EU AI Act Deadlines: The Complete 2025-2028 Timeline

Article 5 prohibited practices became illegal in the EU on this date: manipulative techniques causing harm, social scoring, untargeted facial-image scraping, emotion recognition in workplaces and schools (outside medical/safety uses), and several others. Penalties for violations reach €35M or 7% of global turnover — the highest tier in the Act.

The same date activated Article 4: providers and deployers must take measures to ensure sufficient AI literacy among staff and others operating AI systems on their behalf. This is the one obligation that applies to virtually every company using AI, regardless of risk tier. An internal AI usage policy can support it, but it must be paired with role-appropriate training and evidence for the relevant context.

Providers of general-purpose AI models (foundation models offered to others) must maintain technical documentation, provide information to downstream providers, put a copyright compliance policy in place, and publish a training-content summary (Article 53). Models with systemic risk carry additional evaluation and incident-reporting duties.

Important nuance: calling the OpenAI or Anthropic API does not make you a GPAI provider. These duties fall on the companies training and offering the models themselves.

This remains the date for Article 50 transparency duties for limited-risk systems: chatbots must disclose they are AI, synthetic content must be machine-readably marked, and deepfakes must be labelled.

The Act also reaches its broad general application date here, with exceptions. For SaaS teams outside Annex III, this is the date to have chatbot disclosure, synthetic-content marking, and deepfake labels ready.

Current European Commission implementation material says rules for systems used in Annex III high-risk areas - including biometrics, critical infrastructure, education, employment, migration, asylum and border control - will apply from 2 December 2027.

That is the full obligation stack: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11 + Annex IV), record-keeping (Art. 12), transparency and instructions for use (Art. 13), human oversight (Art. 14), accuracy and robustness (Art. 15), conformity assessment and CE marking (Art. 43, 47-49).

Documentation is still the long pole. Teams routinely discover it takes weeks, not days - the Annex IV structure demands descriptions of data, oversight, testing and risk management that most teams have never written down.

AI systems that are safety components of products already covered by EU product-safety law (medical devices, machinery, toys, etc.) now follow the product-embedded timeline: 2 August 2028.

Systems placed on the market before these dates get transitional treatment in some cases, but a substantial modification can restart the relevant obligations - assume the deadlines apply to you unless counsel tells you otherwise.

Work backwards from your risk tier. Prohibited practice? You are already past deadline - stop and get counsel. Annex III use case (hiring, credit, education, biometrics, essential services)? Current Commission material points to 2 December 2027. Product-embedded Annex I system? 2 August 2028. Chatbot or content generation only? Article 50 transparency is 2 August 2026, but the duties are far lighter. If no Article 5, Annex III or Article 50 trigger is identified, Article 4 may still apply to providers and deployers, and other operator-specific duties or laws may remain relevant.