The EU AI Act Timeline: Two Deadlines Most Organisations Conflate
The AI Act's 2026 and 2027 dates are not the same obligation. The verified timeline, row by row, and why the distinction changes what you have to do and when.
The distinction that matters
Most organisations asking about the EU AI Act are really asking two different questions and treating them as one. They ask “when does the AI Act apply to us?” and expect a single answer. There are at least four, and they attach to different obligations, different actors and different system categories.
The two that get conflated most often are the transparency duties that bite in 2026 and the stand-alone high-risk obligations that bite in 2027. They are not the same rule arriving on two possible dates. They are two different bodies of obligation, and a firm that treats the 2026 date as “the AI Act deadline” will be unprepared for the one that actually applies to it.
The verified timeline
Four rows matter for planning. Everything else is either transitional and narrow, or not yet settled.
| Date | What applies |
|---|---|
| 2 August 2026 | General application of the Act’s in-force provisions. The Article 50 transparency duties become enforceable, as do the enforcement powers of the AI Office and national authorities. Other Article 50 duties have no extension. |
| 2 December 2026 | Transitional deadline for providers of generative AI systems to meet the Article 50(2) machine-readable marking duty — and it is narrower than it sounds. It applies to generative systems already placed on the market before 2 August 2026. A system placed on the market on or after 2 August 2026 must comply from the moment it is placed on the market: there is no grace period for it. The same date brings new Article 5 prohibitions on non-consensual intimate imagery and on CSAM generation. |
| 2 December 2027 | The stand-alone Annex III high-risk obligations apply — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and the administration of justice. |
| 2 August 2028 | High-risk systems embedded in regulated products (Annex I — medical devices, machinery and similar) come into scope. |
Why 2026 and 2027 are not interchangeable
The 2026 dates are mostly about transparency and marking: telling people when they are interacting with an AI system or looking at synthetic content, and giving synthetic media a machine-readable marker. Those duties attach to generative systems and to the deployers and providers that put them in front of the public.
The 2027 date is about an entirely different control regime — the full high-risk package of risk management, technical documentation, human oversight, logging and conformity assessment for stand-alone Annex III systems. A firm that deploys AI in recruitment, credit scoring, education or access to essential services is a high-risk deployer. A firm shipping a generative model with no such use case very often is not.
Nothing about the 2026 transparency duty discharges the 2027 high-risk obligations. Clearing the first does not buy time on the second, and preparing only for “the Act” without naming which regime applies to which system is the commonest error we see. The correct first move is a classification: place each of your systems on the Act’s risk tiers — prohibited, high-risk, limited, minimal — and read the timeline that attaches to that tier, not to your anxiety about the Act as a whole.
One consequence follows for Swiss firms in particular. A Swiss organisation whose AI output is used in the Union is a provider or deployer under the Act, exactly as an EU firm would be. “We are Swiss, so the Act does not apply” is the most expensive miscalculation in this market, and the 2026 transparency duties are the point at which it stops being theoretical.
The amending instrument
The dates above reflect the amending instrument, Regulation (EU) 2026/1744 — the AI Omnibus. It was agreed in political trilogue on 7 May 2026, approved by the European Parliament on 16 June 2026, given final Council approval on 29 June 2026, published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026. It postpones the high-risk application dates and adds the new Article 5 prohibitions, while preserving the Act’s core risk-based structure. It does not extend the 2026 transparency duties for systems placed on the market on or after 2 August 2026.
What we watch, and what we do not claim
We track the Act against primary sources, and we say plainly where a date rests on a single source: we do not publish a row we cannot corroborate. Two items are deliberately omitted from the table above. The February 2027 “transparency code” watermark-detection date rests on a single source and is not verified. Swiss supervisory and reporting dates — the ISG and NCSC reporting regime, FINMA expectations — are obligations we name but do not date here, pending verification against the official Swiss texts.
If you want to know which of these rows actually binds your systems, that is a classification question, not a reading question. It is what our obligation diagnostic is for.
Last verified: 13 October 2026. Sources: European Commission AI Act service desk timeline; European Commission digital-strategy publications; European Parliament Legislative Train schedule.