EU AI Act timeline for deployers — every date you actually need

The application schedule as it now stands

Article 113 of Regulation (EU) 2024/1689 set the original staged schedule. Regulation (EU) 2026/1744 amended it for the high-risk regimes. Read together, the dates a deployer has to work to are:

• 2 February 2025 — Chapter I and Chapter II apply. Chapter I (general provisions, including Article 4 AI literacy) and Chapter II (Article 5 prohibited AI practices).
• 2 August 2025 — Chapter III Section 4, Chapter V, Chapter VII, Chapter XII apply, except Article 101. Notifying authorities and notified bodies, general-purpose AI models, governance, penalties — with the exception of Article 101 (Commission fines on GPAI providers).
• 2 August 2026 — Article 50 transparency and Article 101 apply. The Article 50 transparency duties took effect on this date and were left untouched by the Digital Omnibus, as was the Commission's Article 101 power to fine GPAI providers.
• 2 December 2026 — two narrow items land. The Article 50(2) machine-readable marking grace period for generative AI systems that were already on the market before 2 August 2026 runs out, and the new Article 5 prohibition introduced by Regulation (EU) 2026/1744 starts to apply.
• 2 December 2027 — the standalone Annex III high-risk regime applies. Deferred from 2 August 2026 by Regulation (EU) 2026/1744, in force 27 July 2026. Covers Article 6(2) and all of Annex III, the Article 26 deployer obligations and the Article 27 fundamental-rights impact assessment — every Annex III area, not only employment.
• 2 August 2028 — Article 6(1) and the Annex I product-embedded regime. High-risk AI systems that are, or are safety components of, products covered by Annex I Union harmonisation legislation (machinery, medical devices, etc.). Regulation (EU) 2026/1744 moved this from the original 2 August 2027.

Date by date — what a deployer must already do today

2 February 2025 (in force)

• Article 4 AI literacy. Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on which the AI systems are to be used. This duty is not tied to the high-risk regime and was not touched by the Annex III deferral.
• Article 5 prohibitions. The eight categories of prohibited AI practices are in force. A deployer that puts a system on its workforce that falls inside Article 5 is in breach today.

2 August 2025 (in force)

• Chapter V — general-purpose AI models. Provider obligations for general-purpose AI models including GPAI with systemic risk apply. Deployers do not pick up new Chapter V obligations on this date, but their vendors do, which changes what a deployer can ask for in due diligence.
• Chapter VII — governance. The European AI Office, the AI Board, the Advisory Forum and the scientific panel are operational.
• Chapter XII — penalties (except Article 101). Article 99 fines become applicable for the obligations that are themselves applicable on this date (notably Article 5 prohibitions and Article 4 AI literacy).

2 August 2026 (in force)

• Article 50 transparency. Providers must inform users that they are interacting with an AI system and mark synthetic output; deployers of emotion-recognition or biometric-categorisation systems must inform exposed persons; deployers of deep fakes must disclose. Article 50 is a free-standing transparency chapter: it bites whether or not the system is high-risk, and the Annex III deferral does not reach it. If you have a customer-facing chatbot or you publish AI-generated content, this is live now.
• Article 101. Commission power to fine GPAI providers becomes effective.
• What did not start on this date. Article 6(2) and Annex III, the Article 26 deployer obligations and the Article 27 FRIA were all scheduled for 2 August 2026 in the original text. Regulation (EU) 2026/1744 moved them to 2 December 2027 before that date arrived, so they never took effect on 2 August 2026.

2 December 2026

• Article 50(2) legacy marking grace ends. Generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking requirement for synthetic content. This is a provider-side transitional period; systems launched after 2 August 2026 had to comply from launch. It is the only obligation legitimately tied to a December 2026 date — do not confuse it with the 2 December 2027 Annex III date set by Regulation (EU) 2026/1744, in force 27 July 2026.
• New Article 5 prohibition. The prohibition added to Article 5 by Regulation (EU) 2026/1744 applies from 2 December 2026.

2 December 2027 — standalone Annex III high-risk (Regulation (EU) 2026/1744, in force 27 July 2026)

• Article 6(2) and the whole of Annex III. Biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services, law enforcement, migration and border control, and administration of justice and democratic processes. Regulation (EU) 2026/1744 defers the standalone Annex III regime as a block. Employment systems under Annex III point 4 are covered because they are part of Annex III, not because they were singled out.
• Both sides of the market. The deferral applies to provider obligations — Articles 9 to 15, Annex IV technical documentation, conformity assessment, CE marking and Article 49 EU database registration — and to deployer obligations alike. A vendor that promises Annex III conformity evidence before this date is offering you something the law does not yet require of it.
• Article 26 deployer obligations. Instructions-for-use adherence, human oversight assignment, input-data control, monitoring of operation, the Article 26(5) suspension duty, Article 26(6) log retention, the Article 26(7) employer duty to inform affected workers, and public-administration registration in the EU database.
• Article 27 FRIA. Deployers that are bodies governed by public law or private entities providing public services, and deployers using systems under Annex III points 5(b) and 5(c), must perform a fundamental-rights impact assessment before deployment.
• Article 99 penalties follow the obligation. Chapter XII has applied since 2 August 2025, but a fine for breaching an Annex III high-risk obligation can only arise once that obligation itself applies. For non-compliance with obligations other than the Article 5 prohibitions, including the high-risk obligations, Article 99 sets fines of up to EUR 15,000,000 or 3% of total worldwide annual turnover, whichever is higher, with lower ceilings for SMEs.

2 August 2028

• Article 6(1) high-risk regime for products in Annex I. AI safety components or AI systems that are themselves products covered by Annex I Union harmonisation legislation (machinery, toys, medical devices, IVDs, lifts, radio equipment, civil aviation, automotive, marine, rail, etc.). Regulation (EU) 2026/1744 moved this date from the original 2 August 2027.

31 December 2030

• Article 111(2) end of the large-scale-IT-systems transitional period.AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X that have been placed on the market or put into service before 2 August 2027 must be brought into compliance with this Regulation by 31 December 2030.

Article 111 transitional regime — pre-existing systems

The paragraphs below restate Article 111 of Regulation (EU) 2024/1689. Because Regulation (EU) 2026/1744 realigned the high-risk application dates, check the consolidated text on EUR-Lex for the cut-off dates that Article 111 now refers to before you rely on a grandfathering argument.

• Article 111(1) — legacy large-scale IT systems. Without prejudice to Article 5, AI systems which are components of the large-scale IT systems listed in Annex X that have been placed on the market or put into service before 2 August 2027 must be brought into compliance with the Regulation by 31 December 2030.
• Article 111(2) — pre-existing high-risk AI. Operators of high-risk AI systems other than the ones referred to in Article 111(1) that were placed on the market or put into service before the applicable high-risk date only become subject to the Regulation if, as from that date, those systems are subject to significant changes in their designs. In any event, providers and deployers of high-risk AI systems intended to be used by public authorities must take the necessary steps to comply with the requirements and obligations of the Regulation by 2 August 2030.
• Article 111(3) — pre-existing GPAI models. Providers of general-purpose AI models that have been placed on the market before 2 August 2025 must take the necessary steps to comply with the obligations laid down in this Regulation by 2 August 2027.

A practical deployer Gantt

Two independent tracks. The Article 50 transparency track is live now. The Annex III high-risk track — all eight Annex III areas, employment included — runs to 2 December 2027 (Regulation (EU) 2026/1744, in force 27 July 2026). Article 4 AI literacy and Article 5 compliance apply to every deployer regardless of vertical and regardless of either track.

• Already overdue if missing. Article 4 AI-literacy programme and Article 5 inventory check (have we deployed anything that falls inside Article 5?).
• Now — Article 50 track. Transparency disclosures wired into the UI for chatbots, emotion-recognition and biometric-categorisation systems and AI-generated content. If you inherited a generative system that was on the market before 2 August 2026, confirm with the provider that machine-readable marking lands before 2 December 2026.
• By Q1 2027 — Annex III track. Annex III scope mapping across all eight areas, vendor-attestation pack for each high-risk candidate, draft Article 26 use record per system, Article 14 oversight assignments per system, GDPR Article 35 DPIA where applicable.
• By Q3 2027 — Annex III track. Article 27 FRIA where applicable, Article 26(7) employer worker-information rollout plan, contractual hooks with providers for the Annex IV documentation you will need to evidence Article 26 compliance.
• Before 2 December 2027 (Regulation (EU) 2026/1744, in force 27 July 2026). Article 26(6) log-retention working, Article 26(5) suspension procedure documented, internal sign-off that no Article 25 re-classification trigger applies.
• Through 2028. Article 72 post-market monitoring tracked at the vendor; Article 26 evidence kept up to date on every contract renewal; Annex I product-embedded systems brought into scope from 2 August 2028.

Common misconceptions

• “The Omnibus deferral only covers HR and recruitment AI.” It covers the whole standalone Annex III high-risk regime. Credit scoring, education, biometrics, essential services, law enforcement and the rest move to 2 December 2027 on exactly the same footing as employment systems, and provider obligations move with them — that is what Regulation (EU) 2026/1744, in force 27 July 2026, actually says.
• “The deferral is only a proposal, so plan for 2 August 2026 anyway.” Regulation (EU) 2026/1744 was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. 2 December 2027 is the applicable date for the standalone Annex III regime.
• “So nothing applies until December 2027.” Article 4 (AI literacy) and Article 5 (prohibitions) have applied since 2 February 2025. Article 99 penalties have applied since 2 August 2025 for the obligations that are themselves in force. Article 50 transparency has applied since 2 August 2026 and is the obligation most deployers are currently exposed on.
• “Article 50 moved to December 2026.” It did not. The only December 2026 item is the Article 50(2) machine-readable marking grace for generative systems that were already on the market before 2 August 2026 — a provider-side transitional period, not a new deployer deadline.
• “Pre-existing high-risk systems are grandfathered indefinitely.” Article 111(2) only grandfathers systems that are not subject to significant design changes from the applicable high-risk date, and only outside the public-authority deadline of 2 August 2030.
• “NIS2 deadlines move with the AI Act.” They are independent. The NIS2 transposition deadline was 17 October 2024 (Article 41 of Directive (EU) 2022/2555).

Related EU guides

• Article 50 transparency — deployer guide
• Human oversight — Article 14
• Record-keeping & logging — Article 12
• Data governance & bias testing — Article 10
• EU AI Act enforcement — who supervises and how
• NIS2 essential vs important entities

Sources

• Regulation (EU) 2024/1689, Articles 4, 5, 6, 26, 27, 50, 99, 101, 111, 113 — EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026, in force 27 July 2026 — EUR-Lex: eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
• Directive (EU) 2022/2555 (NIS2), Article 41 (transposition deadline 17 October 2024) — EUR-Lex: eur-lex.europa.eu/eli/dir/2022/2555/oj
• European Commission — AI Act application timeline overview: digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai