The timeline in one view
The AI Act entered into force on 1 August 2024 and applies progressively. Definitions and the AI-literacy duty applied from 2 February 2025, together with the prohibitions on unacceptable-risk systems. The general-purpose AI (GPAI) obligations and the governance architecture applied from 2 August 2025, with a one-year adjustment period before enforcement powers became usable.
2 August 2026 is the enforcement milestone: the Commission can now use its supervision and enforcement powers against GPAI model providers - requesting documentation, conducting evaluations, demanding compliance measures and imposing fines. The transparency obligations in Article 50 become applicable and enforceable, national authorities begin enforcing the prohibitions and the AI-literacy duty, and regulatory sandboxes must be operational in every member state. The European Commission's official AI Act service desk lists the full sequence.
What the GPAI obligations require
Providers of general-purpose AI models have been obliged since August 2025 to keep technical documentation, provide information to downstream providers, adopt a copyright-compliance policy and publish a training-content summary. The new enforcement powers make those obligations real: the Commission can request documentation and information, run evaluations, require risk mitigation, and fine non-compliant providers.
Providers of models presenting systemic risk carry the heavier set: model evaluations, risk assessment and mitigation, serious-incident reporting and cybersecurity requirements. Providers of open-license models are exempt from most documentation duties but must still comply with the copyright policy and training-summary obligations unless the model presents systemic risk. Non-EU providers must appoint an authorised representative in the Union unless they release under a free and open-source licence.
The transparency and deepfake milestones
Article 50 transparency obligations - labelling AI-generated content, disclosing AI interaction and detecting synthetic content - become applicable on 2 August 2026. Providers of AI systems already on the market that generate synthetic content have until 2 December 2026 to comply with the labelling and detection requirements.
On 2 December 2026, the new prohibitions kick in for AI systems that generate or manipulate non-consensual intimate imagery and child sexual abuse material. These are the Digital Omnibus-era additions, and their early activation reflects the political priority on image-based abuse.
The high-risk phases: 2027 and 2028
The rules for high-risk AI systems listed in Annex III - used in areas such as employment, education, credit scoring and migration - apply from 2 December 2027. High-risk systems embedded in regulated products covered by Annex I follow on 2 August 2028. Between the two dates, providers and deployers must work through the full compliance package: risk-management systems, technical documentation, EU database registration, CE marking, human oversight and cybersecurity.
For companies building or deploying AI in the EU, the practical message is to start now: the gap between the August 2026 enforcement milestone and the 2027-2028 high-risk deadlines is shorter than it looks, and the compliance work - documentation, governance, testing - is not something that can be compressed into the final quarter.
Who should be acting now
Three groups are on the clock. GPAI model providers and anyone using their models in high-risk contexts; developers of high-risk systems in Annex III use-cases, who have roughly a year of runway before the December 2027 deadline; and deployers of AI that interacts with people or generates content, who must now ensure transparency labelling and the December 2026 synthetic-content transition are in hand.
The enforcement posture is also clearer than it was: the Commission holds exclusive powers over GPAI providers, national market-surveillance authorities cover the rest, and the AI Office coordinates. For organisations that treat the August 2026 date as the starting gun rather than a deadline, the remaining timeline is manageable.
