1 August 2024
In forceEntry into force
Regulation (EU) 2024/1689 enters into force — twenty days after its 12 July 2024 publication in the Official Journal. Every later deadline is counted from this date.
Art. 113
All operatorsEvery binding date in the EU AI Act.
Regulation (EU) 2024/1689 phases in from 1 August 2024 to the close of 2030, as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026). Here is when each obligation takes effect, who it lands on, and the Articles behind it.
Next binding deadline
2 December 2026
Marking transition ends & new Article 5 bans
37days away
Rollout progress7 of 13 milestones in force
- 2024
- 2025
2 February 2025
In forceProhibited practices & AI literacy
The Article 5 bans take effect: manipulative or exploitative AI, social scoring, untargeted facial-image scraping, emotion recognition at work and in education (except for medical or safety reasons), certain biometric categorisation, and — for law enforcement — most real-time remote biometric identification in public. In parallel, Article 4 requires organisations to build AI literacy among their staff. The Digital Omnibus softened that duty from 27 July 2026: providers and deployers must take measures to support AI literacy rather than guarantee a set level.
Art. 4Art. 5Every organisation using AI2 May 2025
In forceGPAI Code of Practice
The statutory target for the general-purpose AI Code of Practice under Article 56. The final Code was published on 10 July 2025 and endorsed ahead of the August GPAI obligations — covering transparency, copyright safeguards and systemic-risk evaluation.
Art. 56General-purpose AI model providers2 August 2025
In forceGPAI obligations, governance & penalties
Obligations for general-purpose AI models apply (Chapter V), the AI Office and national competent authorities stand up (Chapters VII and III), and the penalty regime takes effect — up to €35M or 7% of worldwide turnover for breaching the Article 5 prohibitions. GPAI-specific fines and the AI Office's enforcement powers (Article 101) follow on 2 August 2026.
Art. 51–55Art. 99GPAI providers · Member States · authorities- 2026
19 May 2026
In forceDraft high-risk classification guidelines
The Commission publishes its draft guidelines on Article 6 classification — three documents covering general principles, product-embedded systems under Annex I and the Annex III use cases, with worked examples — three and a half months after the statutory 2 February 2026 deadline. The targeted consultation closed on 23 July 2026; the final guidelines are expected before the end of 2026, after the AI Board has been consulted. Two positions already carry weight: adding human oversight does not change a classification, and AI components that jointly drive a high-risk decision are assessed as one system.
Art. 6(5)Providers assessing high-risk status27 July 2026
In forceDigital Omnibus on AI in force
Regulation (EU) 2026/1744 — the Digital Omnibus on AI, signed on 8 July and published in the Official Journal on 24 July 2026 — enters into force. Provisional agreement was reached on 6–7 May 2026, Parliament endorsed it on 16 June and the Council adopted it on 29 June. It fixes the high-risk application dates at 2 December 2027 (stand-alone Annex III) and 2 August 2028 (product-embedded Annex I), adds two Article 5 prohibitions, softens Article 4, moves the national sandboxes to 2 August 2027, narrows the Annex I safety-component test, extends the SME simplifications to small mid-caps and gives the AI Office direct investigation and fining powers over general-purpose AI. The existing Article 5 prohibitions and the GPAI regime are unchanged. Articles 102–110, which amend the sectoral product legislation, apply from the same day (Article 113, third paragraph, point (d)).
Reg. (EU) 2026/1744Art. 102–110All operators2 August 2026
In forceTransparency & GPAI enforcement
The Article 50 transparency duties apply: telling people they are interacting with an AI system, labelling deepfakes and other synthetic media, and machine-readable marking of AI-generated content under Article 50(2) — with a transition to 2 December 2026 for systems already on the market. The Commission's final Article 50 guidelines were published on 20 July 2026 and the transparency Code of Practice was confirmed as adequate the same month. The AI Office's enforcement powers over general-purpose AI models also start: investigations, inspections, binding commitments and Article 101 fines of up to €15M or 3% of worldwide turnover. The high-risk regime does not land on this date — the Omnibus moved it to 2 December 2027.
Art. 50Art. 101Providers of AI with transparency duties · GPAI providers2 December 2026
Next deadlineMarking transition ends & new Article 5 bans
Two Omnibus dates land together. Systems that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 must now meet the Article 50(2) marking and detection duty (Article 111(4)). And the two prohibitions the Omnibus added to Article 5 apply: AI systems intended — or reasonably foreseeable, without significant technical modification — to generate or manipulate non-consensual intimate imagery of an identifiable person (point (ba)), or child sexual abuse material (point (bb)). Providers are caught by intended purpose and foreseeable outcome; deployers only by intentional use. Article 5(1a) and (1b) set the scope of both bans, and Article 5(1a)(a) adds a safeguards condition: check what safeguards your system has in place against that text before concluding it falls outside the ban.
Art. 5Art. 50(2)Art. 111(4)Providers of generative AI · deployers- 2027
2 August 2027
UpcomingLegacy GPAI compliance & national sandboxes
General-purpose AI models placed on the market before 2 August 2025 must reach full compliance with the Chapter V obligations. The same day is the Omnibus-extended deadline for every Member State to have at least one operational AI regulatory sandbox under Article 57, with priority access for SMEs and start-ups.
Art. 57Art. 111(3)Legacy GPAI providers · Member States2 December 2027
UpcomingHigh-risk obligations — Annex III
The core of the Act applies to stand-alone high-risk systems. Annex III systems must meet the full regime: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11 / Annex IV), logging (Art. 12), transparency (Art. 13), human oversight (Art. 14) and accuracy and robustness (Art. 15) — plus deployer duties, the Article 27 FRIA, EU-database registration (Art. 49), post-market monitoring (Art. 72) and serious-incident reporting (Art. 73). Systems already on the market before this date are caught only on a significant change in design (Article 111(2)); high-risk systems "intended to be used by" public authorities must comply by 2 August 2030 regardless.
Art. 6(2)Art. 9–15Art. 27Art. 49–73Art. 111(2)Annex III high-risk providers & deployers- 2028
2 August 2028
UpcomingProduct-embedded high-risk — Annex I
High-risk obligations apply to AI that is a safety component of, or is itself, a product under Annex I legislation requiring third-party conformity assessment (for health/safety reasons) — medical devices, lifts, in-vitro diagnostics and more (Article 6(1)), carried through the product's existing conformity assessment and CE marking. AI used solely for non-safety-related aspects (e.g. user assistance, performance optimisation, convenience) is not a safety component, unless its failure or malfunction would endanger health and safety (Article 6(1a) and (1b), inserted by the Omnibus). A third-party assessment required only for risks other than health and safety, such as electromagnetic compatibility, does not count (Article 6(1c)). For Annex I Section B products (e.g. vehicles, aviation, and, since Regulation (EU) 2026/1744, machinery), the requirements arrive through the sectoral legislation, not directly from the AI Act.
Art. 6(1)–(1c)Annex IAnnex I product providers- 2030
2 August 2030
UpcomingPublic-authority legacy systems
Providers and deployers of high-risk AI systems "intended to be used by" public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by this date (Article 111(2), as replaced by the Omnibus, which kept the 2030 date). Other high-risk systems placed on the market or put into service before the Chapter III application date (2 December 2027 for Annex III, 2 August 2028 for Annex I) are caught only if their design changes significantly afterwards.
Art. 111(2)Public authorities operating legacy high-risk AI31 December 2030
UpcomingLarge-scale EU IT systems
The final deadline. AI components of the large-scale EU IT systems listed in Annex X — such as SIS, VIS, Eurodac, EES, ETIAS and ECRIS-TCN — placed on the market before 2 August 2027 must be brought into compliance. After this date, no legacy carve-out remains.
Art. 111(1)Operators of Annex X large-scale IT systems
Source: Regulation (EU) 2024/1689 — Articles 111 & 113, with Articles 4, 5, 6, 50, 56, 57, 99 and 101 — as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Section 5 (Arts. 40–49) is not named in the deferral in Article 113, third paragraph, point (c), but it has no practical effect until the deferred Sections 1–3 apply. Last reviewed 23 October 2026.
Assess your first AI system with Confir today.
Create your account, add your first AI system, and produce a full EU AI Act assessment with signed conformity documentation — in days, not months.
14-day free trialNo card requiredEU-hosted · GDPR Art. 28 DPA