In one sentence. The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases: 2 February 2025 (prohibited AI practices + AI literacy), 2 August 2025 (GPAI models + governance + penalties), 2 August 2026 (high-risk Annex III systems — the main wave), 2 August 2027 (high-risk Annex I product-embedded systems). Maximum fines reach €35 million or 7% of global turnover for prohibited practices. Official source: EUR-Lex Regulation (EU) 2024/1689.
This timeline matters because early phases are already enforceable — prohibited-practice violations sanctionable since February 2025, GPAI compliance since August 2025. The big wave for most enterprises is August 2026.
Key takeaways
- 1 August 2024: AI Act entered into force.
- 2 February 2025: Articles 1-5 + AI literacy applicable.
- 2 August 2025: GPAI rules + national authorities + penalties.
- 2 August 2026: High-risk Annex III systems applicable (most enterprises).
- 2 August 2027: High-risk Annex I (embedded in regulated products).
- Fines up to €35M or 7% of global turnover for prohibited practices.
1. Entry into force vs application
- Entry into force: 1 August 2024 (20 days after OJ publication 12 July 2024)
- General application: 2 August 2026 (24 months after entry into force)
- Specific provisions accelerated or delayed per Article 113
2. Phase 1 — 2 February 2025
Applicable from this date:
- Article 1 subject matter
- Article 2 scope
- Article 3 definitions
- Article 4 AI literacy (Article 4 obligation on providers and deployers to ensure sufficient AI literacy of staff)
- Article 5 prohibited AI practices
Prohibited practices include:
- Subliminal manipulation causing harm
- Exploitation of vulnerabilities (age, disability, social/economic situation)
- Social scoring by public authorities
- Predictive policing solely from profiling
- Untargeted scraping for facial recognition databases
- Emotion recognition in workplace/education (limited exceptions)
- Biometric categorisation by sensitive attributes
- Real-time remote biometric identification in public for law enforcement (narrow exceptions)
Sanctions for Article 5 violations: up to €35M or 7% of global turnover (Article 99(3)).
3. Phase 2 — 2 August 2025
Applicable from this date:
- Chapter V General Purpose AI models (GPAI)
- Chapter III Section 4 notified bodies
- Chapter VII governance (AI Office, Board, advisory forum, scientific panel)
- Chapter XII penalties
GPAI obligations include:
- Technical documentation (Annex XI)
- Information for downstream providers (Annex XII)
- Copyright policy
- Training data summary
GPAI with systemic risk (compute >10^25 FLOPs) face stricter obligations: model evaluations, adversarial testing, incident reporting, cybersecurity.
4. Phase 3 — 2 August 2026 (main wave)
Applicable from this date:
- General application of the Act
- High-risk AI systems listed in Annex III become subject to all Chapter III requirements
Annex III covers:
- Biometric identification and categorisation
- Critical infrastructure management
- Education and vocational training (admissions, scoring)
- Employment (recruiting, performance, dismissal decisions)
- Essential private and public services (credit, insurance, social benefits)
- Law enforcement
- Migration, asylum, border control
- Administration of justice and democratic processes
Provider obligations (Chapter III Section 2): risk management, data governance, technical documentation, transparency, human oversight, accuracy/robustness/cybersecurity, conformity assessment, registration, post-market monitoring.
5. Phase 4 — 2 August 2027
Applicable from this date:
- High-risk AI systems in Annex I products (machinery, toys, medical devices, in vitro diagnostics, etc.) — extended deadline allows alignment with sector regulations
6. Transitional rules
- GPAI placed on market before 2 August 2025: must comply by 2 August 2027
- High-risk systems placed on market before 2 August 2026: must comply by 2 August 2030 unless substantially modified
- AI used by public authorities: must comply by 2 August 2030
7. Sanctions matrix
| Violation | Fine cap |
|---|---|
| Prohibited practices (Article 5) | €35M or 7% of global turnover |
| Non-compliance with high-risk obligations | €15M or 3% of global turnover |
| Supply of incorrect information to authorities | €7.5M or 1% of global turnover |
For SMEs and start-ups, fines are typically the lower of the two values.
8. Governance institutions
- AI Office (Commission, operational since 2024)
- European Artificial Intelligence Board (Member States + Commission)
- Advisory forum (stakeholders)
- Scientific panel (independent experts)
- National competent authorities designated by 2 August 2025
9. Compliance checklist by phase
Before 2 February 2025: ensure no prohibited practices; AI literacy training for staff handling AI systems.
Before 2 August 2025 (for GPAI providers): technical documentation, training data summary, copyright policy, downstream information; systemic-risk providers add evaluations and incident reporting.
Before 2 August 2026 (high-risk Annex III): full Chapter III Section 2 compliance including risk management, data governance, human oversight, conformity assessment.
10. Interaction with GDPR
The AI Act explicitly does not affect GDPR (Article 2(7)). High-risk AI systems involving personal data require both AI Act compliance and GDPR compliance (DPIA, lawful basis, transparency). See AI Act vs GDPR.
11. Tooling
Legiscope offers AI Act risk classification, GPAI documentation, high-risk Annex III conformity assessment workflow, and unified GDPR + AI Act records. See also EU AI Act timeline, AI Act compliance tools, high-risk systems.
FAQ
What are the EU AI Act effective dates?
1 August 2024 (entry into force), 2 February 2025 (prohibited practices + AI literacy), 2 August 2025 (GPAI + governance + penalties), 2 August 2026 (high-risk Annex III), 2 August 2027 (high-risk Annex I in regulated products).
When does the AI Act become fully applicable?
2 August 2026 — general application. Phased provisions before and after this date.
When do GPAI rules apply?
2 August 2025 for new GPAI models. Models already on market before this date have until 2 August 2027 to comply.
What are the maximum AI Act fines?
€35M or 7% of global turnover for prohibited practices (Article 5). €15M or 3% for high-risk non-compliance. €7.5M or 1% for incorrect information to authorities.
Where is the official AI Act text?
EUR-Lex Regulation (EU) 2024/1689, published in OJ L of 12 July 2024.
Legiscope automates this for you
Stop doing compliance manually. Legiscope's AI handles ROPA creation, DPA audits, and gap analysis — in minutes, not weeks.
Start free trial
