Compliance CalendarEU AI Act

EU AI Act deadlines and compliance calendar

Find the date that applies to your AI system or model, then assign the work and evidence.

Covers rules already in use, upcoming deadlines, and transitions for systems and models already on the market.

Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
Overview

Most AI Act rules have applied since 2 August 2026. The next milestones include new prohibitions and a limited synthetic-output marking transition on 2 December 2026, older GPAI model compliance on 2 August 2027, Annex III high-risk duties on 2 December 2027, and product-linked high-risk duties on 2 August 2028. Check the exact provision and any transition before assigning a deadline.

Section 1

Key dates under Article 113

sets when the AI Act applies. Regulation (EU) 2026/1744 amended that schedule: it was published in the Official Journal, the EU's official legal publication, on 24 July 2026 and entered into force on 27 July 2026.

The amendment kept the general application date of 2 August 2026. It changed the dates for Chapter III Sections 1-3, which cover high-risk classification, requirements and operator duties, except Article 6(5). The dates below identify the exact provisions.

Use one row per deadline. List the affected system or model, legal provision, owner, required evidence, and an earlier internal completion date.

  • 1 August 2024: the Regulation entered into force, but entry into force did not make every operator duty immediately applicable.
  • 2 February 2025: Chapters I and II apply; cover AI literacy and the original Article 5 prohibited-practice categories. The new Article 5 provisions added by Regulation (EU) 2026/1744 apply from 2 December 2026.
  • 2 August 2025: Chapter III Section 4, Chapter V, Chapter VII, Chapter XII, and Article 78 apply, except Article 101. These cover notified bodies, general-purpose AI models, governance, penalties and confidentiality.
  • 27 July 2026: Regulation (EU) 2026/1744 enters into force and Articles 102-110 apply.
  • 2 August 2026: the Regulation applies as the main application date for obligations not covered by the specific exceptions.
  • 2 December 2026: the new Article 5(1) points (ba) and (bb), plus Article 5(1a) and (1b), apply. These introduce the specified non-consensual intimate-content and child sexual abuse material prohibitions.
  • 2 December 2027: Chapter III Sections 1-3, except Article 6(5), apply to high-risk systems classified under Article 6(2) and Annex III.
  • 2 August 2028: Chapter III Sections 1-3, except Article 6(5), apply to high-risk systems classified under Article 6(1) and Annex I.
  • Keep: source citation, affected chapter or article, affected system or model inventory entries, owner, readiness status, and approval date.
Section 2

Already applies: prohibited uses and AI literacy

Chapters I and II began to apply on 2 February 2025. Assign someone to screen products and deployments for prohibited practices, and someone to support AI literacy for staff and others using AI on the organisation's behalf.

Since 27 July 2026, amended Article 4 requires providers and deployers to take measures supporting AI literacy development. Consider people's knowledge, experience and training, the system's context, and the people affected. The duty does not require a guaranteed individual literacy level.

Keep the training audience and materials, product-screening notes, and release decision. Update them when the system or its use changes.

  • AI literacy owner: legal/compliance sets the standard; product, engineering, support, and business owners identify who operates or uses each AI system.
  • Prohibited-practice owner: product and legal screen manipulation, exploitation of vulnerabilities, social scoring, certain biometric uses, and other Article 5 categories against the actual feature behavior.
  • Evidence: role-based literacy plan, attendance or completion records, product review notes, prohibition-screen result and redesign or stop decision where required, and release-ticket links.
  • Review again when: new AI feature, new user group, new deployment context, supplier model change, or expansion into workplace, education, law-enforcement, biometric, or vulnerable-person contexts.
Section 3

Already applies: GPAI model-provider duties

General-purpose AI (GPAI) models can support many tasks and applications. Chapter V model-provider duties began to apply on 2 August 2025. They differ from the duties of an organisation using a supplier's AI product.

If you build a product with a supplier's model, assign product and procurement owners to collect model documentation and supplier contacts. Record whether you use the model, integrate it into a system you provide, or modify and supply the model yourself. That decision affects your legal role.

  • GPAI provider owner: maintain model inventory, documentation status, copyright-policy evidence, public summary status, and systemic-risk notification review where relevant.
  • Downstream/product owner: record which GPAI model versions are integrated, what supplier documentation was received, and what product obligations depend on that model.
  • Compliance owner: track Chapter VII governance contacts, Article 78 confidentiality handling, and Chapter XII penalty exposure except Article 101 at this stage.
  • Procurement owner: add renewal triggers for model-provider documentation, material model changes, new model versions, and supplier non-response.
  • Evidence: model card or equivalent documentation, supplier correspondence, model version register, integration notes, and internal assessment of provider versus downstream-provider role.
Section 4

Upcoming deadlines in 2026, 2027 and 2028

Since 2 August 2026, the general AI Act rules, most Article 50 transparency duties and Commission enforcement powers for GPAI providers apply. Final Article 50 guidance was published on 20 July 2026; use it to interpret the duties while checking the legal text.

Track each later deadline separately. The Article 50(2) transition ends on 2 December 2026 only for provider-side marking of synthetic outputs from systems placed on the market before 2 August 2026. National AI regulatory sandboxes, supervised settings for development and testing, must be operational by 2 August 2027.

For Chapter III Sections 1-3, except Article 6(5), the amended dates are 2 December 2027 for Annex III high-risk use cases and 2 August 2028 for Article 6(1) product-linked systems. GPAI models placed on the market before 2 August 2025 have their own 2 August 2027 transition.

  • 2 August 2026: confirm general applicability, Article 50 interaction notices, synthetic-content marking, deployer disclosures, GPAI enforcement readiness, and any sandbox participation as separate rows.
  • Article 50 evidence: map each system to the applicable provider or deployer duty, document any exception, retain the approved notice or disclosure, and record how machine-readable marking is implemented where required.
  • 2 December 2026: complete the Article 111(4) transition for provider-side synthetic-output marking and detection for covered systems placed on the market before 2 August 2026, and apply the new Article 5 prohibitions.
  • 2 August 2027: close transition work for GPAI models placed on the market before 2 August 2025.
  • 2 December 2027 and 2 August 2028: complete the relevant Chapter III Sections 1-3, except Article 6(5), work for Annex III and Article 6(1) high-risk systems respectively.
  • High-risk owner: map the exact Annex I product route or Annex III use case, technical documentation, conformity route, registration, monitoring, and deployer dependencies.
  • Review again when: formal amendment, final guidance, substantial modification, intended-purpose change, new model, new product route, or new deployment context.
Section 5

Check transitions for existing systems and models

Article 111 gives specific transitions to certain systems and models already on the market or in service. Check the first market or service date, design changes, intended public-authority use and model status against the relevant rule below.

Record the Article 111 conclusion beside the deadline. A later date applies only if the system or model meets that transition's conditions.

  • AI components of Annex X large-scale IT systems: AI systems that are components of the listed large-scale IT systems and were placed on the market or put into service before 2 August 2027 must be brought into compliance by 31 December 2030. This transition does not suspend Article 5 prohibitions.
  • Other high-risk AI systems placed on the market or put into service before the Chapter III date that applies under : Article 111 applies the Regulation only if, from that date, the systems are subject to significant design changes. This transition also leaves Article 5 prohibitions applicable.
  • Synthetic-content systems placed on the market before 2 August 2026: providers must take the necessary steps to comply with Article 50(2) by 2 December 2026.
  • High-risk AI systems intended for use by public authorities: providers and deployers must take necessary steps to comply by 2 August 2030.
  • GPAI models placed on the market before 2 August 2025: providers must take the necessary steps to comply by 2 August 2027.
  • Evidence: first placing-on-market or putting-into-service date, change-control record, public-authority use flag, GPAI model market date, and owner sign-off on the applicable transition row.
Section 6

Standards dates have a different purpose

EN 18286:2026 is a provider quality-management standard. CEN-CENELEC announced it on 31 July 2026. The Commission adopted Decision (EU) 2026/2274 on 12 October and published it on 14 October 2026, when it entered into force.

From 14 October, conformity with the standard supports a presumption of conformity: a legal assumption that the covered requirements are met. Annex ZA lists the conditions and exclusions. Providers still need evidence for requirements outside that coverage.

The citation leaves the Chapter III dates unchanged: 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) systems, except Article 6(5). Use of the standard is voluntary; 14 October is not a deadline to obtain a certificate.

  • Assign the provider quality owner to map the standard edition to Article 17 procedures, each system version, evidence and remaining requirements. Set an internal review date before the relevant conformity assessment.
  • Record 14 October 2026 as the Official Journal citation and entry-into-force date. Recheck the listing when preparing a conformity claim and after later amendments.
  • January 2027 is the standard foreword's month for national adoption and withdrawal of conflicting standards. This timetable applies to standards bodies. Providers' legal deadlines follow the Act; no exact January day is specified.
Section 7

What to put in each calendar row

Link each row to the affected systems or models. Show the deadline, missing evidence, responsible owner and next decision so the team can act without rereading the whole law.

Use a legal deadline only when a source supports it. Track expected guidance and Article 112 Commission evaluations or reports as items to monitor, with no invented operator deadline.

Set an earlier internal completion date to allow for classification, implementation, evidence approval, supplier follow-up and release approval. Keep the legal deadline visible beside it.

  • Calendar row fields: date, source article or guidance page, affected chapter or obligation set, systems/models in scope, owner, evidence owner, readiness status, and next review trigger.
  • System/model fields: provider, deployer, importer, distributor, downstream provider, GPAI provider, public-authority use, Annex I product route, Annex III category, and significant-change status.
  • Evidence fields: source URL, source quote, inventory export, role assessment, risk classification, supplier documentation, training record, conformity evidence, registration evidence, and approval record.
  • Owner fields: legal interpretation, product behavior, engineering controls, security evidence, privacy review, procurement supplier file, quality/conformity assessment, operations monitoring, and executive escalation.
  • Watch items: Commission guidance, harmonised standards, supplier model changes, product redesign, new deployment context, and authority requests; do not turn watch items into dated obligations without source support.
Primary sources

References and citations

digital-strategy.ec.europa.eu4 citations
Referenced sections
  • Commission guidance page supporting GPAI provider application, enforcement, and transition planning dates.
  • Commission guidance page used for GPAI provider application and enforcement planning dates.
  • Commission guidance confirms GPAI enforcement powers from 2 August 2026 and the 2 August 2027 transition for models placed on the market before 2 August 2025.
Show 1 more
  • Commission guidance page confirming the GPAI transition date for models placed on the market before 2 August 2025.
"providers of general-purpose AI models"
More quoted passages
"obligations for providers of GPAI models entered into application"
"Application and enforcement timeline"
"By 2 August 2027"
digital-strategy.ec.europa.eu3 citations
Referenced sections
  • Commission policy page supporting risk-category context, high-risk implementation steps, and the current application timeline.
  • Commission policy page used to cross-check the risk-based implementation context and current high-risk planning sequence.
  • Commission policy page used for implementation context, risk categories, high-risk provider workflow, and transition support through the AI Pact and Service Desk.
"A Risk-based Approach"
More quoted passages
"risk-based rules for AI developers and deployers"
eur-lex.europa.eu3 citations
Referenced sections
  • Primary legal text for the AI Act staged application dates used in this compliance calendar.
  • Primary legal text confirming that Chapters I and II apply from 2 February 2025.
  • Primary legal text confirming the 2 August 2025 application of Chapter V and related chapters listed in Article 113.
"It shall apply from 2 August 2026."
More quoted passages
"Chapters I and II shall apply from 2 February 2025"
"Chapter V, Chapter VII and Chapter XII"
eur-lex.europa.eu3 citations
Referenced sections
  • Binding amendment supporting the revised Article 5, Article 111, Article 113, high-risk, and sector-law dates in this calendar.
  • Binding amendment supporting its 27 July 2026 entry into force, the new Article 5 application date, and the revised Chapter III high-risk dates.
  • Binding amendment supporting the Article 111(4) synthetic-output transition, new Article 5 date, and revised Chapter III high-risk application dates.
ai-act-service-desk.ec.europa.eu2 citations
Referenced sections
  • Official Service Desk article supporting the prohibited-practices screening workstream in the 2 February 2025 calendar row.
  • Official Service Desk article used for prohibited-practice screening under Chapter II.
"Prohibited AI practices"
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Official announcement supporting the 20 July 2026 publication date, the scope of the final guidance, and the 2 August 2026 application date for Article 50 transparency duties.
  • Commission announcement confirming publication of the final transparency guidelines on 20 July 2026 and the 2 August 2026 application date for Article 50 obligations.
"Commission publishes guidelines on transparency obligations"
More quoted passages
"which start to apply on 2 August 2026"
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission page supporting the voluntary GPAI Code of Practice as a planning aid for providers of general-purpose AI models.
  • Commission page used to identify the voluntary GPAI Code of Practice as an implementation planning aid for GPAI providers.
"General-Purpose AI Code of Practice"
More quoted passages
"voluntary tool"
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission source for the draft high-risk classification guidance, the targeted consultation, and the revised Annex III and product-integrated high-risk dates.
  • Non-binding Commission guidance explains the Annex III and product-integrated high-risk dates and identifies the classification guidance as draft pending final adoption.
"Application and enforcement timeline"
cencenelec.eu
Referenced sections
  • Official announcement dated 31 July 2026 confirms publication and provider quality-management purpose. Annex ZA in the standard states the coverage and conditions.
eur-lex.europa.eu
Referenced sections
  • Primary legal text used for cited calendar rows, AI Act roles, staged dates, transition provisions, and high-risk classification.
"binding in its entirety and directly applicable"
eur-lex.europa.eu
Referenced sections
  • Primary legal text for transition rows covering existing high-risk AI systems, Annex X large-scale IT systems, public-authority use, and pre-2 August 2025 GPAI models.
"AI systems already placed on the market"
eur-lex.europa.eu
Referenced sections
  • Primary legal text for Article 113 staged application dates, Article 111 transition provisions, Article 4 AI literacy, Article 5 prohibited practices, and Article 6(1) high-risk classification.
"Entry into force and application"
eur-lex.europa.eu
Referenced sections
  • Original legal text used for the AI literacy duty that began to apply with Chapter I on 2 February 2025 and was replaced on 27 July 2026.
"ensure, to their best extent, a sufficient level of AI literacy"
Show all related guides (34)

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Check whether the Act applies

Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.

Are you the provider or the deployer? | EU AI Act

Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.

Do you need a notified body? | EU AI Act

Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.

Does this tool count as AI? | EU AI Act

Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.

How do you monitor AI after release? | EU AI Act

Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.

Is this industry use high-risk? | EU AI Act

See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.

What belongs in the technical file? | EU AI Act

See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.

What must general-purpose model providers do? | EU AI Act

Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.

When must you disclose AI use? | EU AI Act

Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.

When must you report a serious incident? | EU AI Act

Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.