The AI Act timeline in plain language

The European AI Act is the world’s first broad AI law — and also a law that does not take effect all at once, but in phases. That makes sense: some rules require years of preparation from manufacturers and regulators, others can apply straight away. But it does not make things clearer for a normal organisation. So here is the timeline in plain language: what already applies, what is coming, and what each phase means for you.

One honest note up front: below we only mention the dates from the official phase-in schedule that we are certain of. For details that differ per situation — and certainly for the question of whether your specific system falls into a particular category — the rule is always: check the official source or ask a lawyer. The regulation itself and the European Commission’s accompanying information are publicly available.

August 2024: the law enters into force

The AI Act was published in the summer of 2024 and entered into force on 1 August 2024. “Entered into force” here means: the law officially exists and the clock on the phase-in schedule started ticking. At that moment no obligations applied to organisations yet — the subsequent phases determine when which rules actually become applicable.

What this meant for a normal organisation: nothing mandatory yet, but it was the starting signal to take stock: which AI do we actually use, for what, and who works with it?

2 February 2025: prohibited practices and AI literacy

This is the first phase with real obligations, and it touches almost everyone who uses AI. Since 2 February 2025, two things apply:

• The ban on certain AI practices. AI applications with an unacceptable risk are prohibited. Think of systems for social scoring by governments and AI that manipulates people in a way that causes harm. For most normal organisations this is mainly a check: are we using anything that falls into this category? Usually the answer is no — the prohibited categories are deliberately kept narrow and extreme.
• The AI literacy obligation (Article 4). Organisations that provide or deploy AI must ensure that their staff and others working with AI on their behalf have a sufficient level of AI literacy — appropriate to their role, experience and the context in which the AI is used.

That second obligation is the most important one for most readers, and it is often missed because all the media attention went to the prohibitions. Does your team use ChatGPT, Copilot or another AI tool for work? Then this applies to you — regardless of the size of your organisation. The law does not prescribe how you arrange that literacy (there is no mandatory diploma or fixed programme), but it does require that you arrange it. And whoever arranges it is wise to make it demonstrable. More on the team approach on our employers page; how to move from resistance to skill is covered in this article.

2 August 2025: rules for general-purpose AI models

One year after entry into force, the rules for so-called general-purpose AI (GPAI) became applicable — the large, broadly deployable models such as those behind well-known chatbots and image generators. Providers of such models must since then be transparent about training data and technical documentation, among other things, and additional requirements apply to the most powerful models. Around this date the administrative side also got going: supervisory structures and the possibility of penalties.

What this means for a normal organisation: few direct obligations — this phase targets the makers of the large models, not their users. Indirectly you do notice it: providers publish more documentation about their models, which makes it easier for you to judge which tool you trust with which work.

2 August 2026: most remaining obligations

Two years after entry into force, the largest part of the regulation becomes applicable. The core of this phase is the rules for high-risk AI systems: AI deployed in domains where decisions have major consequences for people. The regulation mentions, among others, applications around recruitment and selection, education, access to essential services, and law enforcement. Heavy requirements apply to such systems: risk management, data quality, documentation, human oversight, transparency.

Important to know: most requirements fall on the providers of high-risk systems, but users (in the law: deployers) also get obligations — such as using the system according to the instructions, ensuring human oversight, and keeping relevant logs. From this phase, transparency requirements also apply to certain AI applications, such as making clear that someone is talking to a chatbot.

What this means for a normal organisation: this is the phase in which you seriously need to know what you have in house. Do you use AI in hiring, performance assessment, testing pupils, or access to services? Then you may be dealing with the high-risk rules, even if you only purchase the software. For the precise delineation of what is and is not high-risk: check the official source — the details matter, and additional guidance from the European Commission is still coming. For schools, which deal with these categories relatively often, we have a dedicated page.

August 2027: the final parts

For part of the obligations, a longer transition period applies, until August 2027. This includes high-risk AI embedded in products already covered by other European product legislation (such as medical devices and machinery). Transitional arrangements also apply to certain existing systems and models. The precise delineation here is specialist territory — if your situation might fall into this category, this is typically the moment to consult the official source or seek advice.

The timeline at a glance

• 1 August 2024 — the regulation enters into force; no obligations yet.
• 2 February 2025 — prohibited AI practices and the AI literacy obligation (Article 4) apply. This applies now.
• 2 August 2025 — rules for general-purpose AI models and the governance structure apply. This applies now.
• 2 August 2026 — the majority of remaining obligations become applicable, including most rules for high-risk systems.
• August 2027 — longer transition periods end, including for high-risk AI in regulated products.

What is the best thing to do now?

1. Take stock of your AI use. Which tools, by whom, for what? Without this overview you cannot properly assess any phase.
2. Arrange the literacy — that is the obligation that already applies. Make sure everyone working with AI understands how it works, where it goes wrong and which rules apply. What AI structurally cannot do is summarised here — a good litmus test for the knowledge level in your team. Want a quick sense of where you or your colleagues stand? Take the free quiz.
3. Look ahead to 2026. If you use AI in sensitive processes (HR, education, access to services), start finding out now whether the high-risk rules will affect you.
4. Record what you do. A simple overview of your AI use, your agreements and your training efforts will be worth gold later — for supervision, for clients and for yourself.