EU AI Act Deadlines: The Full Compliance Timeline

The Act entered into force in 2024, but its substantive obligations apply on staggered dates set by Article 113. There are four milestones that matter for most organisations:

• 2 February 2025 — prohibited practices and AI literacy
• 2 August 2025 — general-purpose AI (GPAI) model obligations plus governance and penalties
• 2 August 2026 — Article 50 transparency obligations and most of the rest of the Act
• 2 December 2027 — high-risk obligations for Annex III systems

The sections below break each one down. The safest planning assumption is to work backwards from the deadline that applies to your riskiest system. Run the free risk checker first to find out which tier you fall in.

The first obligations to bite. From this date:

• The prohibited AI practices in Article 5 — the unacceptable-risk uses banned outright — apply.
• The AI literacy duty under Article 4 applies to all providers and deployers.

What to do before this date: Audit your AI uses against the Article 5 ban list and stop anything that falls foul of it — breaches here carry the heaviest fines. In parallel, stand up an AI literacy programme with training records, since that duty has no risk-tier or size threshold and reaches every organisation using AI.

From this date:

• The general-purpose AI (GPAI) model obligations apply — technical documentation, downstream information, a copyright-compliance policy and a training-data summary, with extra duties for GPAI with systemic risk.
• The Act's governance structures and penalties provisions become operational.

What to do before this date: If you develop GPAI models, have your technical documentation, copyright policy and training-content summary ready as living artefacts. If you merely build on someone else's model, confirm your upstream provider will supply the information you need as a downstream provider.

This is the Act's central application date. From here:

• The Article 50 transparency obligations apply — for example, informing people they are interacting with an AI system and labelling certain AI-generated or manipulated content.
• Most of the remaining provisions of the Act become applicable.

What to do before this date: Inventory every user-facing AI touchpoint — chatbots, generated media, emotion or biometric features — and design the disclosures and labels each requires. This is also the point by which your broader compliance framework, described in the complete guide, should be operational.

The final major milestone. From this date, the obligations for high-risk AI systems listed in Annex III apply in full — the provider duties in Articles 9-15 and the deployer duties in Article 26, supported by the Annex IV technical documentation.

What to do before this date: If any of your systems fall under Annex III, this is the most demanding workstream and the one to start earliest. Build your risk-management system, data governance, logging, human oversight and technical documentation well ahead of the date — these cannot be assembled at the last minute.

Enforcement scales to the severity of the breach. Under Article 99, the penalties are:

• Up to €35M or 7% of worldwide annual turnover for breaching the prohibited practices — whichever is higher.
• Up to €15M or 3% for breaching other obligations.
• Up to €7.5M or 1% for supplying incorrect, incomplete or misleading information.

Because the ban and the AI literacy duty came first and the prohibited-practice fines are the largest, the February 2025 milestone is the one to have addressed already. Everything after it rewards early, methodical preparation over deadline-driven scrambling.