The EU AI Act (Regulation 2024/1689) entered into force on August 1, 2024, but its obligations phase in over four years. Some rules are already enforceable. The ones that carry the heaviest burden for mid-market deployers do not bite until December 2027. Knowing which deadlines apply to your business — and what to prioritise — is essential for compliance planning.
This guide covers every major deadline, what each means for deployers, and what the Digital Omnibus changed when it deferred the high-risk regime in July 2026.
The Full Timeline
Already in Effect
February 2, 2025 — Prohibited Practices + AI Literacy
What happened: Two sets of obligations became enforceable.
Prohibited AI practices (Article 5) are now banned. The following uses of AI are illegal in the EU:
- Social scoring that leads to detrimental or unfavourable treatment, whether by public authorities or private companies
- Exploitation of vulnerabilities related to age, disability, or social or economic situation
- Subliminal manipulation techniques that cause harm
- Real-time remote biometric identification in publicly accessible spaces for law enforcement (with limited exceptions)
- Untargeted scraping of facial images from the internet or CCTV to build facial recognition databases
- Emotion recognition in workplace and educational settings
- Biometric categorisation based on sensitive characteristics (race, political opinions, religious beliefs, sexual orientation)
From December 2, 2026, the Digital Omnibus adds two more: AI systems used to generate or manipulate non-consensual intimate imagery, and AI systems used to generate child sexual abuse material.
AI literacy (Article 4) requires all providers and deployers to take measures to support the AI literacy of their staff and of anyone else operating AI systems on their behalf. The Digital Omnibus (Regulation (EU) 2026/1744) softened the original wording, which required them to ensure a sufficient level of literacy: the duty is now to take measures, without guaranteeing any particular level for any individual. Those measures should account for:
- Their technical knowledge and experience
- The context in which the AI systems are used
- The persons or groups on whom the AI systems will be used
What you should have done by now:
- Audited all AI systems against the prohibited practices list
- Discontinued any systems that fall under Article 5 prohibitions
- Established an AI literacy training programme for relevant staff
- Documented the training provided
If you have not done these things, you are already non-compliant. Address this immediately.
August 2, 2025 — GPAI Rules + Governance
What happened: Obligations for general-purpose AI (GPAI) models under Chapter V became enforceable. This primarily affects GPAI model providers (companies like OpenAI, Anthropic, Google, Meta that build foundation models), not deployers.
Key provisions:
- Article 53 — GPAI model providers must maintain technical documentation, provide information to downstream providers, comply with EU copyright law, and publish a training content summary
- Article 55 — GPAI models with systemic risk (trained with >10^25 FLOPs) face additional obligations: model evaluations, adversarial testing, incident reporting, and cybersecurity protections
- Governance structures — The European AI Office, AI Board, advisory forum, and national competent authorities began full operation
What this means for deployers: Mostly indirect. Your GPAI providers (if you use ChatGPT, Claude, or similar models directly) should be complying with these obligations. You may want to verify that your AI vendors have adequate documentation and transparency measures in place, particularly if you build products on top of GPAI models.
August 2, 2026 — Transparency + The Penalty Framework
What happened: The transparency duties that apply to everyone, regardless of risk tier, took effect — along with the machinery for enforcing the Act.
Transparency obligations (Article 50):
- Deployers of AI systems that interact with natural persons must inform them they are interacting with AI
- Deployers of emotion recognition or biometric categorisation systems must inform those exposed
- AI-generated content (deepfakes, synthetic text) must be labelled as such
Penalty regime (Articles 99-101):
- The penalty framework is enforceable
- Up to €35M or 7% of turnover for prohibited practices
- Up to €15M or 3% of turnover for high-risk violations — exposure that attaches once the high-risk duties below apply
- Up to €7.5M or 1% of turnover for incorrect information
- Reduced caps for SMEs and startups
What you should have done by now: Audited every customer-facing AI touchpoint and added a disclosure wherever a person interacts with an AI system or sees AI-generated content. This is the cheapest obligation in the Act to satisfy and the easiest to be caught missing, because a regulator or a complainant can check it from outside your business.
Note that this date was the main enforcement date for high-risk systems. It is not any more — see the Digital Omnibus section below.
Still Ahead
December 2, 2027 — Annex III High-Risk Obligations
What happens: This is the date that matters most for mid-market businesses. The bulk of the AI Act's obligations become enforceable for the eight Annex III use-case categories — including credit scoring (5(b)), insurance pricing and risk assessment (5(c)), recruitment, and essential private and public services.
For deployers of high-risk AI systems (Article 29):
- Use systems according to provider instructions
- Assign competent human oversight personnel
- Ensure input data relevance
- Monitor AI system operations
- Retain automatically generated logs (minimum 6 months)
- Report serious incidents to providers and authorities
Fundamental Rights Impact Assessment (Article 27):
- Deployers of high-risk AI in certain categories must complete an FRIA before deploying or continuing to use high-risk AI systems
- This applies to public bodies, private entities providing public services, and deployers of credit scoring, insurance risk, recruitment, and certain other high-risk systems
Registration obligations (Article 49):
- Deployers of high-risk AI systems must register in the EU database before putting the system into use
What you must do before this date:
- Complete your AI system inventory and risk classification
- Implement human oversight procedures for all high-risk systems
- Complete fundamental rights impact assessments where required
- Establish monitoring and logging processes
- Register high-risk AI systems in the EU database
- Document everything
August 2, 2028 — Annex I Systems
What happens: High-risk AI systems that are safety components of products covered by Annex I EU harmonisation legislation (medical devices, machinery, toys, civil aviation, automotive, etc.) must fully comply. These systems get extra time because they are already subject to existing EU product safety frameworks.
What this means for deployers: If you use AI-enabled products that fall under existing EU product safety legislation, your vendors should be completing conformity assessments during this period. Verify compliance as part of your vendor management process.
The Digital Omnibus — What Actually Changed
The European Commission proposed the Digital Omnibus package in 2025 to amend several digital regulations, the AI Act among them. It is no longer a proposal. The Council approved it on June 29, 2026, and Regulation (EU) 2026/1744 entered into force on July 27, 2026.
The change that matters:
The Annex III high-risk obligations moved from August 2, 2026 to December 2, 2027 — a sixteen-month deferral. Annex I embedded-product obligations moved from August 2, 2027 to August 2, 2028.
What did not move:
- Prohibited practices (Article 5) — enforceable since February 2025
- AI literacy (Article 4) — enforceable since February 2025, as amended by the Digital Omnibus
- GPAI provider obligations (Chapter V) — enforceable since August 2025
- Article 50 transparency duties — enforceable since August 2, 2026
If you were building towards August 2026, nothing you built is wasted. The requirements did not get lighter; the date got later.
Why the deferral is not a reason to stop
Three reasons, in order of how quickly they will reach you.
1. Your buyers did not get a deferral. Enterprise procurement questionnaires and vendor due-diligence packs already ask for AI risk classification, human oversight procedures, and impact assessments. A deal blocked on a security-and-compliance review is blocked on the buyer's timeline, not the legislature's. That is the version of this deadline most mid-market companies will actually meet first.
2. Systems placed on the market before the date are treated differently. A high-risk system already on the market when the obligations apply is not swept into the full regime until it is substantially modified. Being compliant before December 2, 2027 is therefore worth more than being compliant on it — early work buys a position you keep, rather than a box you tick.
3. The work takes longer than the gap suggests. A fundamental rights impact assessment is three to four weeks per system. Inventory and classification is two to four weeks. Evidence compilation runs for months. Sixteen extra months sounds generous until you divide it by the number of systems in a mid-market estate and subtract the months where nobody is available to do the work.
Our recommendation: treat December 2, 2027 as the statutory backstop, not the plan. Plan to be ready when a customer asks — which, if you sell to enterprises or regulated financial institutions, is already happening.
What to Do Now vs Later
Do Now (Already Overdue)
- Discontinue prohibited AI practices — Article 5 has been enforceable since February 2025
- Implement AI literacy training — Article 4 is already enforceable
- Implement transparency disclosures for all AI-user interactions — Article 50 has been enforceable since August 2, 2026
- Build your AI system inventory — you cannot assess risk without it
- Start risk classification — map each system to Annex III categories
Do Before December 2, 2027 (And Before Your Next Enterprise Deal)
- Complete fundamental rights impact assessments for high-risk systems requiring them under Article 27
- Implement human oversight procedures for high-risk systems (Article 14 + Article 29)
- Set up logging and monitoring for high-risk systems (Article 12 + Article 29)
- Register high-risk systems in the EU database (Article 49)
- Document everything — your compliance evidence needs to be audit-ready
These are also the items enterprise procurement teams ask about, so the practical deadline is usually whichever comes first: December 2027, or the next customer security review.
Can Wait Until 2028
- Annex I product safety compliance — only if you deploy AI systems that are safety components of products under EU harmonisation legislation
- Advanced conformity assessment processes — primarily a provider obligation; deployers should verify vendor compliance
Planning Your Compliance Programme
For a mid-market business with 5-15 AI systems, expect the compliance programme to take 3-6 months from start to audit-ready state. The main workstreams:
- AI System Inventory and Classification — 2-4 weeks
- Gap Analysis — what documentation and processes you already have vs what you need — 2-3 weeks
- Fundamental Rights Impact Assessments — 3-4 weeks per high-risk system
- Human Oversight and Monitoring Implementation — 4-6 weeks
- Documentation and Evidence Compilation — ongoing, 4-8 weeks for initial build
- Training and Awareness — 2-3 weeks for programme design, ongoing delivery
Against December 2027 that looks comfortable. It stops looking comfortable the moment you count systems: those per-system figures multiply, and the calendar does not. A business with a dozen AI systems that starts in the last two quarters before the deadline is doing the same scramble it would have done for August 2026 — and doing it after the enterprise buyers have already asked. Compliance automation can compress these timelines significantly, particularly for evidence collection, gap analysis, and ongoing monitoring.
The businesses that will be best positioned are those that treat compliance not as a one-time project but as an ongoing process — because that is exactly what the AI Act requires.