EU AI Act timeline — every deadline that matters

The five enforcement dates

1 August 2024 — Act enters into force

Regulation 2024/1689 was published in the Official Journal on 12 July 2024 and entered into force 20 days later. No substantive obligations applied yet — this is the clock starting.

2 February 2025 — Prohibitions + AI literacy

Article 5 (prohibited practices) becomes enforceable. Article 4 (AI literacy of staff who interact with AI systems) also applies — every business using AI has to take measures to ensure their staff have a sufficient understanding of what the AI does and its limits. Article 4 doesn't prescribe how, but documented training (even informal) is the default safe answer.

2 August 2025 — GPAI + governance structures live

Obligations on providers of General-Purpose AI Models (GPAI) take effect. Member State competent authorities are formally designated. The European AI Office becomes operational. Doesn't directly affect most SMEs unless they're putting their own foundation model on the market.

2 August 2026 — Transparency + high-risk (subject to Omnibus)

The big one. Article 50 transparency obligations become enforceable — chatbot disclosures, AI-generated content marking, deepfake labelling, biometric inference notice. The Annex III high-risk obligations were also scheduled for this date; the Digital Omnibus proposal would delay this portion to 2 December 2027 (Parliament voted to support; trilogue ongoing).

Penalty regime fully active from this date.

2 August 2027 — Annex I product-safety AI

AI used as a safety component of products already regulated under existing harmonised legislation (medical devices, machinery, toys, lifts, etc.) becomes subject to the high-risk AI regime. This category has the longest runway because it dovetails with existing conformity assessment cycles.

What to do before each date

Before 2 August 2026 — the priority

1. List every AI system that touches a user — chatbots, AI content, AI image tools, accessibility overlays, biometric inference, deepfakes.
2. Classify each against Article 50 — which sub-rule applies?
3. Implement the disclosure or marking.
4. Screenshot or capture proof and store it.
5. For any Annex III high-risk system you operate, name the human-oversight owner and capture the vendor's instructions for use — even if the Omnibus delays the substantive obligations, the discipline is the same.

Before 2 August 2027 (if you build product-safety AI)

1. If you make medical devices, machinery, toys, or other products under EU harmonised safety law and you're adding an AI safety component — start the conformity assessment process now. Notified Bodies have capacity constraints.

Penalty bands

What you breach	Max fine
Prohibited practices (Article 5)	€35M or 7% of global turnover
Other obligations (incl. Article 50 transparency, Annex III deployer duties)	€15M or 3% of global turnover
Supplying false information to authorities	€7.5M or 1% of global turnover

For SMEs, the cap is the lower of the two amounts — Article 99(6) is a deliberate SME protection.

Klarvo organises and explains EU AI Act compliance. It is not legal advice. For specific legal situations, consult a qualified professional.