EU AI Act Enforcement Timeline
Every enforcement phase of Regulation (EU) 2024/1689 — from entry into force to the final transition deadline.
Phase 1 — 6 months after entry into force
Prohibited AI Practices
Article 5 prohibited practices are enforceable. Systems involving social scoring, subliminal manipulation, exploitation of vulnerabilities, real-time biometric identification in public spaces (with exceptions), emotion recognition in workplace/education, predictive policing based solely on profiling, and untargeted facial image scraping must be discontinued.
Phase 2 — 12 months after entry into force
GPAI Model Obligations
Chapter V obligations for general-purpose AI models take effect. All GPAI providers must comply with transparency, technical documentation, copyright policy, and energy consumption reporting. Systemic risk models (Article 51) face additional evaluation, incident reporting, and adversarial testing duties. The AI Office begins enforcement.
Phase 3 — 24 months after entry into force
High-Risk AI Systems (Annex III)
Full compliance required for high-risk AI systems classified under Annex III (stand-alone). Providers must meet all Chapter III Section 2 requirements: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), logging (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15). Deployer obligations (Art. 26), FRIA (Art. 27), and EU database registration (Art. 49) also apply. Market surveillance authorities begin enforcement.
Phase 4 — 36 months after entry into force
High-Risk Products (Annex I)
Obligations extend to AI systems that are safety components of products covered by Annex I Section A Union harmonisation legislation (e.g., medical devices under MDR, machinery under the Machinery Regulation, toys, lifts, pressure equipment, vehicles). These systems must meet both AI Act and sectoral product-law requirements. Notified bodies must be prepared for integrated conformity assessment.
Phase 5 — Extended transition for Annex X systems
Large-Scale EU IT Systems (Annex X)
AI systems that are components of large-scale EU IT systems listed in Annex X (SIS II, VIS, Eurodac, EES, ETIAS, ECRIS-TCN) must comply with the AI Act. Article 110 grandfathering expires for systems placed on the market before August 2027 unless significantly modified. This is the final compliance deadline in the AI Act.