EU AI Act timeline: what applies, and when
By Sam Rivera, Founder, SentinelPanda · June 1, 2026 · 3 min read · AI Governance
You probably do not need to be ready for all of the AI Act today, but two of its phases are already in force. The rest land on a published calendar.
The phased application
The EU AI Act entered into force on 1 August 2024. Article 113 sets out the phased application: most provisions become applicable two years after entry into force (2 August 2026), but specific chapters land earlier or later. The phasing is not arbitrary — it reflects how heavy the obligations are and how much time providers need to comply.
Compliance work should be aligned to these dates, not bunched at the deadline. The Act anticipates that providers will use the phasing window to align with harmonised standards as they are published in the Official Journal of the EU.
2 February 2025 — prohibited practices and AI literacy
Chapter II of the Act (prohibited AI practices) and Article 4 (AI literacy obligations) became applicable on 2 February 2025. Prohibited practices include social scoring by public authorities, untargeted scraping of facial images, emotion recognition in workplaces and schools, biometric categorisation by sensitive attributes, predictive policing based purely on profiling, and (with narrow exceptions) real-time remote biometric identification in publicly accessible spaces.
Article 4 is short and easy to miss: providers and deployers must take measures to ensure a sufficient level of AI literacy among their staff and others operating AI systems on their behalf. There is no prescribed curriculum, but expect supervisory authorities to ask what your training programme looks like.
2 August 2025 — GPAI, governance, penalties
On 2 August 2025, Chapter V (general-purpose AI models) became applicable, along with Chapter III Section 4 (notifying authorities and notified bodies), most of Chapter VII (governance), Chapter XII (penalties), and Article 78 (confidentiality). GPAI model providers must produce and publish a sufficiently detailed summary of training content, comply with EU copyright law, and prepare technical documentation. GPAI models with systemic risk carry additional obligations: model evaluations, systemic-risk assessment, incident reporting, cybersecurity.
From this date the penalty regime is also in force. Fines can reach the higher of €35 million or 7% of global annual turnover for the most serious infringements (prohibited practices), with lower tiers for other non-compliance.
2 August 2026 — most provisions become applicable
This is the main applicability date. High-risk AI system obligations under Chapter III for systems placed on the market after this date — risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy/robustness/cybersecurity — become enforceable. Conformity assessment procedures, CE marking, EU declaration of conformity, registration in the EU database all apply.
Article 6(1) (classification rules for high-risk systems used as safety components of regulated products) is delayed slightly to 2 August 2027 to align with the underlying product-safety legislation. But the bulk of the Act is live on 2 August 2026.
2 August 2027 — legacy high-risk systems
High-risk AI systems placed on the market before 2 August 2026 are not exempt forever. By 2 August 2027 they must comply if they undergo significant modifications, and Article 111(2) extends specific obligations to large-scale IT systems used by EU authorities that were already in use. If you operate AI systems that were grandfathered in 2026, this is the date by which compliance work must be completed.
What to put on your calendar
- Now: AI literacy programme in place; inventory of AI use cases against the prohibited-practices list.
- Now: if you build or distribute a general-purpose AI model, technical documentation and copyright compliance work is already due.
- Before 2 Aug 2026: conformity assessment work for any high-risk system you intend to place on the market.
- Before 2 Aug 2027: compliance plan for legacy high-risk systems still in service.
- Continuous: track harmonised standards as they appear in the Official Journal — they create the presumption of conformity that simplifies the evidentiary burden.