EU AI Act Implementation Tracker
A dated reference for EU AI Act implementation status, key deadlines and obligations by risk tier — including the two product regulations that usually bind a physical-AI product first. We are currently 12 months 3 weeks to the 2 Dec 2027 deadline.
Provided for information only — this is not legal advice. Whether a system is high-risk, and under which annex, is a legal determination for qualified counsel; conformity assessment is carried out by or for the provider with an authorised body. Hyperion is not a law firm, a notified body or a certification body.
Dates checked by the founder on 2026-08-06 against the European Commission. On 2026-10-10 an automated re-read of the Official Journal texts on EUR-Lex found the dates unchanged. That second check was run by software, not by a person. High-risk dates as amended by Regulation (EU) 2026/1744.
Implementation Timeline
Key dates from entry into force through full application
AI Act Entered into Force
The EU AI Act was published in the Official Journal and entered into force.
Prohibited AI Practices Apply
Chapter I (General Provisions) and Chapter II (Prohibited AI Practices) apply from this date. AI systems that violate fundamental rights — including social scoring, subliminal manipulation, and real-time remote biometric surveillance — are banned. AI-literacy duties apply from the same date.
GPAI Rules + Governance Apply
General Purpose AI (GPAI) model obligations and the EU AI Office governance structure apply from this date. Providers of GPAI models (including frontier models) are subject to transparency, copyright, and systemic-risk requirements.
General Application + Transparency Obligations (Article 50)
The AI Act's general date of application, and the date the Article 50 transparency duties apply from: people must be told when they interact with an AI system, and AI-generated or manipulated content (deepfakes, synthetic media) must be labelled. This is NOT the high-risk deadline — Regulation (EU) 2026/1744 moved those to 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
Article 50(2) Transition Closes + Omnibus Prohibitions Apply
The narrow Article 50(2) transition window for AI systems already placed on the market closes, so the transparency duties apply to the installed base and not only to new placements. The two prohibitions added by Regulation (EU) 2026/1744 also apply from this date: AI systems that generate or manipulate non-consensual intimate imagery of an identifiable person, and AI systems that generate or manipulate child sexual abuse material (Article 5(1), points (ba) and (bb), within the limits of Article 5(1a) and (1b)).
Machinery Regulation (EU) 2023/1230 Applies
Replaces the Machinery Directive 2006/42/EC and becomes directly applicable — no national transposition. Annex I Part A lists safety components, and systems embedded in machinery, that have fully or partially self-evolving behaviour using machine learning approaches and ensure safety functions. For those, Article 25(2) requires a conformity assessment procedure involving a notified body rather than internal production control; for machinery with an embedded system of that kind, this applies in respect only of that system. AI that performs a safety function without self-evolving behaviour is not listed there on that ground. Whether a given robot cell, AGV or charging system falls in Part A depends on the product and its safety functions. Either way this Regulation decides whether the machine may be placed on the EU market, and it applies well over a year BEFORE the AI Act's Annex I date it is usually discussed alongside.
High-Risk AI Systems (Annex III) Apply
The core compliance date for stand-alone high-risk AI in Annex III sectors: healthcare, education, employment, essential services, law enforcement, border control, administration of justice, and democratic processes. Conformity assessment, technical documentation, and human oversight mechanisms are required. Moved here from 2 August 2026 by Regulation (EU) 2026/1744.
Cyber Resilience Act (EU) 2024/2847 — Main Obligations Apply
Applies to products with digital elements made available on the EU market whose intended or reasonably foreseeable use includes a data connection to a device or network (Article 2(1)). Article 2 excludes products covered by the medical device regulations (EU) 2017/745 and 2017/746 and the vehicle type-approval regulation (EU) 2019/2144, products certified under the aviation regulation (EU) 2018/1139, marine equipment under Directive 2014/90/EU, identical spare parts, and products made exclusively for national security or defence. Most other connected physical-AI products are in scope. Requires security by design, a documented vulnerability-handling process for the support period, an SBOM, and CE marking that covers the software. The reporting duty for actively exploited vulnerabilities and severe incidents started earlier, on 11 September 2026. Relevant here because an OTA-updatable machine inherits CRA obligations for its whole supported life, not just at launch.
High-Risk AI in Annex I Products Apply
The application date for AI systems that are high-risk under Article 6(1): a safety component of a product covered by the Annex I legislation, or itself such a product, where that product must undergo third-party conformity assessment under that legislation. Both conditions must be met. For Section A legislation (for example medical devices, toys, lifts and radio equipment) the AI Act's high-risk requirements apply directly. For Section B legislation (civil aviation, vehicles, rail, marine equipment and, since Regulation (EU) 2026/1744, machinery) only a few AI Act provisions apply (Article 2(2)) and the requirements come through the sector's own rules, which for machinery are still to be set by delegated act. Extended to this date by Regulation (EU) 2026/1744.
Obligations by Risk Tier
The EU AI Act uses a risk-based approach. Your obligations depend entirely on how your AI system is classified.
AI practices that pose unacceptable risks to fundamental rights
Key Obligations
- Real-time remote biometric surveillance in public spaces (limited exceptions for law enforcement)
- Social scoring systems by public or private entities
- Subliminal manipulation techniques that distort behavior
- Exploitation of vulnerabilities of specific groups
- AI-based predictive policing (individual crime prediction)
- Emotion recognition in workplaces and education (with exceptions)
- Biometric categorisation inferring race, political opinions, religion
AI systems in critical sectors requiring mandatory conformity assessment
Key Obligations
- Conformity assessment before market placement
- Technical documentation (Annex IV format)
- Automatic event logging and audit trails
- Transparency and provision of information to deployers
- Human oversight measures — operators must be able to monitor, intervene, or stop the system
- Accuracy, robustness, and cybersecurity requirements
- Quality management system across the AI lifecycle
- Registration in EU database (Article 71)
- Post-market monitoring plan
AI systems with specific transparency obligations
Key Obligations
- Disclose to users that they are interacting with an AI system (chatbots, virtual assistants)
- Label AI-generated content (deepfakes, synthetic media)
- Inform users when emotion recognition or biometric categorization is used
- Providers of GPAI models must publish summaries of training data
AI systems posing little or no risk — the vast majority of AI applications
Key Obligations
- No mandatory obligations under the AI Act
- Encouraged (voluntary) to adopt codes of conduct
- Existing product safety, consumer protection, and GDPR rules still apply
GPAI Model Obligations (Post-Aug 2025)
General Purpose AI models — including large language models — have specific obligations under Chapter V of the AI Act, in force since 2 August 2025.
Technical Documentation
Maintain up-to-date technical documentation covering training methodology, data sources, compute used, and known limitations.
Copyright Compliance
Implement and maintain a copyright policy. Publish summaries of training data used for text and data mining.
Model Card & Transparency
Publish model cards describing capabilities, limitations, intended and foreseeable misuse, and evaluation results.
Systemic Risk Assessment (Frontier Models)
For frontier models (≥10²⁵ FLOPs training compute), conduct adversarial testing, incident reporting, and cybersecurity measures.
Is My AI System High-Risk?
The four EU AI Act risk levels and the questions that place a system in one of them. Automated classification is switched off on this site.
See the risk levels and self-checkTurn the applicable duties into product requirements
Once counsel has confirmed which duties apply to your systems, a Product Decision Review turns them into product requirements, an evidence plan and a dated 90-day sequence your engineering organisation can actually execute.
Product Decision ReviewDon't Wait Until December 2027
The conformity assessment process for high-risk AI systems takes 3–12 months depending on complexity. Organizations that start now have the highest chance of meeting the deadline without disrupting operations.