The EU AI Act came into force in August 2024, and its obligations switch on in stages. In July 2026, the Digital Omnibus on AI moved the high-risk deadlines to December 2027 and August 2028. Your deadline depends on your role in the AI supply chain and how much risk your AI system carries. Here’s a breakdown of the key dates.
The EU AI Act has a staggered implementation timeline. The bans on prohibited AI practices and the AI literacy obligation have applied since February 2025. The rules for general-purpose AI (GPAI) models have applied since August 2025. Transparency obligations apply since August 2026, and most high-risk AI systems have until December 2027 or August 2028.
To know which deadline applies to you, consider three factors:
Companies have different sets of responsibilities and deadlines depending on whether they develop, use, or import an AI system. The collective term for everyone on the supply chain is an “operator.” Broken down into more specific roles, operators can be split into:
AI providers develop an AI system or GPAI model, or have one developed, and place it on the market under their own name. Think of a company developing AI that can automate large parts of a bank’s transaction monitoring and offer predictive analytics.
AI deployers use AI systems. Working with the earlier example, a deployer would be the bank or any financial institution that is buying and using the AI.
AI importers bring an AI system into the EU under the name or trademark of another company based outside the European Union.
AI distributors aren’t providers or importers but still play a role in making AI systems available on the market.
The EU AI Act sorts AI systems into four risk levels, with separate rules for general-purpose AI models:
General-purpose AI (GPAI) models, the large models behind many AI tools, have their own obligations. GPAI models with systemic risk face additional ones.
For GPAI models, timing matters. Models placed on the market from August 2 2025 had to comply straight away. Models already on the market before that date have until August 2 2027.
Considering these factors, these are the key dates:
Key date: August 2 2025
Providers of GPAI models placed on the market on or after August 2 2025 have had to comply from day one. That means technical documentation, information for downstream providers, a copyright policy, and a public summary of the training data.
The General-Purpose AI Code of Practice, published in July 2025, gives providers a practical way to show they meet these obligations. From August 2 2026, the EU AI Office can enforce the GPAI rules, including issuing fines.
Since August 2 2025, Member States have also had to name the authorities that supervise the Act.
Key date: August 2 2026
From August 2 2026, the transparency obligations in Article 50 apply. People need to know when they’re interacting with an AI system, and deployers need to disclose deepfakes.
Providers of generative AI must mark AI-generated content in a machine-readable way. If your system was placed on the market before August 2 2026, the Digital Omnibus gives you until December 2 2026 to add this marking.
Key dates: December 2 2027 and August 2 2028
High-risk obligations were originally due on August 2 2026. However, the Digital Omnibus on AI moved them back:
The delay changes when you need to comply, but not what you need to do. Risk management, data governance, technical documentation, and human oversight still apply in full. Use the extra time to classify your AI systems and build these processes without being under pressure.
Key dates: August 2 2027 and December 2030
Providers of GPAI models placed on the market before August 2 2025 have until August 2 2027 to meet the GPAI obligations.
Large-scale EU IT systems in the area of freedom, security, and justice, listed in Annex X, have until December 31 2030.
Much like how an AI system’s risk level determines the final compliance deadlines, it also defines what steps providers need to take.
Providers of GPAI models need technical documentation, information for downstream providers, a copyright policy, and a public summary of their training data. Providers of GPAI models with systemic risk also need to assess and mitigate those risks and report serious incidents.
For high-risk systems, the obligations go much further, from risk management and human oversight to post-market monitoring. Our compliance experts cover them in this on-demand webinar.
While providers carry tremendous responsibility in keeping AI systems safe, deployers also play a part in their proper implementation and oversight.
Ultimately, they’re still responsible for how the system is used. Among other things, deployers need to use the system according to its instructions, assign human oversight, check the input data they control, and monitor whether everything works as intended. Providers and deployers also need to take measures to support AI literacy among staff who work with AI.
Importers and distributors have the task of verifying whether the system they’re placing in the EU market is in fact compliant with the EU AI Act.
This means they have to confirm if the provider has taken critical steps like carrying out a conformity assessment, making technical documentation available, acquiring the European Conformity marking, and more.
These operators also have to make sure that compliance isn’t affected by the storage and transport of the AI system. In addition, they’ll need to provide relevant information to the competent authorities and maintain records for ten years.
With the high-risk deadlines now set for December 2027 and August 2028, you have time to prepare properly. Focus on these areas: mapping where you use AI, classifying each system by risk, establishing a risk management system, implementing data governance measures, drawing up technical documentation, and keeping records.
Each roadmap to compliance is highly contextual and will look different from one business to another. Get more familiar with the finer details through our ultimate guide to the EU AI Act.
The EU AI Act entered into force on August 1 2024, and its obligations apply in phases. The bans on prohibited AI practices came first, on February 2 2025. The last major deadline is August 2 2028, when the high-risk rules for AI in regulated products apply. Large-scale EU IT systems have until December 31 2030.
This phased approach gives organizations time to assess their AI use cases, implement controls, and align internal governance before full enforcement begins.
No. The EU AI Act follows a risk-based approach.
Obligations depend on how your AI system is classified. Prohibited AI practices have been banned since February 2 2025. High-risk systems must meet strict requirements before being placed on the market or put into service. Limited-risk systems mainly require transparency measures.
Understanding your system’s risk category is the first step toward compliance planning.
The transition period offers time to prepare, not to wait.
Organizations should identify where AI is used across the business, assess risk classifications, review documentation practices, and establish internal governance structures. You may also need to update vendor contracts, monitoring processes, and transparency mechanisms.
Early preparation reduces the risk of last-minute compliance gaps once enforcement begins.
Partly. The Digital Omnibus on AI (Regulation (EU) 2026/1744) came into force on July 27 2026. It moved the high-risk deadlines to December 2 2027 and August 2 2028. Most other dates stay the same: the transparency obligations still apply from August 2 2026, and the GPAI rules already apply.
_HighPerformer_HighPerformer.svg)
TISAX® is a registered trademark of the ENX Association. DataGuard is not affiliated with the ENX Association. We provide Software-as-a-Service and support for the assessment on TISAX® only. The ENX Association does not take any responsibility for any content shown on DataGuard's website.
All data provided is for information only, based on internal estimates. This information is not indicative of KPIs, and is not given with any warranties or guarantees, expressly stated or implied in relation to accuracy and reliability.
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "Organization",
"@id": "www.dataguard.com#organization",
"name": "DataGuard",
"legalName": "DataCo GmbH",
"description": "DataGuard, the European leader in security and compliance software, is trusted by more than 4,000 organizations across 50+ countries. We help you identify and manage your security and compliance risks and fast-track your certifications and compliance by combining expert consultancy with AI-powered automation. Our purpose-built, all-in-one platform is developed with the experience of over 1.5 million total hours by a team of certified security and compliance experts.",
"foundingDate": "2018",
"taxID": "DE315880213",
"logo": "https://7759810.fs1.hubspotusercontent-na1.net/hubfs/7759810/DataGuardLogo.svg",
"url": "www.dataguard.com",
"email": "info@dataguard.de",
"telephone": "+49 89 452459 900",
"address": {
"@type": "PostalAddress",
"streetAddress": "Sandstrasse 33",
"addressLocality": "Munich",
"addressRegion": "Bavaria",
"postalCode": "80335",
"addressCountry": "Germany"
},
"sameAs": [
"https://www.linkedin.com/company/dataguard1/",
"https://www.youtube.com/channel/UCEQzPZ6sCBCj9cAoBvaLL6w",
"https://x.com/i/flow/login?redirect_after_login=%2FDataGuard_dg"
]
}
]
}✅ Organization schema markup for "DataGuard" has been injected into the document head.