EU AI Act: Dates, Duties & Enforcement FAQs
The EU AI Act is the world’s first comprehensive law regulating artificial intelligence, and its obligations apply in phases starting February 2025. This article answers the most common questions about the Act’s timeline, who must comply, what they must do, and how enforcement works.
Background: Why the EU AI Act Exists
The European Union introduced the AI Act to address the risks that AI systems can pose to health, safety, and fundamental rights. It follows a risk-based approach: the higher the risk of harm, the stricter the rules. The Act also aims to make the EU a global hub for trustworthy AI by setting a clear legal framework that encourages innovation while protecting citizens.
Key milestones in the legislative process:
- April 2021: The European Commission published the first draft proposal.
- December 2023: The European Parliament and Council reached a political agreement.
- March 2024: The European Parliament formally approved the text.
- May 2024: The Council of the EU gave its final approval, and the Act was published in the Official Journal on 12 July 2024.
The Act entered into force on 1 August 2024, but most obligations start later, giving businesses time to prepare.
Timeline: When Do the Rules Apply?
The EU AI Act has staggered application dates. Here is the schedule:
- 1 August 2024: The Act enters into force (20 days after publication).
- 2 February 2025: Prohibitions on AI practices that pose unacceptable risk apply. This includes social scoring by governments, real-time remote biometric identification in public spaces (with limited exceptions), and manipulative or exploitative AI.
- 2 August 2025: Rules for general-purpose AI models (like large language models) and governance obligations begin. This includes transparency requirements for models that can generate text, images, or audio.
- 2 August 2026: Most of the Act applies, including rules for high-risk AI systems listed in Annex III (e.g., AI used in employment, credit scoring, and critical infrastructure).
- 2 August 2027: Obligations for high-risk AI systems embedded in regulated products (e.g., medical devices, machinery, vehicles) that are already covered by other EU legislation.
It is important to note that the Act applies to any organisation that places AI systems on the EU market or whose AI systems affect people in the EU, regardless of where the company is based.
Who Has Duties Under the Act?
The AI Act defines several roles, and your duties depend on which role you play:
- Providers: Developers of AI systems who place them on the market or put them into service. They bear the most responsibilities, including risk management, data governance, technical documentation, and post-market monitoring.
- Deployers: Users of AI systems in a professional capacity (e.g., a hospital using an AI diagnostic tool). They must use the system according to instructions, ensure human oversight, and monitor for risks.
- Importers and distributors: They must verify that the provider has fulfilled its obligations before making the system available in the EU.
- Authorised representatives: Providers based outside the EU must appoint an in-EU representative to act on their behalf.
Small and medium-sized enterprises (SMEs) and startups have some simplified obligations, but they are not exempt from the core requirements.
What Are the Specific Duties for High-Risk AI?
High-risk AI systems face the most extensive requirements. If your system falls into one of the high-risk categories (e.g., AI used for recruitment, creditworthiness, or law enforcement), you must:
- Establish a risk management system that identifies, evaluates, and mitigates risks throughout the lifecycle.
- Use training, validation, and testing data that is relevant, representative, and free of bias.
- Create and maintain detailed technical documentation that demonstrates compliance.
- Implement automatic logging to ensure traceability of the system’s outputs.
- Provide clear instructions for use, including limitations and expected performance.
- Enable human oversight so that a person can intervene or override the system’s decisions.
- Ensure robustness, accuracy, and cybersecurity appropriate to the context.
Before placing a high-risk system on the market, you must conduct a conformity assessment and, if required, register the system in the EU database (for most high-risk systems, this is done by the provider).
How Is the AI Act Enforced?
Enforcement is carried out by national authorities in each EU member state. Each country must designate at least one notifying authority and one market surveillance authority. The European Commission also plays a role, particularly for general-purpose AI models.
Penalties for non-compliance are significant:
- Up to €35 million or 7% of global annual turnover (whichever is higher) for violations of the prohibited practices.
- Up to €15 million or 3% of global annual turnover for most other violations (e.g., failing to meet high-risk obligations).
- Up to €7.5 million or 1.5% of global annual turnover for supplying incorrect information to authorities.
For SMEs and startups, the maximum fines are lower (the same percentages, but capped at lower absolute amounts). The Act also encourages the creation of regulatory sandboxes, which are controlled environments where businesses can test innovative AI before full compliance is required.
Common Misconceptions and Practical Tips
A frequent misconception is that the AI Act only affects large tech companies. In reality, it applies to any business that uses AI in the EU, including small firms that deploy AI for HR or customer service. Another myth is that the Act bans all AI; it only bans a narrow set of practices deemed unacceptable.
For practical steps, start by mapping your AI systems and determining their risk level. If you are a provider, begin preparing your technical documentation early. If you are a deployer, review your existing contracts with AI vendors to ensure they are taking responsibility for compliance. Keep an eye on the European Commission’s guidance documents, which are being published to clarify ambiguous provisions.
Frequently Asked Questions
When does the EU AI Act fully apply?
Most of the Act applies from 2 August 2026, but prohibitions on unacceptable risk started on 2 February 2025, and rules for general-purpose AI began on 2 August 2025. High-risk AI in regulated products has until 2 August 2027.
Who does the EU AI Act apply to?
It applies to any organisation that develops, deploys, imports, or distributes AI systems that are placed on the EU market or that affect people in the EU, regardless of where the organisation is based. If you are outside the EU but your AI system is used in the EU, you must appoint an authorised representative.
What are the penalties for non-compliance?
Fines range from €7.5 million to €35 million, or up to 7% of global annual turnover, depending on the violation. For SMEs and startups, the absolute caps are lower, but the percentage-based fines still apply.
Does the AI Act apply to open-source AI models?
Yes, but with some exceptions. Open-source models are generally exempt from many provider obligations unless they are classified as high-risk or as general-purpose AI models with systemic risk. However, the Act still applies to the deployers of open-source models.
How do I know if my AI system is high-risk?
Check Annex III of the Act, which lists eight specific areas (e.g., biometric identification, education, employment, law enforcement). There is also a catch-all for AI used as a safety component of regulated products. If you are unsure, you can consult the European Commission’s guidelines or seek legal advice.
What should I do right now to prepare?
Inventory your AI systems, classify them by risk, and start a compliance gap analysis. If you are a provider, begin drafting technical documentation and risk management procedures. If you are a deployer, review your procurement processes and ensure your vendors are compliant.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.