The EU AI Act (Regulation 2024/1689) entered into force on 1 August 2024 following publication in the Official Journal of the European Union. The Regulation is being applied in stages: not all obligations take effect at the same time. Acting on the basis of an incorrect date risks being too early or too late. This article provides an overview of the official timeline, including the most recent changes introduced by the Digital Omnibus agreement of 7 May 2026.
2 February 2025: prohibited practices and AI literacy
The first obligations took effect on 2 February 2025. From that date, the prohibited practices under Article 5 became applicable. These cover eight categories of AI systems that may no longer be placed on the market, put into service, or used within the EU. Examples include systems that use subliminal techniques to manipulate behaviour, social scoring systems, and real-time biometric identification in publicly accessible spaces for law enforcement purposes.
At the same time, the AI literacy obligation under Article 4 entered into application on 2 February 2025. Providers and deployers are required to ensure that their staff have a sufficient level of AI literacy. That obligation applies regardless of the risk classification of the AI systems they deploy.
2 August 2025: GPAI obligations and governance
On 2 August 2025, the rules for general-purpose AI (GPAI) models became applicable. Providers of GPAI models must comply with technical documentation requirements, transparency obligations, and, for models posing systemic risk, additional requirements around safety evaluations. Codes of practice for GPAI had to be finalised by 2 May 2025 at the latest.
Also from 2 August 2025, Member States were required to designate their national competent authorities, and the EU-level governance structure, including the AI Board, the scientific panel and the advisory forum, had to be operational. The Member States' penalty rules also became applicable from that date.
Providers of GPAI models placed on the market before 2 August 2025 have until 2 August 2027 at the latest to comply with the obligations, pursuant to Article 111(3) of the Regulation.
2 August 2026: start of enforcement and transparency obligations
On 2 August 2026, the vast majority of the Regulation formally enters into application. Enforcement at national and EU level officially begins. The transparency obligations under Article 50, including the requirement to inform users when they are interacting with an AI system, become applicable. Member States must also have at least one regulatory sandbox for AI in operation by that date.
For high-risk AI systems listed in Annex III (stand-alone high-risk systems, such as applications in recruitment, credit scoring, education, law enforcement, and border control), 2 August 2026 was originally the application date as well. As a result of the Digital Omnibus agreement, that date has been moved to 2 December 2027.
Digital Omnibus: agreement of 7 May 2026
On 7 May 2026, the European Parliament and the Council of the EU reached a provisional political agreement on the Digital Omnibus on AI. The agreement introduces targeted amendments to the AI Act aimed at simplification and smoother implementation.
The most significant change concerns the deadlines for high-risk AI:
- Annex III systems (stand-alone high-risk AI in sectors such as education, employment, law enforcement, and border control): obligations apply from 2 December 2027 rather than 2 August 2026.
- Annex I systems (high-risk AI embedded in regulated products, such as medical devices, machinery, and vehicles): obligations apply from 2 August 2028 rather than 2 August 2027.
The agreement is provisional and must be formally adopted by the European Parliament and the Council. Formal adoption is expected before 2 August 2026. Following publication in the Official Journal, the amendments enter into force three days later.
What remains unchanged
The prohibitions under Article 5, the AI literacy obligation under Article 4, and the GPAI obligations fall outside the scope of the Digital Omnibus and continue to apply on their original dates. The transparency obligation under Article 50(2), the so-called watermarking requirement for synthetic content, has been delayed by four months under the Omnibus agreement and now applies from 2 December 2026.
Transition periods for existing systems
Separate transitional provisions under Article 111 apply to systems already on the market. High-risk AI systems put into service before the application date that undergo no substantial modifications are not, as a rule, subject to the immediate compliance obligation. For systems used by public authorities, the long-stop date is 2 August 2030.
Further evaluation milestones
The European Commission will evaluate, by 2 August 2028 at the latest, the list of high-risk applications in Annex III, the functioning of the AI Office, and the governance structure, among other matters. Large-scale IT systems listed in Annex X that were put into service before 2 August 2027 must be brought into compliance by 31 December 2030 at the latest.