EU AI Act Timeline: Every Deadline From 2025 to 2030, and What to Do Before Each

Short answer: As of October 2026, the EU AI Act's prohibitions, AI literacy duty, general-purpose AI model rules and transparency rules already apply. After the Digital Omnibus on AI, which is now law, high-risk obligations for Annex III systems apply from 2 December 2027, and for AI in regulated products, including medical devices, from 2 August 2028.

Related guides:

• EU AI Act risk categories
• The EU AI Act checklist
• How ISO 42001 helps with EU AI Act compliance

Key takeaways

• The high-risk dates moved, and the move is final. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026 and published in the Official Journal on 24 July 2026. It is no longer a proposal.
• Annex III high-risk systems: 2 December 2027. These are the stand-alone use cases such as employment, education and biometrics.
• Product-embedded high-risk AI: 2 August 2028. This covers AI medical devices and in vitro diagnostics that need third-party conformity assessment.
• Some duties are already live. Prohibitions and AI literacy since 2 February 2025, general-purpose AI model rules since 2 August 2025, and most other provisions, including transparency, since 2 August 2026.
• More time is not a reason to wait. Your AI inventory, classification and supplier evidence take months, and buyers ask for them well before regulators do.

What is the EU AI Act timeline at a glance?

The EU AI Act entered into force on 1 August 2024 and applies in stages until 2030, with the dates set in Article 113 and the legacy deadlines in Article 111.

The table reflects Regulation (EU) 2024/1689 as amended, as of October 2026.

Date	What applies	Who it affects most
1 August 2024	Entry into force, no obligations yet	Everyone, as the start of the clock
2 February 2025	Chapters I and II: definitions, AI literacy and prohibited practices	Every provider and deployer
2 August 2025	General-purpose AI model obligations, governance, notified body rules, penalties chapter	Model providers, national authorities
2 August 2026	General application, including Article 50 transparency and Commission fines for model providers	Providers and deployers of chatbots, generative AI and deepfakes
2 December 2026	New prohibitions on non-consensual intimate content and child sexual abuse material; legacy generative AI marking deadline	Generative AI providers
2 December 2027	High-risk rules for Annex III systems	SaaS in HR, education, biometrics and other listed areas
2 August 2028	High-risk rules for Annex I product AI	HealthTech, medical device and other product manufacturers
2 August 2030	High-risk systems used by public authorities must comply	Vendors selling AI to the public sector

What already applies as of October 2026?

Four layers already apply: prohibitions, AI literacy, general-purpose AI model rules and the general provisions, including transparency.

1. Prohibited practices (since 2 February 2025). Article 113(a) applied Chapters I and II from that date. The Commission published guidelines on prohibited practices to help draw the line.
2. AI literacy (since 2 February 2025, reworded in 2026). The Omnibus replaced Article 4. Providers and deployers must now "take measures to support the development of AI literacy" of staff and others using AI on their behalf, and the amended text says this does not require guaranteeing any specific level of literacy for an individual.
3. General-purpose AI models (since 2 August 2025). Chapter V applies to model providers. Most SaaS teams use a model rather than provide one, but the provider's documentation belongs in your vendor file.
4. General application (since 2 August 2026). The Commission's overview notes that transparency rules took effect then, so Article 50 disclosure and marking duties already matter for chatbots and generative features.

One more date is close: the two new prohibitions added by the Omnibus, on generating non-consensual intimate imagery and child sexual abuse material, apply from 2 December 2026 under Article 113(a).

Did the Digital Omnibus change the EU AI Act deadlines?

Yes, and as of October 2026 the change is adopted law, not a proposal. The legal dates for high-risk systems are now 2 December 2027 and 2 August 2028.

The path:

• 19 November 2025: the Commission adopted its proposal, COM(2025) 836.
• 7 May 2026: the Council and Parliament reached a provisional agreement.
• 16 June 2026: Parliament approved the agreement in plenary.
• 8 July 2026: Regulation (EU) 2026/1744 was adopted, then published in the Official Journal on 24 July 2026.
• 27 July 2026: it entered into force, as the Commission's AI Act page confirms.

Beyond the dates, the Council's summary highlights that providers claiming an exemption from high-risk classification must register in the EU database, and that national AI regulatory sandboxes are now due by 2 August 2027. Older guides citing 2 August 2026 for high-risk rules are out of date.

When do high-risk obligations apply to SaaS products?

For stand-alone high-risk systems listed in Annex III, Chapter III Sections 1 to 3 apply from 2 December 2027, under Article 113(c)(i).

Under Article 6(2), the systems in Annex III are high-risk. The Commission's overview gives biometrics, education, employment and migration as examples. For SaaS companies, HR technology is a common exposure, because Annex III point 4 covers AI for recruitment or selection and for decisions such as promotion, termination, task allocation and performance monitoring.

Sections 1 to 3 cover classification, system requirements, and provider and deployer obligations. Our risk categories guide covers classification.

When does the EU AI Act apply to AI medical devices?

AI that is a medical device, or a safety component of one, becomes subject to the high-risk rules on 2 August 2028, when it is classified as high-risk through Article 6(1) and Annex I.

Two conditions must both be met under Article 6(1). The AI system is a product, or a safety component of a product, covered by the legislation in Annex I, and that product must undergo a third-party conformity assessment under that legislation. Annex I, Section A lists the Medical Devices Regulation (EU) 2017/745 and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746.

For HealthTech teams, that gives a practical split:

Your product	Likely route	Date of high-risk rules
AI software that is a medical device needing notified body assessment under MDR or IVDR	Article 6(1) and Annex I	2 August 2028
AI used in hiring, education or another Annex III area	Article 6(2) and Annex III	2 December 2027
Clinical admin or wellness AI outside both lists	Not high-risk by these routes, but literacy and transparency still apply	Already applying

In our experience, the extra time is best spent folding AI Act requirements into your existing MDR or IVDR documentation, not a parallel file.

What about AI systems already on the market?

Systems placed on the market before their high-risk date are generally covered only if they later undergo significant changes in design, under the amended Article 111(2).

The transitional rules in Article 111, as of October 2026:

• Legacy high-risk systems: outside the rules unless significantly changed in design after the application date. The Omnibus recitals in Regulation (EU) 2026/1744 clarify that this is judged per type and model, based on when the first unit of that type and model was placed on the market.
• Public sector: providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030.
• General-purpose AI models: models placed on the market before 2 August 2025 must comply by 2 August 2027.
• Generative AI marking: systems generating synthetic audio, image, video or text placed on the market before 2 August 2026 must meet Article 50(2) by 2 December 2026.

The legacy rule is not a permanent shield. A retrain or new intended purpose could count as a significant change, so log design decisions with dates.

What should SMBs do before each deadline?

Work backwards from the date that applies to your riskiest system, and do the inventory now because every later step depends on it.

Now, before 2 December 2026

1. Build an AI inventory: every feature, internal tool and third-party model, with its intended purpose and EU exposure.
2. Confirm nothing touches a prohibited practice, including the two new prohibitions.
3. Record your AI literacy measures: training, guidance and who received them.
4. If you ship generative features, check Article 50 disclosure and marking, especially for anything launched before 2 August 2026.

During 2027, before 2 December 2027

1. Classify each system and record provider or deployer role, using our EU AI Act checklist.
2. For Annex III systems, close gaps in risk management, data governance, logging, human oversight and technical documentation.
3. Ask model and AI vendors for their documentation and contract terms.
4. Register in the EU database where required, including where you rely on an exemption.

Before 2 August 2028 (HealthTech)

1. Map AI Act requirements into your MDR or IVDR technical documentation and quality management system.
2. Plan the notified body timeline with your regulatory lead.
3. Align post-market monitoring across both regimes.

An ISO 42001 management system gives this work owners and an evidence trail.

When can penalties be imposed?

The penalties chapter has applied since 2 August 2025, Commission fines for general-purpose AI model providers since 2 August 2026, and high-risk breaches become possible only once those obligations apply.

Article 113(b) applied Chapter XII from 2 August 2025, except Article 101, which follows the general date. The maximum amounts in Article 99 and Article 101:

Breach	Maximum fine	Relevant from
Prohibited practices (Article 5)	EUR 35 million or 7% of worldwide annual turnover, whichever is higher	2 August 2025
Operator obligations, including Article 50 transparency and high-risk duties	EUR 15 million or 3%, whichever is higher	As each obligation applies
Incorrect, incomplete or misleading information to authorities	EUR 7.5 million or 1%, whichever is higher	As each obligation applies
General-purpose AI model providers (Commission)	EUR 15 million or 3%, whichever is higher	2 August 2026

For SMEs and start-ups, Article 99(6) caps each fine at the lower of the percentage or the amount, and the Omnibus added a similar rule for small mid-cap enterprises in Article 99(6a), for the fines in paragraphs 4 and 5.

How SecureSlate helps

SecureSlate turns the EU AI Act timeline into tracked work with owners and dates. Built-in EU AI Act and ISO 42001 frameworks, with multi-framework control mapping to SOC 2, ISO 27001, HIPAA, GDPR and NIS 2, let you reuse controls you already run. Custom controls capture items such as your AI inventory, literacy records and design-change log. Risk management records classification decisions, vendor risk management tracks model and AI suppliers, and audit management keeps evidence together for each deadline. The trust center and security questionnaire automation help you answer customers asking about your AI Act readiness.

Start your free SecureSlate trial

FAQ

When does the EU AI Act apply?

It entered into force on 1 August 2024 and has applied generally since 2 August 2026. Prohibitions and AI literacy applied from 2 February 2025, and high-risk rules apply from 2 December 2027 or 2 August 2028 depending on the route.

Is the Digital Omnibus delay to the high-risk deadlines final?

Yes. As of October 2026, Regulation (EU) 2026/1744 has been adopted, published in the Official Journal on 24 July 2026 and in force since 27 July 2026.

When do the EU AI Act deadlines hit HealthTech companies?

AI medical devices and in vitro diagnostics that need third-party conformity assessment follow Article 6(1) and Annex I, so the high-risk rules apply from 2 August 2028. Any Annex III use, such as hiring, applies from 2 December 2027.

Do we need to do anything if we only use third-party AI tools?

Yes. As a deployer you already have AI literacy and prohibited-practice duties, and possibly transparency duties. If an Annex III use is involved, deployer obligations apply from 2 December 2027.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.