EU AI Act Timeline: What Applies When, from 2025 to 2028 (Updated for the Digital Omnibus)

The EU AI Act is the world’s first comprehensive law on artificial intelligence, and its biggest practical difficulty has always been timing. Obligations arrive in waves, different rules apply to different actors, and in 2026 the Digital Omnibus on AI moved several of the most important deadlines. This guide puts every date that matters in one place, explains who each one affects, and ends with what to do now.

For live countdowns to each deadline, see the AI regulation countdown tracker.

The timeline at a glance

Date	What applies	Who it affects
1 August 2024	The Act enters into force	Everyone in scope (no obligations yet)
2 February 2025	Prohibited AI practices banned; AI literacy duty	All providers and deployers
2 August 2025	General-purpose AI (GPAI) model obligations; governance structures; penalties regime	GPAI model providers; Member States
2 August 2026	Transparency duties (Article 50); Commission enforcement powers for GPAI	Providers and deployers of certain AI systems; GPAI providers
2 December 2026	End of grace period for marking AI-generated content from systems already on the market	Providers of generative AI systems
2 August 2027	GPAI models placed on the market before 2 August 2025 must comply	Legacy GPAI model providers
2 December 2027	High-risk obligations for Annex III systems (deferred by the Digital Omnibus)	Providers and deployers of high-risk AI
2 August 2028	High-risk obligations for AI in Annex I regulated products (deferred by the Digital Omnibus)	Product manufacturers and AI providers

Stage by stage

2 February 2025: prohibitions and AI literacy

Article 5 bans a short list of practices considered an unacceptable risk. They include manipulative or deceptive techniques that cause significant harm, exploitation of vulnerabilities related to age, disability or social or economic situation, social scoring, predicting criminality based solely on profiling, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools (with narrow exceptions), biometric categorisation to infer sensitive characteristics, and real-time remote biometric identification in public spaces for law enforcement except in tightly defined cases.

The same date brought the AI literacy duty in Article 4. The Digital Omnibus has since reframed it as a duty to take measures supporting the AI literacy of staff and others operating AI systems, rather than a guarantee of any particular level of literacy. In practice, organisations should still be able to show training and guidance proportionate to the AI they use.

2 August 2025: general-purpose AI

Providers of general-purpose AI models, the large models that power chatbots and many downstream products, became subject to obligations on technical documentation, information for downstream providers, a copyright compliance policy and a public summary of training content. Models with systemic risk carry additional duties on evaluation, incident reporting and cybersecurity. The Commission’s General-Purpose AI Code of Practice offers one route to demonstrating compliance.

Models already on the market before that date have until 2 August 2027 to comply.

2 August 2026: transparency

Article 50 introduced transparency duties that affect a wide range of businesses, not only high-risk ones:

• People must be informed when they are interacting with an AI system, unless it is obvious.
• Providers of generative AI must mark synthetic audio, image, video and text output in a machine-readable format so it can be detected as AI-generated.
• Deployers of deepfakes must disclose that the content has been artificially generated or manipulated, with adjustments for artistic and satirical work.
• Deployers publishing AI-generated text on matters of public interest must disclose it, unless it has undergone human editorial review and someone holds editorial responsibility.

Under the Digital Omnibus, generative AI systems already on the market have until 2 December 2026 to meet the marking requirement.

2 December 2027 and 2 August 2028: high-risk AI

High-risk AI is the heart of the Act. Annex III lists use cases such as biometrics, critical infrastructure, education, employment and worker management, access to essential services including credit and insurance, law enforcement, migration and border control, and the administration of justice and democratic processes. Annex I covers AI that is a safety component of products already regulated by EU product legislation, such as machinery and medical devices.

Providers of high-risk systems face requirements on risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, along with conformity assessment, registration and post-market monitoring. Deployers must use systems according to instructions, assign human oversight, monitor operation and, in some cases, carry out a fundamental rights impact assessment.

These obligations were originally due on 2 August 2026 (Annex III) and 2 August 2027 (Annex I). The Digital Omnibus on AI deferred them to 2 December 2027 and 2 August 2028 respectively.

Who the Act applies to, including outside the EU

The Act’s reach is deliberately wide. It applies to providers placing AI systems or general-purpose AI models on the EU market, whether or not they are established in the EU; to deployers established in the EU; and to providers and deployers in third countries where the output of the AI system is used in the EU. Importers, distributors and authorised representatives also carry duties. A software company in Lahore, London or Los Angeles can therefore be in scope if its AI product or its outputs reach users in the EU.

Penalties

Fines follow three tiers: up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for most other breaches; and up to EUR 7.5 million or 1% for supplying incorrect, incomplete or misleading information to authorities. For SMEs and start-ups the lower of the two figures applies. GPAI providers face separate fines imposed by the Commission.

What to do now

1. Inventory your AI. List every AI system you build, buy or use, and every general-purpose model you rely on. Note who supplies it and where its outputs go.
2. Classify each system. Is it prohibited, high-risk, subject only to transparency duties, or minimal risk? Are you a provider, deployer, importer or distributor for each?
3. Close the 2026 gaps first. Transparency notices, AI-generated content marking and AI literacy measures are live now.
4. Plan for high-risk deadlines. If anything is high-risk, the deferral to December 2027 is preparation time, not a reprieve. Conformity work takes many months.
5. Fix your contracts. Supplier terms should allocate AI Act responsibilities, information duties and cooperation. Customer terms should reflect transparency and acceptable use. The AI Vendor Terms Red-Flag Scanner helps review supplier terms quickly.
6. Watch for change. Guidelines, standards and implementing acts continue to arrive. The Global AI Law Tracker records status changes with sources.

The bottom line

The Digital Omnibus bought time for high-risk AI, but it did not pause the Act. Prohibitions, AI literacy, general-purpose AI rules and transparency duties already apply. Businesses that use the extra time to inventory, classify and contract properly will reach December 2027 ready. Those that read “deferred” as “dropped” will not.