Updated May 2026 to reflect the Digital Omnibus agreement of 7 May 2026, which pushes the AI Act high-risk enforcement deadline from August 2026 to December 2027.
The EU Artificial Intelligence Act introduces the world’s first comprehensive regulatory framework for artificial intelligence. But unlike many laws that apply immediately, the AI Act follows a phased implementation timeline.
Different obligations apply gradually between 2024 and 2027, depending on the type of AI system and the role of the organisation (provider, deployer, importer or distributor).
For companies operating in Europe — especially SMEs — understanding when each obligation takes effect is critical for planning compliance.
This guide explains the EU AI Act implementation timeline step by step, focusing especially on 2026 and 2027, when the most significant obligations begin to apply.
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
Overview: EU AI Act Timeline at a Glance
| Date | What Happens |
|---|---|
| 1 August 2024 | AI Act enters into force |
| 2 February 2025 | Ban on prohibited AI practices |
| 2 August 2025 | Governance rules and GPAI obligations apply |
| December 2027 | Most AI Act provisions apply |
| August 2028 | Extended transition for some high-risk AI systems |
The Act entered into force on 1 August 2024, beginning a two-year transition period before the majority of obligations become fully applicable.
2024: The AI Act Enters into Force
The EU AI Act was published in the Official Journal in July 2024 and entered into force on 1 August 2024.
This date marked the start of the transition period but did not yet impose most obligations on companies.
Instead, the EU institutions and Member States began preparing the regulatory infrastructure, including:
- Establishing the EU AI Office
- Preparing technical standards
- Creating conformity assessment procedures
- Setting up national supervisory authorities
For companies, the period between 2024 and 2025 was primarily a preparation phase.
February 2025: Prohibited AI Practices Become Illegal
The first binding obligations began 2 February 2025.
From this date, AI systems considered to pose an “unacceptable risk” are prohibited.
Examples include:
- Social scoring systems
- AI exploiting vulnerable groups
- Certain forms of biometric surveillance
- Manipulative AI systems that distort behaviour
Companies that were using such systems needed to stop deploying them immediately or face regulatory penalties.
This stage of the Act reflects the EU’s intention to remove the most harmful uses of AI early, even before the broader regulatory framework becomes fully applicable.
August 2025: Governance Rules and GPAI Obligations
The next major milestone arrived on 2 August 2025.
Two important regulatory layers began to apply:
1. Governance infrastructure
EU Member States were required to establish the institutional architecture necessary to supervise the AI Act.
This includes:
- National market surveillance authorities
- Notification bodies
- Regulatory sandboxes
- Cooperation with the European AI Office
2. General-Purpose AI (GPAI) rules
Obligations for general-purpose AI models (such as foundation models used in generative AI systems) also began applying.
Providers of GPAI models must comply with requirements such as:
- Technical documentation
- Transparency obligations
- Risk mitigation measures for systemic models
December 2027: Most AI Act Obligations Apply
The most important milestone for businesses is December 2027 – the final enforcement phase of the AI Act has been pushed from August 2026 to December 2027, following the agreement on the Digital Omnibus package reached by the Council of the European Union and the European Parliament on 7 May 2026.
From this date, the majority of AI Act provisions become applicable.
For companies deploying or developing AI systems, this includes:
High-risk AI system requirements
High-risk systems must comply with obligations such as:
- Risk management systems
- Data governance and quality controls
- Technical documentation
- Human oversight mechanisms
- Accuracy, robustness and cybersecurity requirements
Obligations for deployers
Companies that use AI systems in their operations must:
- Monitor system performance
- Ensure human oversight
- Keep logs and documentation
- Inform affected persons where required
Transparency requirements
Certain AI systems must disclose their use, for example:
- AI-generated content
- AI chatbots
- Emotion recognition systems
For most organisations, 2027 is the real compliance deadline.
August 2028: Final Phase for Certain High-Risk Systems
Some high-risk AI systems receive a longer transition period until August 2028.
This mainly applies to AI systems embedded in regulated products, such as:
- Medical devices
- Aviation systems
- Automotive safety systems
- Industrial machinery
These products already operate under sector-specific safety regulations, which is why they require a longer transition period.
By August 2028, the EU AI Act will be fully operational across the entire AI ecosystem.
What Companies Should Focus on in 2026 and 2027
Companies should focus on three immediate priorities:
1. Identify whether AI systems fall under the AI Act
Many organisations still underestimate how broadly the Act applies.
Common corporate use cases include:
- HR screening tools
- Fraud detection systems
- Customer service chatbots
- Risk scoring systems
2. Determine risk classification
Each AI system must be classified as:
- prohibited
- high-risk
- limited risk
- minimal risk
3. Prepare compliance documentation
The AI Act introduces extensive documentation obligations.
Companies should prepare:
- AI system inventories
- technical documentation
- risk management frameworks
- governance procedures
This preparation phase is essential before the December 2027 compliance deadline.
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
Frequently Asked Questions
When does the EU AI Act start applying?
The AI Act entered into force on 1 August 2024, but most obligations apply gradually between 2025 and 2027 and beyond.
When do the bans on harmful AI systems apply?
The ban on prohibited AI practices began on 2 February 2025.
When do most AI Act obligations apply?
Most requirements — including those for high-risk AI systems — begin applying in December 2027, following the Digital Omnibus agreement of 7 May 2026.
When will the AI Act be fully implemented?
The final transition period ends on August 2028, when additional obligations for certain high-risk systems embedded in regulated products take effect.
Do SMEs need to comply with the AI Act?
Yes. The AI Act applies to all companies operating AI systems in the EU market, including SMEs.
However, the regulation contains support measures and regulatory sandboxes designed to help smaller companies comply.
Key Takeaway
The EU AI Act is not a single compliance deadline but a multi-year regulatory rollout.
For most companies, the critical milestone is December 2027, when the majority of obligations become enforceable.
Organisations that start preparing now — especially by identifying their AI systems and risk levels — will be significantly better positioned to navigate the new regulatory landscape.
