AI & Privacy · guide
EU AI Act obligations timeline: what applies when
Updated
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. The dates below reflect the regulation's text at time of writing; always confirm against the Official Journal and the European Commission's AI Act pages, since implementing acts and guidance continue to arrive.
The phases
| Date | What starts applying |
|---|---|
| 2 February 2025 | Prohibited AI practices (e.g., certain social scoring, manipulative techniques, some biometric categorization) and the AI-literacy obligation. |
| 2 August 2025 | Obligations for general-purpose AI (GPAI) model providers; governance structures (AI Office, national authorities); penalties framework. |
| 2 August 2026 | The bulk of the Act, including most high-risk AI system obligations (Annex III use cases such as employment, credit, education, essential services) and transparency duties for certain systems. |
| 2 August 2027 | High-risk obligations for AI embedded in products already covered by EU product-safety law (Annex I), with their longer transition. |
What this means in practice
- Deployers, not just developers, have duties. Using a high-risk system (for hiring, credit decisions, etc.) brings obligations: human oversight, logging, informing affected people, and in some cases a fundamental-rights impact assessment.
- Classify your use cases now. The hardest work is deciding which of your systems are high-risk, limited-risk (transparency only) or minimal-risk.
- GPAI providers face documentation, copyright-policy and, for systemic-risk models, evaluation and incident-reporting duties.
- Guidance keeps arriving. The Commission publishes guidelines, codes of practice and standards requests that change how obligations are read.
How to stay current
Monitor the European Commission's AI Act pages, the EDPB (for the privacy overlap), and reputable aggregators for national implementation. RegPing AI & Privacy tags EU items by jurisdiction so a privacy or AI-governance lead can watch them without wading through US-only news.
This guide is general information, not legal advice. Dates and scope are subject to amendment and to the Commission's implementing measures — verify before relying on them.
Questions people ask
Does the EU AI Act apply to companies outside the EU?
It can. The Act applies to providers placing AI systems on the EU market and to deployers whose system outputs are used in the EU, regardless of where the company is established. Check the territorial-scope provisions against your situation with counsel.