EU AI Act Deadlines: Timeline From 2024 to 2030
Every application date of the EU AI Act from 2024 to 2030, with the article behind each date, who is affected and the fine levels.
The EU AI Act applies in stages to providers and deployers of AI systems in the EU. Eight bans apply from 2 February 2025, two more from 2 December 2026.
Transparency duties apply from 2 August 2026, high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). High-risk systems already on the market or in service are covered only after significant design changes (Article 111(2)). Fines for the duties listed in Article 99(4) reach EUR 15 million or 3% of total worldwide annual turnover, whichever is higher. Next step: find your system’s date below.
Each date switches on a different part of the Act
1 August 2024
The Act enters into force
The Act entered into force on the twentieth day after its publication in the Official Journal (Article 113). Its duties apply from the later dates below.
2 February 2025
Bans and AI literacy apply
Chapters I and II apply. They contain the Article 5 bans, except points (ba) and (bb) and Article 5(1a) and (1b), and the Article 4 duty on providers and deployers to support the AI literacy (skills and understanding) of their staff (Article 113(a)).
2 August 2025
GPAI model rules, governance and penalties apply
Rules for providers of GPAI models (Chapter V, Articles 51 to 56), notified bodies, governance (Chapter VII), penalties (Chapter XII, except Article 101) and Article 78 on confidentiality apply (Article 113(b)).
2 August 2026
Transparency duties and the general application date
All provisions without another date apply from this date (Article 113). They include the transparency duties of Article 50: telling people that they interact with an AI system, marking synthetic content and disclosing deepfakes. The Commission can fine GPAI providers under Article 101 from this date. Articles 102 to 110, which amend other Union acts, applied earlier, from 27 July 2026 (Article 113(d)).
2 December 2026
Two new bans and the marking deadline for older systems
The two new Article 5 bans, points (ba) and (bb), apply together with Article 5(1a) and (1b) (Article 113(a)). Providers of AI systems that generate synthetic audio, image, video or text content and were placed on the market before 2 August 2026 must take the necessary steps to comply with the machine-readable marking duty of Article 50(2) by this date (Article 111(4)).
2 August 2027
Older GPAI models must comply
Providers of GPAI models placed on the market before 2 August 2025 must take the necessary steps to comply with the Act by this date (Article 111(3)). Member States must also have at least one AI regulatory sandbox operational (Article 57(1)).
2 December 2027
High-risk rules apply to Annex III systems
Articles 6 to 27 (Chapter III, Sections 1 to 3, except Article 6(5)) apply to AI systems that are high-risk under Article 6(2) and Annex III (Article 113(c)(i)). They set the requirements for high-risk systems (Articles 8 to 15) and the duties of providers, deployers and other parties (Articles 16 to 27).
2 August 2028
High-risk rules apply to Annex I products
The same articles apply to AI systems that are high-risk under Article 6(1) because they are, or are safety components of, products under Annex I laws (Article 113(c)(ii)). For products under Annex I Section B, only Articles 6(1), 60a and 102 to 112 apply, and Articles 57 to 59 apply only in so far as the high-risk requirements are integrated in that legislation (Article 2(2)). For Annex I Section A products, some requirements may be limited where that legislation gives equivalent or higher protection (Article 2(13)).
2 August 2030
High-risk systems for public authorities: necessary steps to comply
In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by this date. The rule sits in the paragraph on systems placed on the market or put into service before the high-risk dates above (Article 111(2)).
31 December 2030
Large-scale EU IT systems must comply
AI systems that are components of the large-scale IT systems listed in Annex X, placed on the market or put into service before 2 August 2027, must comply by this date (Article 111(1)).
Providers, deployers, importers, distributors and model providers have separate duties
Providers
Providers develop an AI system, or have one developed, and place it on the market or put it into service under their own name (Article 3(3)). For high-risk systems they carry the main duties: risk management, technical documentation, conformity assessment and post-market monitoring (Articles 9 to 17, 43 and 72).
Deployers
Deployers use an AI system under their authority, except in a personal non-professional activity (Article 3(4)). For high-risk systems they must follow the instructions for use, assign human oversight, monitor operation and keep the logs under their control for a period appropriate to the purpose, at least six months unless other Union or national law provides otherwise. Employers must inform workers’ representatives and affected workers before using a system at the workplace (Article 26). Public bodies and some other deployers must also assess the impact on fundamental rights first (Article 27).
Importers and distributors
Importers place on the EU market an AI system that bears the name or trademark of a person established in a third country. Distributors make a system available further along the supply chain (Article 3(6) and (7)). Before doing so with a high-risk system, both check the CE marking, the EU declaration of conformity and the instructions for use. Importers also check the conformity assessment and the technical documentation (Articles 23 and 24).
GPAI model providers
Providers of GPAI models must document the model, inform downstream providers, publish a training-data summary and keep a copyright policy (Article 53). Models with systemic risk carry more duties (Article 55).
Fines come in three levels, with a lower cap for SMEs
Up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher
For banned practices under Article 5 (Article 99(3)).
Up to EUR 15 million or 3% of total worldwide annual turnover, whichever is higher
For breaking the obligations of providers (Article 16), authorised representatives (Article 22), importers (Article 23), distributors (Article 24), providers and operators under Article 25(2) and (4), and deployers (Article 26). Also for breaking the transparency obligations of Article 50 and the requirements of notified bodies under Articles 31, 33(1), (3) and (4) and 34 (Article 99(4)). The Commission can fine providers of GPAI models up to the same level (Article 101).
Up to EUR 7.5 million or 1% of total worldwide annual turnover, whichever is higher
For giving notified bodies or national authorities incorrect, incomplete or misleading information in reply to a request (Article 99(5)).
Up to the lower of the two amounts
For SMEs, including start-ups, each fine is up to the lower of the percentage and the amount (Article 99(6)). Small mid-cap companies (companies that outgrew the SME definition) get the same rule for the two lower levels (Article 99(6a)).
Frequently Asked Questions
Does the EU AI Act apply to companies outside the EU?
Yes. Article 2(1) covers providers that place AI systems or general-purpose AI models on the EU market, wherever they are established (point (a)), and providers and deployers in a third country when the system’s output is used in the EU (point (c)). It also covers importers, distributors, product manufacturers and authorised representatives (points (d) to (f)). Article 2 sets limits, for example for military, defence and national security uses (paragraph 3) and scientific research (paragraphs 6 and 8).
What happens if my AI system is already on the market?
The Article 5 bans apply to all systems, whenever they were placed on the market. A high-risk system placed on the market or put into service before 2 December 2027 (Annex III) or 2 August 2028 (Annex I) falls under the Act only if its design changes significantly from that date. This does not cover components of the Annex X large-scale IT systems (Article 111(1) and (2)). In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030. GPAI models placed on the market before 2 August 2025 must comply by 2 August 2027 (Article 111(3)). Synthetic-content systems placed on the market before 2 August 2026 must meet Article 50(2) by 2 December 2026 (Article 111(4)).
Which deadline applies to my AI system?
It depends on the system. Banned practices: 2 February 2025, with two new bans from 2 December 2026. GPAI models: 2 August 2025. Transparency duties under Article 50: 2 August 2026. High-risk systems under Annex III: 2 December 2027. High-risk systems under Annex I: 2 August 2028. Regulation (EU) 2026/1744 moved the two high-risk dates from 2 August 2026 (Annex III) and 2 August 2027 (Annex I) to the dates above.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.