1 August 2024
In forceEntry into force
Regulation (EU) 2024/1689 enters into force — twenty days after its 12 July 2024 publication in the Official Journal. Every later deadline is counted from this date.
Art. 113
All operatorsEvery binding date in the EU AI Act.
Regulation (EU) 2024/1689 phases in from 1 August 2024 to the close of 2030, as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026). Here is when each obligation takes effect, who it lands on, and the Articles behind it.
Next binding deadline
2 December 2026
Marking transition ends & new Article 5 bans
52days away
Rollout progress7 of 13 milestones in force
- 2024
- 2025
2 February 2025
In forceProhibited practices & AI literacy
The Article 5 bans take effect: manipulative or exploitative AI, social scoring, untargeted facial-image scraping, emotion recognition at work and in education, certain biometric categorisation, and — for law enforcement — most real-time remote biometric identification in public. In parallel, Article 4 requires organisations to build AI literacy among their staff. The Digital Omnibus softened that duty from 27 July 2026: providers and deployers must take measures to support AI literacy rather than guarantee a set level.
Art. 4Art. 5Every organisation using AI2 May 2025
In forceGPAI Code of Practice
The statutory target for the general-purpose AI Code of Practice under Article 56. The final Code was published on 10 July 2025 and endorsed ahead of the August GPAI obligations — covering transparency, copyright safeguards and systemic-risk evaluation.
Art. 56General-purpose AI model providers2 August 2025
In forceGPAI obligations, governance & penalties
Obligations for general-purpose AI models apply (Chapter V), the AI Office and national competent authorities stand up (Chapters VII and III), and the penalty regime takes effect — up to €35M or 7% of worldwide turnover for breaching the Article 5 prohibitions. GPAI-specific fines and the AI Office's enforcement powers (Article 101) follow on 2 August 2026.
Art. 51–55Art. 99GPAI providers · Member States · authorities- 2026
19 May 2026
In forceDraft high-risk classification guidelines
The Commission publishes its draft guidelines on Article 6 classification — three documents covering general principles, product-embedded systems under Annex I and the Annex III use cases, with worked examples — three and a half months after the statutory 2 February 2026 deadline. The targeted consultation closed on 23 July 2026; the final guidelines are expected before the end of 2026, after the AI Board has been consulted. Two positions already carry weight: adding human oversight does not change a classification, and AI components that jointly drive a high-risk decision are assessed as one system.
Art. 6(5)Providers assessing high-risk status27 July 2026
In forceDigital Omnibus on AI in force
Regulation (EU) 2026/1744 — the Digital Omnibus on AI, signed on 8 July and published in the Official Journal on 24 July 2026 — enters into force. Provisional agreement was reached on 6 May 2026, Parliament endorsed it on 16 June and the Council adopted it on 29 June. It fixes the high-risk application dates at 2 December 2027 (stand-alone Annex III) and 2 August 2028 (product-embedded Annex I), adds two Article 5 prohibitions, softens Article 4, moves the national sandboxes to 2 August 2027, narrows the Annex I safety-component test, extends the SME simplifications to small mid-caps and gives the AI Office direct investigation and fining powers over general-purpose AI. The existing Article 5 prohibitions and the GPAI regime are unchanged.
Reg. (EU) 2026/1744All operators2 August 2026
In forceTransparency & GPAI enforcement
The Article 50 transparency duties apply: telling people they are interacting with an AI system, labelling deepfakes and other synthetic media, and machine-readable marking of AI-generated content under Article 50(2) — with a transition to 2 December 2026 for systems already on the market. The Commission's final Article 50 guidelines were published on 20 July 2026 and the transparency Code of Practice was confirmed as adequate the same month. The AI Office's enforcement powers over general-purpose AI models also start: investigations, inspections, binding commitments and Article 101 fines of up to €15M or 3% of worldwide turnover. The high-risk regime does not land on this date — the Omnibus moved it to 2 December 2027.
Art. 50Art. 101Providers of AI with transparency duties · GPAI providers2 December 2026
Next deadlineMarking transition ends & new Article 5 bans
Two Omnibus dates land together. Systems that generate synthetic audio, image, video or text and were placed on the market before 2 August 2026 must now meet the Article 50(2) marking and detection duty. And the two prohibitions the Omnibus added to Article 5 apply: AI systems intended — or reasonably foreseeable, without significant technical modification — to generate or manipulate non-consensual intimate imagery, or child sexual abuse material. Providers are caught by intended purpose and foreseeable outcome; deployers only by intentional use.
Art. 5Art. 50(2)Providers of generative AI · deployers- 2027
2 August 2027
UpcomingLegacy GPAI compliance & national sandboxes
General-purpose AI models placed on the market before 2 August 2025 must reach full compliance with the Chapter V obligations. The same day is the Omnibus-extended deadline for every Member State to have at least one operational AI regulatory sandbox under Article 57, with priority access for SMEs and start-ups.
Art. 57Art. 111(3)Legacy GPAI providers · Member States2 December 2027
UpcomingHigh-risk obligations — Annex III
The core of the Act applies to stand-alone high-risk systems. Annex III systems must meet the full regime: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11 / Annex IV), logging (Art. 12), transparency (Art. 13), human oversight (Art. 14) and accuracy and robustness (Art. 15) — plus deployer duties, the Article 27 FRIA, EU-database registration (Art. 49), post-market monitoring (Art. 72) and serious-incident reporting (Art. 73). Systems already on the market before this date are caught only on a significant change in design (Article 111(2)).
Art. 6(2)Art. 9–15Art. 27Art. 49–73Art. 111(2)Annex III high-risk providers & deployers- 2028
2 August 2028
UpcomingProduct-embedded high-risk — Annex I
High-risk obligations extend to AI that is a safety component of products already regulated under Annex I — medical devices, vehicles, lifts, in-vitro diagnostics and more (Article 6(1)), carried through the product's existing conformity assessment and CE marking. The Omnibus narrowed the test: the AI must be a safety component whose intended purpose is to prevent or mitigate risks to health and safety — assistance and optimisation functions are out — and AI in products under the Machinery Regulation is handled through that regulation instead.
Art. 6(1)Annex IAnnex I product providers- 2030
2 August 2030
UpcomingPublic-authority legacy systems
High-risk AI systems already in use by public authorities before the high-risk rules applied must be brought into full compliance by this date — a deadline the Omnibus left unchanged. Private-sector legacy high-risk systems are caught only if they undergo a significant change in design.
Art. 111(2)Public authorities operating legacy high-risk AI31 December 2030
UpcomingLarge-scale EU IT systems
The final deadline. AI components of the large-scale EU IT systems listed in Annex X — such as SIS, VIS, Eurodac, EES, ETIAS and ECRIS-TCN — placed on the market before 2 August 2027 must be brought into compliance. After this date, no legacy carve-out remains.
Art. 111(1)Operators of Annex X large-scale IT systems
Source: Regulation (EU) 2024/1689 — Articles 111 & 113, with Articles 4, 5, 6, 50, 56, 57, 99 and 101 — as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Last reviewed 11 September 2026.
Assess your first AI system with Confir today.
Create your account, add your first AI system, and produce a full EU AI Act assessment with signed conformity documentation — in days, not months.
14-day full-access trialNo card requiredEU-hosted · GDPR Art. 28 DPA