EU AI Act timeline for deployers — every date you actually need

The Article 113 application schedule

Article 113 makes the regulation applicable from 2 August 2026, with three carve-outs:

• 2 February 2025 — Chapter I and Chapter II apply. Chapter I (general provisions, including Article 4 AI literacy) and Chapter II (Article 5 prohibited AI practices).
• 2 August 2025 — Chapter III Section 4, Chapter V, Chapter VII, Chapter XII apply, except Article 101. Notifying authorities and notified bodies, general-purpose AI models, governance, penalties — with the exception of Article 101 (Commission fines on GPAI providers).
• 2 August 2026 — the rest of the regulation applies. Including the Annex III high-risk regime (Article 6(2)), the Article 26 deployer obligations, the Article 27 fundamental-rights impact assessment, the Article 50 transparency duties and Article 101 GPAI fines.
• 2 August 2027 — Article 6(1) and the corresponding obligations apply.High-risk AI systems that are products covered by Annex I Union harmonisation legislation (machinery, medical devices, etc.).

Date by date — what a deployer must already do today

2 February 2025 (in force)

• Article 4 AI literacy. Providers and deployers of AI systems must take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on which the AI systems are to be used.
• Article 5 prohibitions. The eight categories of prohibited AI practices are in force. A deployer that puts a system on its workforce that falls inside Article 5 is in breach today.

2 August 2025 (in force)

• Chapter V — general-purpose AI models. Provider obligations for general-purpose AI models including GPAI with systemic risk apply. Deployers do not pick up new Chapter V obligations on this date, but their vendors do, which changes what a deployer can ask for in due diligence.
• Chapter VII — governance. The European AI Office, the AI Board, the Advisory Forum and the scientific panel are operational.
• Chapter XII — penalties (except Article 101). Article 99 fines become applicable for the obligations that are themselves applicable on this date (notably Article 5 prohibitions and Article 4 AI literacy).

2 August 2026 (the big one)

• Article 6(2) and Annex III high-risk regime. Recruitment and HR-tech systems under Annex III point 4(a) and point 4(b) become regulated high-risk.
• Article 26 deployer obligations. Including instructions-for-use adherence, human oversight, input-data control, monitoring of operation, suspension duty, log retention, employer worker-information duty, public-administration entity registration in the EU database, and Article 50 transparency.
• Article 27 FRIA. Deployers that are bodies governed by public law or private entities providing public services, and deployers using systems under Annex III points 5(b) and 5(c), must perform a fundamental-rights impact assessment before deployment.
• Article 50 transparency. Providers must inform users that they are interacting with an AI system; deployers of emotion-recognition or biometric-categorisation systems must inform exposed persons; deployers of deepfakes must disclose. Article 50 is extensively re-shaped by the Commission Digital Omnibus proposals; the current text of Regulation (EU) 2024/1689 governs unless and until amendment is adopted.
• Article 101. Commission power to fine GPAI providers becomes effective.

2 August 2027

• Article 6(1) high-risk regime for products in Annex I. AI safety components or AI systems that are themselves products covered by Annex I Union harmonisation legislation (machinery, toys, medical devices, IVDs, lifts, radio equipment, civil aviation, automotive, marine, rail, etc.).

31 December 2030

• Article 111(2) end of the large-scale-IT-systems transitional period.AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X that have been placed on the market or put into service before 2 August 2027 must be brought into compliance with this Regulation by 31 December 2030.

Article 111 transitional regime — pre-existing systems

• Article 111(1) — legacy large-scale IT systems. Without prejudice to Article 5, AI systems which are components of the large-scale IT systems listed in Annex X that have been placed on the market or put into service before 2 August 2027 must be brought into compliance with the Regulation by 31 December 2030.
• Article 111(2) — pre-existing high-risk AI placed on the market before 2 August 2026. Operators of high-risk AI systems other than the ones referred to in Article 111(1) that have been placed on the market or put into service before 2 August 2026 only become subject to the Regulation if, as from that date, those systems are subject to significant changes in their designs. In any event, providers and deployers of high-risk AI systems intended to be used by public authorities must take the necessary steps to comply with the requirements and obligations of the Regulation by 2 August 2030.
• Article 111(3) — pre-existing GPAI models. Providers of general-purpose AI models that have been placed on the market before 2 August 2025 must take the necessary steps to comply with the obligations laid down in this Regulation by 2 August 2027.

A practical deployer Gantt for HR-tech

• Already overdue if missing. Article 4 AI-literacy programme and Article 5 inventory check (have we deployed anything that falls inside Article 5?).
• By Q1 2026. Annex III scope mapping, vendor-attestation pack for each high-risk candidate, draft Article 26 use record per system, Article 14 oversight assignments per system, GDPR Article 35 DPIA where applicable.
• By Q2 2026. Article 27 FRIA where applicable, Article 26(7) employer worker-information rollout plan, Article 50 transparency disclosures wired into UI for candidate-facing and employee-facing systems.
• Before 2 August 2026. Article 26(6) log-retention working, Article 26(5) suspension procedure documented, internal sign-off that no Article 25 re-classification trigger applies.
• Through 2026–2027. Article 72 post-market monitoring tracked at the vendor; Article 26 evidence kept up to date on every contract renewal.

Common misconceptions

• “Nothing applies until 2 August 2026.” Article 4 (AI literacy) and Article 5 (prohibitions) have applied since 2 February 2025. Article 99 penalties have applied since 2 August 2025 for the obligations that are themselves in force.
• “Pre-existing high-risk systems are grandfathered indefinitely.” Article 111(2) only grandfathers systems that are not subject to significant design changes from 2 August 2026, and only outside the public-authority deadline of 2 August 2030.
• “The 2 August 2025 governance go-live changes my obligations.” It changes your vendors’ obligations (GPAI providers) and turns on the AI Office. Deployer obligations under Article 26 still wait until 2 August 2026.
• “NIS2 deadlines move with the AI Act.” They are independent. The NIS2 transposition deadline was 17 October 2024 (Article 41 of Directive (EU) 2022/2555).

Related EU guides

• Human oversight — Article 14
• Record-keeping & logging — Article 12
• Data governance & bias testing — Article 10
• EU AI Act enforcement — who supervises and how
• NIS2 essential vs important entities

Sources

• Regulation (EU) 2024/1689, Articles 4, 5, 6, 26, 27, 50, 99, 101, 111, 113 — EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
• Directive (EU) 2022/2555 (NIS2), Article 41 (transposition deadline 17 October 2024) — EUR-Lex: eur-lex.europa.eu/eli/dir/2022/2555/oj
• European Commission — AI Act application timeline overview: digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai