure you are not using anything banned, and that your people have enough AI literacy. These are not “later” problems.
- By August 2026: if you deploy high-risk AI, have the oversight, monitoring, logging and (where needed) impact assessments in place. That is not a lot of runway for something you have not started.
The trap is treating 2 August 2026 as the only date and ignoring the two duties that already apply. We covered the obligations themselves in the EU AI Act for deployers; this post is just the calendar.
Why “we’ll deal with it in 2026” is risky
Three reasons. First, the literacy and prohibition duties are already enforceable, so “later” is already wrong for those. Second, the August 2026 work, inventory your AI, classify it, stand up oversight and evidence, takes months, not weeks. Third, enterprise buyers are asking vendors to prove governance now, well ahead of the legal deadline, so the commercial clock runs faster than the regulatory one.
One honest caveat: the high-risk timing could still move under the EU’s Digital Omnibus, which is not yet finally adopted. Plan for the dates above; don’t bet on them slipping.
Where to start
Map the AI you use and classify it by risk, that tells you which of these dates actually apply to you. The free EU AI Act readiness assessment does that in about ten minutes, no email required. When you want to turn the deadlines into a plan, talk to us.
For the full picture, see the EU AI Act guide.
Frequently asked questions
When does the EU AI Act fully apply?
It phases in. The ban on prohibited practices and the AI literacy duty applied from February 2025, general-purpose AI model rules from August 2025, the bulk of the high-risk and transparency obligations from 2 August 2026, and a final set for AI built into regulated products from August 2027.
What is already in force?
Two things bite now. Prohibited practices (Article 5) are banned outright, and the AI literacy duty (Article 4) requires you to ensure the people using or affected by your AI understand it well enough to use it responsibly.
When do the deployer obligations for high-risk AI start?
2 August 2026. From then, deployers of high-risk AI must use it per the provider's instructions, assign human oversight, monitor it, keep logs, and where required run a fundamental-rights impact assessment. Transparency duties under Article 50 apply from the same date.
Could these dates change?
Possibly. The EU's Digital Omnibus package has floated changes to the high-risk timeline, but it is not yet finally adopted. Plan around the current dates and watch for movement.
Building something you need to govern?
Start with a fixed-scope AI Opportunity & Risk Audit.
Meet an Expert