EU AI Act: Timeline and Deadlines 2024–2028 (as of October 2026)

The EU AI Act timeline phases in the application of Regulation (EU) 2024/1689 over several years: entry into force on 1 August 2024, prohibited practices and AI literacy since 2 February 2025, GPAI obligations since 2 August 2025, general application since 2 August 2026, and high-risk obligations staggered through to 2028. Since the Digital Omnibus, all application dates have been fixed.

• Already in full force: prohibitions (Art. 5) and AI literacy (Art. 4) since 2 February 2025, GPAI obligations (Art. 51–55) since 2 August 2025.
• Since 2 August 2026: transparency obligations (Art. 50) and enforcement by the authorities, plus fines for GPAI providers (Art. 101).
• High-risk obligations: Annex III from 2 December 2027, Annex I from 2 August 2028, fixed with binding effect by the Digital Omnibus Regulation (EU) 2026/1744. Art. 26 (deployer obligations), Art. 27 (FRIA, Annex III only) and Art. 73 (incident reporting) only cover high-risk systems and only apply from these dates.

Legal basis and entry into force

The EU AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. As a directly applicable regulation, it applies in all EU Member States without national transposition. Entry into force merely started the clock: no immediate obligations arose at that point.

The actual mechanism lies in Art. 113: the AI Act activates its obligations in several waves. It is precisely these staggered AI Act deadlines that make the timeline relevant for decision-makers, because depending on the role (provider, deployer, GPAI provider) and risk class, a different date applies.

The milestone table: AI Act timeline at a glance

The following overview shows the key dates under Art. 113 and Art. 111 as amended by the Digital Omnibus Regulation (EU) 2026/1744. The regulation was published in the Official Journal on 24 July 2026 and has been in force since 27 July 2026. All application dates in the table are therefore binding.

Phase 1 (since Feb 2025): prohibitions and AI literacy

Since 2 February 2025, two blocks have applied that affect every deployer, regardless of whether a system qualifies as high-risk at all.

First, the prohibited practices (Art. 5): eight categories that are entirely banned in the EU. Particularly relevant for DACH companies is Art. 5(1)(f), namely emotion recognition in the workplace and in educational institutions (with narrow exceptions for medical and safety purposes). An HR analytics agent that infers employees' mood, concentration or stress from video, audio or biometrics is prohibited in the workplace. The Digital Omnibus Regulation (EU) 2026/1744 added two prohibitions to Art. 5 that apply from 2 December 2026: AI systems that generate non-consensual intimate deepfakes, and AI systems that generate child sexual abuse material.

Second, AI literacy (Art. 4): providers and deployers must take measures to support the AI literacy of their staff and of other people who operate AI systems on their behalf. Since 27 July 2026, Art. 4 as amended by Regulation (EU) 2026/1744 no longer requires a specific level of literacy. The obligation applies across all risk levels, and therefore also to minimal-risk internal agents. No certificate is required. A documented training program remains the best evidence when a supervisory authority asks.

Phase 2 (since Aug 2025): GPAI obligations

Since 2 August 2025, the obligations for providers of general-purpose AI models (Art. 51–55) have applied. They concern the model layer on which practically every modern agent is built. A model qualifies as a GPAI model if it has an indicative training compute of around 10^23 FLOP or more plus language generation capability; it qualifies as GPAI with systemic risk if cumulative training compute exceeds 10^25 FLOP (Art. 51(2)). Fines for GPAI providers (Art. 101) became enforceable on 2 August 2026; legacy models placed on the market before 2 August 2025 have until 2 August 2027 to adapt (Art. 111(3)).

Phase 3 (since Aug 2026): general application and transparency

Since 2 August 2026, the AI Act has applied in general, and the authorities have been enforcing it. For deployers of AI agents, Art. 50 (transparency) matters most; GPAI providers also face fines under Art. 101. Art. 26 (deployer obligations), by contrast, only covers high-risk AI systems and applies from 2 December 2027 (Annex III) or 2 August 2028 (Annex I). The fundamental rights impact assessment (FRIA) under Art. 27 only covers certain deployers of Annex III systems and applies from 2 December 2027. The duty to report serious incidents under Art. 73 also falls only on providers of high-risk systems. For Art. 50 labeling, there is one transition period: providers of generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to implement machine-readable marking under Art. 50(2). All other Art. 50 obligations have applied since 2 August 2026.

Phase 4 (from 2027/2028): high-risk systems

Originally, the high-risk obligations were due to take effect on 2 August 2026 for Annex III and on 2 August 2027 for Annex I (Art. 6(1)). The Digital Omnibus Regulation (EU) 2026/1744, in force since 27 July 2026, postpones both dates:

• Annex III (stand-alone high-risk categories such as HR, credit, insurance, critical infrastructure): to 2 December 2027.
• Annex I (AI as a safety component in regulated products, such as medical devices and machinery): to 2 August 2028.

Both dates have been binding since the Omnibus entered into force. The postponement affects the high-risk obligations in Chapter III, Sections 1 to 3, which include Art. 26 and Art. 27. Not postponed: Art. 4 (literacy, reworded in substance), Art. 5 (prohibitions), the GPAI rules, Art. 50 and the penalty regime. For marking under Art. 50(2), the only relief is the transition period for legacy systems until 2 December 2026.

Transition periods and sanctions: a worked example

The AI Act transition periods only take full effect through the penalty regime. The three tiers under Art. 99:

In each case, the higher amount applies. Concrete numerical example: a DACH mid-sized company with EUR 40 million annual turnover and 180 employees (an SME in the EU sense) has been running a self-built AI agent in customer service since August 2026. The agent does not tell customers that they are talking to an AI. As the provider, the company thus breaches Art. 50(1), which falls into Tier 2: 3% of EUR 40 million is EUR 1.2 million, while the absolute cap is EUR 15 million. Without SME status, the higher amount would be decisive, i.e. up to EUR 15 million.

For SMEs and start-ups, however, the special rule of Art. 99(6) applies: here the lower of the two values applies, i.e. up to EUR 1.2 million in this example. Since Regulation (EU) 2026/1744, this cap also covers small mid-cap enterprises (SMCs), but only for fines under Art. 99(4) and (5). For breaches of Art. 4 (AI literacy), the AI Act sets no fine range of its own. Member States lay down those penalties under Art. 99(1).

For agencies and B2B decision-makers

The message for the roadmap: the Omnibus mainly postponed the high-risk dates. For Art. 50(2), there is only a transition period for legacy systems until 2 December 2026. AI literacy (Art. 4) has been due since February 2025, Art. 50 transparency since August 2026. Marketing agencies and B2B teams should therefore implement two things now: a documented AI literacy program and an inventory of all customer-facing AI interaction points for Art. 50 transparency. If you run agents in HR, lending or other Annex III areas, use the time until December 2027 for risk classification, the deployer obligations under Art. 26 and, where required, the FRIA. Blck Alpaca supports DACH companies in securing agent stacks against the binding part of the timeline.

Note: This article is provided for general information purposes and does not constitute legal advice. For a binding assessment of your specific AI use case, please seek qualified legal counsel.