Plan Your AI Act Compliance

What happens: The AI Act is published in the Official Journal of the European Union. It enters into force 20 days later, on 1 August 2024.

Resource: Official Journal

What happens: Member States must identify and publicly list the authorities and bodies responsible for fundamental rights protection, and notify the European Commission and other Member States.

Required by: Article 77(2)

Resource: Fundamental rights protection authorities

Relevant to: Providers, deployers, importers and distributors of AI systems

What happens: The European Commission publishes guidelines explaining the prohibited AI practices under Article 5 of the AI Act.

Required by: Article 96(1)(b)

Resource: Guidelines on prohibited AI practices

Relevant to: Providers of general-purpose AI models

What happens: The General-Purpose AI Code of Practice was due to be ready by this date. Its final version was published later, on 10 July 2025.

Required by: Article 56(9)

Resource: General-Purpose AI Code of Practice

Relevant to: Providers of general-purpose AI models

What happens: The European Commission publishes guidelines on the scope of obligations for providers of general-purpose AI models.

Required by: Article 96(1)

Resource: Scope of obligations for GPAI providers

Relevant to: GPAI model providers, notified bodies, Member State authorities and other actors covered by the applicable provisions

What happens: The following rules start to apply: Notified bodies (Chapter III, Section 4), GPAI models (Chapter V), Governance (Chapter VII), Confidentiality (Article 78), Penalties (Articles 99 and 100).

Required by: Article 113(b)

Relevant to: Providers, deployers and other organizations assessing whether an AI system qualifies as high-risk

What happens: Under Article 6(5), the European Commission was required to provide guidelines on the practical implementation of Article 6 by this date, including practical examples of AI systems that should and should not be classified as high-risk. Draft guidelines were subsequently published for consultation on 19 May 2026; they were not final guidelines at that time.

Required by: Article 6(5)

Resource: Draft guidelines on the classification of high-risk AI systems

Relevant to: Providers and deployers of generative AI systems subject to the transparency obligations for AI-generated or manipulated content

What happens: The European Commission publishes the final Code of Practice on Transparency of AI-Generated Content. The voluntary code provides practical measures to help providers and deployers comply with the marking and labelling obligations under Article 50(2), (4) and (5), which begin to apply on 2 August 2026.

Required by: Article 50(7)

Resource: Code of Practice on Transparency of AI-Generated Content

Relevant to: Providers and deployers of AI systems subject to the transparency obligations under Article 50, as well as competent authorities

What happens: The European Commission publishes final guidelines on the scope and practical implementation of the transparency obligations under Article 50. The guidelines address direct interaction with AI systems, machine-readable marking of AI-generated or manipulated content, emotion recognition and biometric categorisation systems, deepfakes, and AI-generated text concerning matters of public interest.

Required by: Article 96(1)(d)

Resource: Guidelines on Article 50 Transparency Obligations

What happens: The Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force and amends the EU AI Act, including its implementation timeline and several substantive requirements. Articles 102 to 110 of the AI Act also begin to apply from this date.

Amendment note: The Digital Omnibus on AI amends the AI Act (Regulation (EU) 2024/1689); it does not replace the AI Act.

Required by: Article 4 of the Digital Omnibus on AI (Regulation (EU) 2026/1744) and Article 113(d) of the AI Act, as amended

Resource: Digital Omnibus on AI — Official Journal

Relevant to: All providers and deployers of AI systems

What happens: Article 4 is replaced. Providers and deployers must take measures to support the development of AI literacy among their staff and other persons operating AI systems on their behalf. The provision expressly states that they are not required to guarantee any specific level of AI literacy for any individual. The Commission and Member States must support these efforts, and the AI Board adopts recommendations setting out common objectives.

Amendment note: The original, stricter version of Article 4 applied from 2 February 2025 until this date.

Required by: Article 4, as replaced by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

Relevant to: Providers of high-risk AI systems, and providers and deployers of other AI systems and models

What happens: A new Article 4a allows the exceptional processing of special categories of personal data where strictly necessary for bias detection and correction, subject to six cumulative safeguards. The legal basis is available to providers of high-risk AI systems and, in a second paragraph, to providers and deployers of other AI systems and models and to deployers of high-risk AI systems. It creates no obligation to carry out bias detection.

Amendment note: Article 4a was introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744) and replaces the former Article 10(5), which was deleted. It is not subject to the deferred application dates for the substantive high-risk requirements in Chapter III, Sections 1 to 3.

Required by: Article 4a of the AI Act, as introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

Relevant to: Providers assessing whether an AI system qualifies as high-risk under Article 6(1)

What happens: The definition of "safety component" in Article 3, point (14), is narrowed and tied to the notion of a safety function, understood as an intended purpose determined by the provider. Integration into a regulated product does not by itself mean that an AI system fulfils a safety function.

Amendment note: The corresponding new paragraphs in Article 6(1a) to (1c) sit in Chapter III, Section 1, and therefore only become applicable on 2 December 2027 or 2 August 2028, depending on the classification of the system.

Required by: Article 3, point (14), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

Relevant to: Providers, deployers and other operators of AI systems covered by the new prohibited-practice provisions

What happens: New prohibitions begin to apply to the placing on the market, putting into service or use of certain AI systems that generate or manipulate realistic non-consensual intimate material depicting identifiable persons or material constituting child sexual abuse material. The prohibitions apply subject to the specific conditions and safeguards set out in Article 5(1a) and (1b).

Amendment note: These prohibited practices were introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

Required by: Article 5(1), points (ba) and (bb), and Article 5(1a) and (1b), as introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

Relevant to: Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text content and were placed on the market before 2 August 2026

What happens: Providers of these existing systems must take the necessary steps to comply with the machine-readable content-marking requirements under Article 50(2) by this date.

Amendment note: This transitional deadline was introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

Required by: Article 111(4), as introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744), in conjunction with Article 50(2)

Relevant to: Providers of general-purpose AI models placed on the market before 2 August 2025

What happens: Providers of these GPAI models must comply with the applicable AI Act obligations by this date.

Required by: Article 111(3)

Relevant to: Providers and operators of AI systems used as components of the large-scale IT systems listed in Annex X

What happens: AI systems placed on the market or put into service before this date must be brought into compliance with the AI Act by 31 December 2030.

Required by: Article 111(1)

What happens: Member States must ensure that their competent authorities have established at least one AI regulatory sandbox at national level and that it is operational by this date. The sandbox may also be established jointly with the competent authorities of other Member States.

Amendment note: This deadline reflects the amendment introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744). The original deadline was 2 August 2026.

Required by: Article 57(1), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

Relevant to: Providers of high-risk AI systems classified under Article 6(1) and covered by the Union harmonisation legislation listed in Section A of Annex I

What happens: By this date, the European Commission must adopt delegated acts specifying which high-risk AI systems are concerned, which requirements or obligations under Articles 9 to 15 and 17 to 25 may be limited, and the conditions and scope of any such limitation. A limitation is only possible where the sectoral legislation provides an equivalent or higher level of protection and where the overall level of protection is not reduced.

Amendment note: This equivalence clause was introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744). Until the delegated acts are adopted, the requirements remain fully applicable.

Required by: Article 2(13), as introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

Relevant to: Providers, deployers and other operators of high-risk AI systems classified under Article 6(2) and Annex III

What happens: The requirements and obligations in Chapter III, Sections 1 to 3, begin to apply to these high-risk AI systems. For systems of the same type and model placed on the market or put into service before this date, the AI Act generally applies only if their design is significantly changed from this date onward.

Amendment note: This application date reflects the amended implementation timeline introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

Required by: Article 111(2) and Article 113(c)(i), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

What happens: The European Commission evaluates the functioning of the AI Office.

Required by: Article 112(5)

What happens: The European Commission evaluates the impact and effectiveness of the voluntary codes of conduct and repeats the evaluation every three years.

Required by: Article 112(7)

What happens: The European Commission evaluates whether amendments are needed to the list of high-risk areas and use cases covered by Annex III, the AI systems covered by the transparency obligations in Article 50, and the AI Act’s supervision and governance framework. It reports its findings to the European Parliament and the Council and repeats the review every four years.

Required by: Article 112(2)

What happens: The European Commission submits a public progress report on standardization deliverables supporting the energy-efficient development of general-purpose AI models. The report is submitted to the European Parliament and the Council and repeated every four years.

Required by: Article 112(6)

Relevant to: Providers and other operators of high-risk AI systems classified under Article 6(1) and related to products covered by the Union harmonisation legislation listed in Section A of Annex I

What happens: The requirements and obligations in Chapter III, Sections 1 to 3, begin to apply to these high-risk AI systems. For systems of the same type and model placed on the market or put into service before this date, the AI Act generally applies only if their design is significantly changed from this date onward.

Section B exception: For high-risk AI systems related to products covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 of the AI Act apply directly. The relevant AI requirements are otherwise integrated into the applicable sectoral product legislation. Machinery is listed in Section B following the Digital Omnibus on AI (Regulation (EU) 2026/1744).

Amendment note: This application date reflects the amended implementation timeline introduced by the Digital Omnibus on AI (Regulation (EU) 2026/1744).

Required by: Article 2(2), Article 111(2) and Article 113(c)(ii), as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744)

What happens: The original five-year period for the Commission’s delegated powers listed in the first sentence of Article 97(2) ends. It is automatically extended for additional five-year periods unless the European Parliament or the Council objects at least three months before the end of the relevant period.

Required by: Article 97(2)

Relevant to: Providers and deployers of high-risk AI systems intended to be used by public authorities

What happens: These providers and deployers must take the necessary steps to comply with the applicable AI Act requirements and obligations by this date.

Required by: Article 111(2)

Relevant to: AI systems used as components of the large-scale IT systems listed in Annex X and placed on the market or put into service before 2 August 2027

What happens: These AI systems must be brought into compliance with the AI Act by this date.

Required by: Article 111(1)

What happens: The European Commission assesses how the AI Act has been enforced and reports its findings to the European Parliament, the Council and the European Economic and Social Committee.

Required by: Article 112(13)