EU AI Act - the dates that drive your 2026 plan

The phased applicability of the EU AI Act through 2028 in one calendar, plus what each milestone means for the work on your desk.

The calendar

Date What applies Action
2 Feb 2025 Prohibited practices (Art. 5) - social scoring, untargeted facial-recognition scraping, emotion recognition in workplace / education, real-time biometric ID in public spaces (narrow exceptions). AI literacy (Art. 4) for staff. Since 27 July 2026 (Digital Omnibus, Regulation (EU) 2026/1744), providers and deployers must take measures to support the AI literacy of staff and others using AI on their behalf; they no longer have to guarantee a sufficient level for each individual. Review use cases against Art. 5; remove prohibited ones. Roll out AI literacy training.
2 Aug 2025 GPAI model obligations (Arts 53-55). Codes of Practice in force. Governance, notified bodies, penalties framework operational. If you train or substantially fine-tune a GPAI model, publish technical documentation and a summary of training data. Deployers: confirm your provider has done this.
27 Jul 2026 Digital Omnibus (Regulation (EU) 2026/1744) enters into force, amending the timetable below. Re-check your plan against the amended dates.
2 Aug 2026 Transparency for limited-risk systems (Art. 50) - AI-generated content disclosure, chatbot identification, deepfake labelling. Add AI-content disclosure to product UX.
2 Dec 2026 Machine-readable marking deadline for generative AI systems already on the market before 2 Aug 2026. Two new prohibited practices (non-consensual intimate imagery, child sexual abuse material) apply. Add machine-readable marking; confirm no system can generate the newly banned content.
2 Dec 2027 High-risk obligations for standalone (Annex III) systems. Operationalise Art. 14 human oversight, Art. 10 data governance, Art. 15 accuracy/robustness/cybersecurity for in-scope systems.
2 Aug 2028 High-risk AI in regulated products (Annex I: medical devices, toys, machinery, lifts, etc.) - full obligations. Align AI conformity work with existing CE-marking processes.
31 Dec 2030 High-risk systems that are components of large-scale IT systems listed in Annex X - full obligations. Largely for public-sector systems; map exposure.

What "high-risk" means in practice

Annex III high-risk categories most likely to affect typical enterprises:

  • Recruitment, evaluation, promotion, termination (HR).
  • Access to and enjoyment of essential private services (credit, insurance pricing).
  • Educational access and assessment.
  • Critical infrastructure operation.
  • Law enforcement, migration, justice (public sector).

If you operate in any of these, your AI is presumed high-risk unless you can show a narrow Annex III(2) exception applies - with documented rationale.

What to put in the board pack

  • Which of your AI systems are prohibited, high-risk, limited-risk, minimal.
  • The Dec 2027 high-risk readiness plan with named owners.
  • The provider/deployer split for each system (Arts 16 vs 26).

Do this Monday

  1. Tag every system in your AI inventory with its EU AI Act class.
  2. Add the four dates above to your compliance calendar with 90-day pre-warnings.
  3. For Aug 2026, draft the Art. 50 transparency UX text now - review cycles take longer than the build.

Reviewer hot-buttons

  • A written classification per system, not "we think we are not high-risk".
  • A plan dated against the Dec 2027 milestone with engineering hours allocated.
  • Art. 50 disclosure visible in the actual product, not just the policy.