The EU AI Act timeline

What applies, from when, and to whom.

Read it as a calendar of duties. For each date: who it binds, what it requires, and an example you will recognise.

1. 2 Feb 2025 Applies today
   WhoEvery organisation that uses AI at work — any sector, any size.

   WhatTwo duties. The banned uses of AI are off-limits. And the AI-literacy duty: the people who use AI on your behalf must understand what it does and where it fails.

   For exampleYou may not run emotion-recognition on staff, or rank people through “social scoring”. And an HR team using a CV-screening tool must be trained to read its output critically — not treat it as a verdict.
2. 2 Aug 2025 Applies today
   WhoTwo audiences: the makers of the big AI models — and, through the penalties, you.

   WhatThe large “foundation” models behind tools like ChatGPT or Claude carry transparency and documentation duties. And the enforcement machinery — including the fines — is switched on.

   For exampleThe model-maker must publish a summary of its training data. For you, the headline is simpler: the penalty regime is now switched on.
3. 2 Dec 2026 Coming — new, via the Omnibus
   WhoAnyone who builds or uses generative AI — plus a new ban that binds everyone.

   WhatA new prohibition on AI that creates non-consensual intimate imagery or child sexual abuse material (the “nudifier” apps). And a short window for generative-AI tools already in use to start labelling their AI-generated output.

   For exampleA tool that fabricates fake nude images of real people is banned outright. And a content-generation tool your team already uses must mark what it produces as AI-made.
4. 2 Dec 2027 Coming — the big one for most employers
   WhoProviders and deployers of “high-risk” AI: recruitment, performance management, access to credit, education and essential services.

   WhatThe heavy obligations. If you deploy such a system: keep a competent human in control, run a fundamental-rights impact assessment (a documented check of who the system could unfairly affect), keep logs, and use it only as intended. Providers — those who build, brand or substantially change the system — add formal conformity checks (a CE-style sign-off) and registration in an EU database.

   For exampleIf you use AI to screen, rank or score job candidates, this is the date your governance has to be in place. The catch: the system you deploy today is the one you will have to prove compliant then.
5. 2 Aug 2028 Coming
   WhoMakers of regulated products with AI inside — machinery, medical devices, toys, lifts and the like.

   WhatThe same high-risk obligations, for AI built into products already regulated under other EU law.

   For exampleA scanner that uses AI to flag tumours: the maker must meet the high-risk rules before the device can ship.

Two questions decide how hard the high-risk row hits you: is your system actually high-risk, and are you its provider or its deployer? Both are easier to get wrong than you would think — see deployer or provider? and the AI Act, explained.