See which AI Act rules already apply and what comes next.
Keep legal deadlines, standards dates and voluntary guidance separate when planning work.
The original prohibited practices and AI literacy rules began to apply in February 2025, followed by model-provider duties in August 2025. Most other rules, including Article 50 transparency duties, began to apply on 2 August 2026. Later deadlines cover specific transitions and high-risk duties. The , Regulation (EU) 2026/1744, changed several dates; the milestones below reflect that amendment.
An tells you when a legal rule applies. Adoption, publication and entry into force are separate events. The original Act was adopted on 13 June 2024, published on 12 July 2024 and entered into force on 1 August 2024. then sets staged application dates.
Label every source. The AI Act and Regulation (EU) 2026/1744 are binding law. A political agreement still needs the final legislative steps. Commission guidelines explain its interpretation; drafts and consultations may change. Codes of practice are voluntary tools for meeting underlying legal duties.
Keep the existing legal date until the published amendment enters into force. Store proposed changes and other milestones separately, with their status and source.
Sources (3)
Article 113 is the adopted-law baseline for entry into force and staged application; Article 111 provides transition rules for systems and GPAI models already on the market or in use.
It shall apply from 2 August 2026
Commission guidance identifies the draft classification-guideline status, the consultation that closed on 23 July 2026, and the high-risk dates announced for the AI Omnibus.
Application and enforcement timeline
Binding amending Regulation published on 24 July 2026 and in force from 27 July 2026; it sets the revised high-risk, sandbox, and Article 50 marking dates.
The original Chapters I and II rules began to apply on 2 February 2025. Screen releases, purchases and deployments for Article 5 prohibited practices. Support AI literacy for people operating or using AI on the organisation's behalf. The later-added content prohibitions have their own December 2026 date.
model-provider duties began to apply on 2 August 2025. Providers need Article 53 documentation, information for companies integrating the model, a copyright policy and a public training-content summary, subject to the relevant exceptions. Models with systemic risk also require Article 55 evaluation, risk mitigation, incident and cybersecurity work.
Sources (2)
Original Article 4 wording for the historical 2 February 2025 milestone; the amended duty from 27 July 2026 requires measures supporting AI literacy development.
a sufficient level of AI literacy
The Commission states that GPAI provider obligations entered into application on 2 August 2025, enforcement powers apply from 2 August 2026, and pre-existing models have a 2 August 2027 compliance transition.
From 2 August 2025
Most AI Act provisions began to apply on 2 August 2026. Article 50 can require AI-interaction notices, machine-readable marking of synthetic output, notices for emotion recognition or biometric categorisation, and disclosures for deepfakes or certain public-interest text. Check each actor, use and exception separately.
Only the Article 50(2) marking duty has the limited old-system transition: providers of systems placed on the market before 2 August 2026 have until 2 December 2026 to implement marking and detection. Final Article 50 guidelines were published on 20 July 2026; the final voluntary transparency code was published on 10 June 2026.
Commission enforcement powers for providers began to apply on 2 August 2026. National AI regulatory sandboxes must be operational by 2 August 2027 under amended Article 57. These supervised testing settings preserve prohibited-practice rules and do not automatically prove conformity.
The new Article 5(1)(ba) and (bb) content prohibitions, with paragraphs 1a and 1b, apply on 2 December 2026. Check intended generation or manipulation, foreseeable and reproducible outcomes, safeguards, and deployer purpose. Record this screening separately from the Article 50(2) transition ending on the same day.
Sources (4)
Articles 50 and 113 support the transparency application date and general application baseline; Regulation (EU) 2026/1744 amends the sandbox deadline and adds the Article 50(2) transition.
Transparency obligations for providers and deployers of certain AI systems
Binding source for the 2 August 2027 regulatory-sandbox deadline and the 2 December 2026 Article 50(2) transition for systems already on the market.
The Commission page records the 10 June 2026 publication of the final voluntary transparency code and the binding Article 50 duties it is intended to support.
adherence to the code is voluntary
Official announcement confirming publication of the final transparency guidelines on 20 July 2026 and the 2 August 2026 application date for Article 50 duties.
which start to apply on 2 August 2026
models placed on the market before 2 August 2025 must comply by 2 August 2027 under Article 111.
Amended applies Chapter III Sections 1-3, except Article 6(5), from 2 December 2027 to Annex III high-risk systems and from 2 August 2028 to Article 6(1) product-linked systems. Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July 2026.
For other high-risk systems already on the market or in service before their applicable Chapter III date, amended Article 111(2) generally makes the rules apply only if significant design changes occur from that date. Article 5 prohibitions remain applicable.
High-risk systems intended for public-authority use have a 2 August 2030 compliance deadline for providers and deployers. AI components of Annex X large-scale IT systems placed on the market or put into service before 2 August 2027 have a separate 31 December 2030 deadline under Article 111(1). Check the exact transition population before changing a plan.
Sources (3)
This source reports the revised high-risk dates and states that the classification guidelines remain draft; the targeted consultation closed on 23 July 2026 and final Commission adoption remains pending.
Following the political agreement on the AI Omnibus
Binding source for the amended 2 December 2027 and 2 August 2028 high-risk dates, published on 24 July 2026 and in force from 27 July 2026.
The Commission confirms the 2 August 2027 transition for GPAI models placed on the market before 2 August 2025.
By 2 August 2027
CEN-CENELEC announced the provider quality-management standard EN 18286:2026 on 31 July 2026. The Commission adopted Decision (EU) 2026/2274 on 12 October and published it on 14 October 2026, when it entered into force.
From 14 October, conformity with the standard supports a presumption of conformity, a legal assumption limited to the AI Act requirements covered. Annex ZA states the conditions and exclusions. Keep evidence for uncovered requirements.
The citation leaves Chapter III deadlines unchanged: 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) systems, except Article 6(5). Providers may choose the standard; the citation creates no general certificate deadline.
Sources (2)
Articles 1-2 and the Annex publish EN 18286:2026 on 14 October 2026. Presumption of conformity covers only requirements covered by the standard.
Official announcement dated 31 July 2026 confirms publication and provider quality-management purpose. Annex ZA in the standard states the coverage and conditions.
Each row should answer five questions: what happens, when, who is affected, who owns the work, and where is the evidence? Add the legal status so readers can tell a binding deadline from a guidance publication.
Review the row when the intended purpose, model, market, role, affected people, integration or classification changes. Also review it when the controlling law or guidance changes.
Keep events separate from duties. One event may create no operator deadline. One can create different work for providers, deployers, importers, distributors, product manufacturers, providers, public authorities and Member States.
A political agreement alone leaves the legal deadline unchanged. Track it separately. Update the deadline after checking the final adopted text, Official Journal publication, entry into force and the provision amended.
No. A code can support evidence of compliance. The legal duty and come from the AI Act or later binding legislation. Record code participation separately.
Use the month, such as July 2026. Leave the day unspecified unless a source confirms it.
Sources (1)
The Commission roadmap identifies planned 2026 guidance on high-risk classification, transparency, serious incidents, FRIA, value-chain responsibilities, substantial modification, post-market monitoring, and simplified SME quality-management elements.
clear and practical instructions on how to apply the AI Act
Use the timeline to understand the sequence, then assign actions and evidence to each milestone that affects your systems or models.
"The guidelines clarify the classification of AI systems as high-risk"
"Application and enforcement timeline"
"Following the political agreement on the AI Omnibus"
"Commission publishes guidelines on transparency obligations"
"which start to apply on 2 August 2026"
"From 2 August 2025"
"By 2 August 2027"
"a sufficient level of AI literacy"
"support compliance with the rules"
"adherence to the code is voluntary"
"Application and enforcement timeline"
"clear and practical instructions on how to apply the AI Act"
"transparency of AI-generated content"
"Transparency obligations for providers and deployers of certain AI systems"
"It shall apply from 2 August 2026"
"Entry into force and application"
Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.
Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.
Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.
Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.
Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.
Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.
Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.
Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.
Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.
Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.
Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.
Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.
Check each AI tool, decide which duties apply, and give every action an owner and evidence link.
Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.
Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.
Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.
High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.
Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.
Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.
Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.
Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.
Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.
Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.
Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.
Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.
Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.
Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.
Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.
See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.
See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.
Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.
Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.
Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.
Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.