![EU AI Act Timeline: 5 Dates to 2028 [2026]](https://shattered.io/wp-content/uploads/2026/11/eu-ai-act-world-first-ai-law-five-dates-to-2028-2026-gen.webp)
The EU AI Act, formally Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, is now deep into its phased rollout. The European Commission’s AI Act Service Desk timeline lays out the sequence, and it ends with the main application milestones foreseen to be completed by 2 August 2028. As of today, November 04, 2026, the first three waves of rules are already live, and two more are scheduled.
That matters well beyond Brussels. Any team that builds, fine-tunes, hosts or deploys AI for users in the European Union has to map its products against a calendar that started in February 2025. Engineers who already run content filters and policy layers, for example the kind we walked through in our 12-step AI guardrails tutorial, will find that several legal duties line up with controls they ship anyway.
This analysis walks through what the law says, which dates are fixed, what the Commission has published about enforcement, and what builders should plan for. It sticks to the verified timeline and to material from official EU channels. Where we offer judgment, we label it as our analysis. Where the record is silent, such as fine amounts or named company cases, we say so rather than guess.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
What the EU AI Act Is and Why It Matters #
The regulation sets harmonised rules for artificial-intelligence systems across the European Union. Its stated purpose, per the Commission, is to protect health, safety, fundamental rights, democracy, the rule of law and the environment while keeping the single market open to AI products. The text entered into force on 1 August 2024, which makes it the first binding horizontal law on AI from a major jurisdiction.
The word “horizontal” carries weight here. The Act does not regulate one industry. It regulates AI by function and risk, so a chatbot on a retail site, a text generator inside an office suite and a foundation model sold through an API all land inside its scope. Obligations differ by role. A provider that places a system on the EU market carries different duties from a deployer that uses someone else’s system.
For readers in the United States and elsewhere, the reach question comes first. The Commission’s own pages describe obligations tied to the EU market, not to where a company is headquartered. A US startup that offers a model or an AI feature to EU users therefore has to treat the Act as a product requirement, much as the GDPR forced global privacy changes after 2018. That comparison is our framing, not a Commission statement, but it explains why compliance teams outside Europe track every milestone.
The Act also reshapes how technical teams talk to lawyers. Terms like general-purpose AI model, systemic risk, provider, deployer and synthetic content now carry defined meanings. Product managers who ignore those definitions risk misclassifying a feature, and misclassification is where most compliance mistakes begin.
The Official Timeline: Five Dates From 2025 to 2028 #
The Commission’s implementation timeline breaks the Act into stages rather than a single switch-on day. The table below consolidates the dates confirmed in the official sources. It separates what already applies from what is still ahead.
| Date | What applies | Status on 4 Nov 2026 |
|---|---|---|
| 1 August 2024 | Regulation enters into force | Done |
| 2 February 2025 | Prohibitions, definitions and AI-literacy provisions | Applying |
| 2 August 2025 | Governance rules and obligations for general-purpose AI models | Applying |
| 2 August 2026 | Article 50 transparency requirements and main enforcement start | Applying |
| 2 December 2027 | Obligations for high-risk systems listed in Annex III | Scheduled |
| 2 August 2028 | Obligations for high-risk systems embedded in regulated products (Annex I) | Scheduled |
Source: European Commission AI Act Service Desk and implementation timeline pages. Note the pattern. The law front-loads the bans and the model-level rules, then pushes the heaviest product-conformity work out to late 2027 and 2028. That ordering gives regulators time to stand up bodies and gives industry time to finish technical standards.
February 2025: Prohibitions and AI Literacy Arrive #
The first wave landed on 2 February 2025. The Commission lists three elements as applicable from that date: the prohibitions, the definitions and the AI-literacy provisions. The prohibitions put hard limits on certain AI practices inside the EU, and violations can incur fines of up to €35 million or 7% of worldwide turnover, according to the European Commission. Because the fact sheet behind this report does not enumerate each banned practice, we will not list them here. Readers should check the regulation text or the Commission’s guidance pages for the exact scope.
The AI-literacy provisions matter more than they first appear. They push organizations to make sure the people who operate and oversee AI systems understand what those systems can and cannot do. In practice that means training, documentation and internal policy, not a software patch. Many firms treated literacy as a soft item in early 2025. By late 2026, auditors and customers increasingly ask for proof of it.
Definitions also did real work in this first wave. By fixing what counts as an AI system, a provider and a deployer, the Act settled arguments that would otherwise have lingered for years. Legal teams could finally classify products against shared terms. That sounds dry, but it is the groundwork every later duty depends on.
City and state governments elsewhere have started to regulate narrower slices of the same problem. Our earlier report on New York City’s AI hiring rule shows the contrast. The EU wrote one framework for the whole market, while US jurisdictions so far have moved use case by use case.
August 2025: General-Purpose AI Rules Switch On #
The second wave, applicable from 2 August 2025, covers governance rules and obligations for general-purpose AI models. This is the part of the Act that speaks most directly to the companies building large language models and other foundation models. According to the Commission’s digital strategy pages, providers of these models must prepare technical documentation, pass information to downstream providers, put a copyright-compliance policy in place and publish a sufficiently detailed summary of the content used for training. The Commission adds that breaches of these general-purpose AI rules can trigger fines of up to €15 million or 3% of global turnover.
The copyright element draws the most debate. Providers must maintain a policy for complying with EU copyright law, including any text-and-data-mining opt-outs rightsholders have declared. That requirement has pushed the industry toward machine-readable opt-out signals. We covered one such effort in our report on four AI developers backing one opt-out token, which shows how quickly the technical ecosystem moved once the legal duty existed.
Systemic-Risk Models Face Extra Duties
The Commission describes a higher tier for the most advanced general-purpose models, classed as carrying systemic risk. Providers of those models face added duties covering model evaluations, adversarial testing, systemic-risk assessment, serious-incident reporting and cybersecurity. The risk categories the Commission names include chemical, biological, radiological or nuclear misuse, cyberattacks, harmful manipulation and loss of control.
The Commission’s pages do not publish a list of named models in that tier in the material we retrieved. The classification depends on a model’s legal designation and capabilities, not on its brand or launch date. Anyone claiming a specific commercial model is or is not designated should point to an official notice.
Who Governs the Models
The official implementation timeline identifies three bodies tied to general-purpose AI governance: the AI Board, the Scientific Panel and the Advisory Forum. The European AI Office holds supervisory and enforcement responsibility for general-purpose models, according to the Service Desk, while national authorities stay central for many rules that govern AI systems.
August 2026: Article 50 Transparency and Enforcement Begin #
The third wave arrived on 2 August 2026, three months ago. Two things switched on together. The Article 50 transparency requirements began to apply, and the main enforcement powers started for applicable provisions. The Service Desk states that from that date some enforcement powers of the AI Office and of Member State authorities start to apply, covering prohibited practices, transparency requirements for certain AI systems and the rules for general-purpose AI models.
Article 50 is the section most users will actually feel. Per the Commission’s Article 50 pages, providers of AI systems that interact directly with people, such as chatbots, agents and avatars, must make sure users know they are dealing with AI unless that is obvious from context. Providers of systems that generate synthetic audio, images, video or text must ensure outputs carry machine-readable markings that identify them as AI-generated or manipulated. The Commission says those markings must be effective, reliable, robust and interoperable.
The article also covers disclosure of deepfakes and certain AI-generated or manipulated content. Deployers of emotion-recognition or biometric-categorisation systems must inform the people exposed to them. The Commission’s 2026 Article 50 guidelines add that the marking duty expressly reaches general-purpose AI systems when they generate synthetic audio, image, video or text.
The 2 December 2026 Grace Period
One date sits just ahead of us. The Service Desk FAQ says providers of AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking and detection obligation under Article 50(2). That leaves under four weeks for legacy products to ship watermarking or metadata fixes. Systems launched after the August date have no such cushion, per the same FAQ.
Our reading is that this grace window explains why the next few weeks should bring a cluster of product updates, labeling features and disclosure banners from generative-AI vendors. That is an inference from the deadline, not a report of any specific company’s plans.
High-Risk Systems: Why the Heaviest Duties Come Later #
High-risk obligations arrive last. For systems listed in Annex III, the schedule now points to 2 December 2027. For high-risk AI embedded in products regulated elsewhere under EU law (Annex I), the date is 2 August 2028. The European Parliament’s Legislative Train page records that on 19 November 2025 the Commission proposed targeted amendments, called the Digital Omnibus on AI, to address implementation challenges. That proposal became Regulation (EU) 2026/1744, which entered into force on 27 July 2026.
According to the Parliament’s summary, the problems driving that proposal included delayed standards, the designation of competent authorities and capacity for conformity assessment. In plain terms, the machinery needed to certify high-risk systems was not ready on the original schedule. The Commission’s regulatory framework page also points to guidelines on classifying high-risk systems, which the Commission developed in draft after a public consultation.
The takeaway for product teams is straightforward. The later dates are not a reason to wait. High-risk compliance involves documentation, testing records and quality processes that take quarters to build. A team that starts in mid-2027 for a December 2027 deadline will struggle. The 13 months between now and the Annex III date are the practical build window.
Who Owes What: Obligations by Role #
The Act assigns duties by role, so the first compliance task is to work out which hat your company wears for each product. The table below summarizes obligations the Commission’s pages describe for the roles most relevant to AI-model and app builders.
| Role | Core obligation | Applies from |
|---|---|---|
| General-purpose AI model provider | Technical documentation, downstream information, copyright policy, training-content summary | 2 August 2025 |
| Provider of systemic-risk model | Evaluations, adversarial testing, risk assessment, incident reporting, cybersecurity | 2 August 2025 |
| Provider of chatbot, agent or avatar | Inform users they are interacting with AI unless obvious | 2 August 2026 |
| Provider of generative system | Machine-readable marking of synthetic audio, image, video, text | 2 August 2026 (until 2 December 2026 for legacy systems) |
| Deployer of emotion-recognition or biometric-categorisation system | Inform exposed individuals | 2 August 2026 |
| Provider of Annex III high-risk system | High-risk obligations | 2 December 2027 |
| Provider of Annex I embedded high-risk system | High-risk obligations | 2 August 2028 |
Source: European Commission digital strategy pages and AI Act Service Desk. The table compresses long legal text and does not replace the regulation. Companies often hold more than one role. A firm that fine-tunes a third-party model and wraps it in a branded chatbot may count as a provider of the resulting system, which pulls it into Article 50 even if the underlying model came from elsewhere.
What EU Officials Have Said About the Law #
Statements from EU leaders frame the political intent behind the Act. Each of the following comes from an official EU channel and appears word for word.
Brando Benifei, a Member of the European Parliament and co-rapporteur on the AI Act, said during the plenary debate, as published in the European Parliament press room: “We finally have the world’s first binding law on artificial intelligence, to reduce risks, create opportunities, combat discrimination, and bring transparency.”
Ursula von der Leyen, President of the European Commission, welcomed the December 2023 political agreement in a Commission statement: “Our AI Act will make a substantial contribution to the development of global rules and principles for human-centric AI.” A separate statement carried by the European External Action Service on the provisional agreement put it this way: “The AI Act transposes European values to a new era.”
Margrethe Vestager, then Executive Vice-President of the Commission for a Europe Fit for the Digital Age, marked the entry into force on 1 August 2024 in a Commission press release: “With the AI Act, the EU has taken an important step to ensure that AI technology uptake respects EU rules in Europe.” In the same release, Commissioner Thierry Breton, responsible for the internal market, said: “Today marks a major milestone in Europe’s leadership in trustworthy AI.”
These remarks share a theme. Officials present the law as both a protection and a market-shaping tool. Whether it achieves the second aim depends on how the enforcement bodies behave over the next two years, a point we return to in the predictions section.
Market Impact: What Model Builders and App Teams Should Budget For #
The official sources we retrieved do not name companies under investigation, so we decline to describe any firm’s exposure. They do put ceilings on penalties: up to €35 million or 7% of worldwide turnover for prohibited-AI violations and up to €15 million or 3% of global turnover for breaches of the general-purpose AI rules, according to the European Commission. With enforcement powers live since 2 August 2026, that is enough to change budgets.
Three cost centers stand out in our analysis. First, documentation. General-purpose model providers owe technical documentation and training-content summaries, and keeping them current means engineering time, not just legal review. Second, provenance tooling. Article 50 marking forces generative products to embed machine-readable signals in outputs, which touches pipelines for image, audio, video and text. Third, governance staffing. The AI-literacy duty and the incident-reporting duty for systemic-risk models both need named owners inside the company.
Smaller teams face a different trade-off. Open-weight releases circulate widely, and downstream developers who build products on them become providers of their own systems. Our open-weight AI models spec sheet gives builders a practical view of what is available, but the legal classification of a derived product still needs its own review. A free model does not mean a free-of-obligation product.
Investors watch the same signals from a different angle. Analysts have questioned whether AI revenue will justify current spending, and regulatory friction adds one more variable to that debate. Gartner, in a forecast we covered, expects 30% of AI-driven layoffs to be rehired by 2029. That kind of cost correction suggests companies are already learning that automation carries hidden compliance and oversight costs.
How the EU Approach Compares With Other Regimes #
The EU chose a binding, cross-sector statute. Other approaches rely on narrower local rules or voluntary industry standards. The comparison below uses only features visible in the official sources and in our earlier reporting.
| Approach | Scope | Binding? | Example |
|---|---|---|---|
| EU AI Act | Whole market, tiered by risk and by role | Yes, enforceable since 2 August 2026 for applicable provisions | Regulation (EU) 2024/1689 |
| City-level rule | One use case, such as hiring tools | Yes, within the jurisdiction | New York City AI hiring rule (Local Law 144) |
| Industry opt-out signal | Training-data permissions | Voluntary | Shared AI opt-out token backed by four developers |
| Company safety policy | Individual products | Self-imposed | In-house guardrails and filters |
The contrast shows why the EU law dominates planning conversations. It is the only item in the table that is both broad and binding. Voluntary signals and local rules fill gaps, yet none of them sets obligations for foundation-model providers the way the Act does. Teams that satisfy the EU framework will usually find narrower rules easier to meet, though the reverse does not hold.
Historical Context: From Political Deal to Live Enforcement #
The Act took years to negotiate. EU institutions announced a political agreement in December 2023, according to the Commission statement quoted above. The European Parliament approved the rules in early 2024, as its press room records. The final regulation carries a 13 June 2024 date and became law on 1 August 2024.
The rollout then ran on a slower fuse than many companies expected. Prohibitions came six months after entry into force. Model rules followed a year after entry into force. Transparency and enforcement came two years after. High-risk duties stretch to three and four years. The staggered design reflects a basic fact about regulating fast-moving technology. Lawmakers could not write all the rules for 2028 products in 2024, so they sequenced the work.
The 2025 Digital Omnibus proposal, adopted as Regulation (EU) 2026/1744 on 8 July 2026, shows that sequencing has limits. The Commission itself acknowledged that standards and authority designations lagged, and the amending regulation adjusted high-risk timing. That episode suggests regulators will accept schedule changes when infrastructure is not ready, but they have not shown the same flexibility on the already-live prohibitions and model rules.
Five Predictions for the Next 24 Months #
These forecasts are our analysis. They rest on the confirmed timeline and are not statements from any official or company.
- Labeling features will spread before 2 December 2026. The grace period for legacy generative systems ends then, so expect disclosure banners and provenance metadata to appear in more products during November.
- The first public enforcement actions will target transparency or model documentation. Those rules have been live longest in their enforceable form, and they are the easiest to test from outside a company.
- Guidance documents will keep multiplying. The Commission has already issued Article 50 guidelines and draft high-risk guidelines. More classification examples should follow as December 2027 nears.
- Further timing adjustments remain possible. The Digital Omnibus precedent shows that if standards stay late, pressure to move dates again will return, though prohibitions and model duties look unlikely to slip.
- Open-weight developers will add compliance notes to releases. Downstream builders need classification help, and model cards are the natural place to provide it.
Any of these could miss. Regulatory calendars shift, and enforcement priorities depend on staffing at the AI Office and national authorities, details the sources do not settle.
What Developers and Product Teams Should Do This Quarter #
With the first three waves live, the practical work falls into a short list. Start with an inventory. Record every AI feature, the model behind it, who built the model, and which EU users can reach it. Then tag each entry with its role (provider or deployer) and the Act provisions that apply.
ai_inventory:
- feature: support-chatbot
model_source: third-party general-purpose model
role: provider-of-system
eu_users: true
article_50: disclose-ai-interaction
marking_deadline: "2026-12-02" # only if placed on market before 2026-08-02
owner: product-lead
- feature: image-generator
role: provider-of-system
article_50: machine-readable-marking
owner: ml-platform
Next, assign owners and dates. Each row needs a named person and a deadline drawn from the timeline table above. Third, test the technical controls. Check that chatbots disclose their AI nature at the start of a session, and that generated media carries a signal other tools can read. Finally, document everything. Regulators and enterprise customers ask for evidence, and a dated record of what you shipped and why is the cheapest defense.
Teams that build on general-purpose models should also request the downstream information that model providers must supply. The Act obliges providers to share it, so asking for it costs nothing and fills the gaps in your own file. If a vendor cannot provide it, treat that as a procurement risk.
Frequently Asked Questions #
What is the EU AI Act? It is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, also called the Artificial Intelligence Act. It sets harmonised rules for AI systems in the European Union and aims to protect health, safety, fundamental rights, democracy, the rule of law and the environment.
When did the EU AI Act take effect? It entered into force on 1 August 2024. Its provisions apply in stages, starting with prohibitions, definitions and AI-literacy rules on 2 February 2025.
What changed on 2 August 2026? The Article 50 transparency requirements began to apply, and the main enforcement powers started for applicable provisions, according to the Commission’s AI Act Service Desk.
When do high-risk AI rules apply? Obligations for high-risk systems listed in Annex III are scheduled from 2 December 2027. Obligations for high-risk systems embedded in regulated products under Annex I are scheduled from 2 August 2028.
Does the Act apply to companies outside the EU? The Commission ties obligations to the EU market. A non-EU company that offers AI systems or models to EU users should assume the rules reach it and should confirm its role with legal counsel.
What must chatbots and AI image tools disclose? Per the Commission’s Article 50 pages, providers of chatbots, agents and avatars must inform users they are interacting with AI unless obvious. Providers of generative systems must ensure outputs carry machine-readable markings. Legacy systems placed on the market before 2 August 2026 have until 2 December 2026 for the marking duty.
How large are the fines? According to the European Commission, prohibited-AI violations can incur fines of up to €35 million or 7% of worldwide turnover, and breaches of the general-purpose AI rules can trigger fines of up to €15 million or 3% of global turnover. Check the regulation text for the full penalty provisions.
Where can I follow more AI model news? Our AI and machine learning section tracks model releases, policy changes and tooling updates as they develop.