The European Union’s AI Act is being switched on in stages, not all at once. The obligations for general-purpose AI models started applying on 2 August 2025. The remainder of the Act started applying on 2 August 2026, unless a specific provision says otherwise. And the rules for the “high-risk” systems listed in Annex III were postponed to 2 December 2027. Those dates are from the implementation timeline maintained at artificialintelligenceact.eu, last updated 31 August 2026.
If your company uses AI in its work — even software someone else built — those dates are the frame you plan inside.
The staged switch-on, in order
2 August 2025. Obligations for providers of general-purpose AI models began, along with the governance and penalty provisions and the requirement for member states to designate national authorities.
2 August 2026. The remainder of the Act starts to apply, unless otherwise specified. Providers of systems that generate synthetic content have until 2 December 2026 to comply with the transparency measures in Article 50(2).
2 December 2027. The obligations for high-risk systems classified under Article 6(2) and Annex III start applying, moved back from the original date.
What it means in practice for an ordinary company
Most companies are not building AI models. They are using products that contain them, which usually makes them a deployer rather than a provider — and the two roles carry different duties. Three practical points follow.
Know where AI is in your stack. Not the strategy question; the inventory question. Which of the tools your teams use every day now include an AI feature, what does each one do with your data, and who turned it on? Many of these features arrived in updates nobody announced internally.
Transparency is the obligation that touches everyone first. If your customers interact with a chatbot, or if your business publishes content that a system generated, the Act’s transparency rules are the part most likely to apply to you, and the synthetic-content deadline of 2 December 2026 is the near one.
High-risk is a defined list, not a feeling. Whether a use counts as high-risk is decided by the Act’s own categories, not by how important the system feels to your business. If you think a use of yours might be on that list, that is a question for a lawyer, and the December 2027 date is the one to plan against.
What this article is not
It is a summary of publicly documented dates. It is not legal advice, and no summary — including this one — can tell you which obligations attach to your specific use. Any company that tells you it can make you “AI Act compliant” without looking at what you actually run is selling something.
We follow the same rule on our own site: we state what our software does, and we do not make compliance claims. Where a claim is legal, it belongs to the company’s owner and its lawyer.
A reasonable order of work
1. Write down every AI feature in use across the company, including the ones inside products you already had.
2. For each, note what data it sees and whether anything leaves your systems.
3. Identify anything customer-facing that generates text, audio or images, and check how it is labelled.
4. Take the list — not a general question — to a lawyer, if any of it might touch the high-risk categories.
The companies that will find this easy are not the ones with the best AI strategy. They are the ones that can answer question one.
Sources
- EU AI Act implementation timeline, artificialintelligenceact.eu, page last updated 31 August 2026, read 18 September 2026: https://artificialintelligenceact.eu/implementation-timeline/