AI Act timeline: key dates and obligations by type of actor

Where does the AI Act timetable stand as of 13 October 2026?

As of 13 October 2026, the AI Act already applies in large part. Only the deadlines for high-risk systems have been postponed. Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in stages [5][9]. Its Article 113 sets a general date of application of 2 August 2026, with exceptions: earlier for some topics and later for the heaviest obligations [18].

What already applies

• Since 2 February 2025: the ban on AI practices posing unacceptable risk [5] and the AI literacy obligations [28].
• Since 2 August 2025: the obligations relating to general-purpose AI models [13].
• Since 2 August 2026: the transparency obligations of Article 50, which cover interactive systems and content generated or manipulated by AI [15][23]. A transition period is provided for certain cases [11].

What has been postponed

• The obligations for high-risk systems in Annex III (recruitment, scoring, education, critical infrastructure) will apply from 2 December 2027 [20][24].
• Those for systems in Annex I (regulated products) will follow in August 2028 [22].

Which version of the timetable to use

The original timetable provided for phased implementation over 36 months, between August 2024 and August 2027 [14]. The European Commission thus presents a full rollout by 2 August 2027 [1]. Since then, Regulation (EU) 2026/1744, known as the "Digital Omnibus", in force as of 27 July 2026, has postponed the deadlines for high-risk systems [14]. It was published in the Official Journal on 24 July 2026 [24].

Where a source still places high-risk obligations at 2 August 2026, it is therefore outdated on that point. The version resulting from the omnibus, the most recent, prevails. According to [22], the rest follows the original timetable, and a large part already applies.

The sources consulted on the omnibus are secondary analyses. Before any decision, the dates must be checked against the text published in the Official Journal of the European Union.

What are the key dates, milestone by milestone?

Regulation (EU) 2024/1689 applies in stages, from 1 August 2024 to August 2028 depending on the family of obligations [5][22]. The table follows the timetable as amended by the "Digital Omnibus" Regulation (EU) 2026/1744.

Three clarifications

• General-purpose models already on the market. Those placed on the market before 2 August 2025 have until 2 August 2027 to comply [3]. This information comes from a specialised monitoring website, not from an official text of the file.
• Annex I. The file gives "August 2028" without specifying the day [22]. No exact date is therefore put forward here.
• A discrepancy between sources. The European Commission page, dated 1 August 2024, provides for full rollout by 2 August 2027 [1]. The sources reporting the omnibus postpone Annex III to 2 December 2027 and Annex I to August 2028 [22][24]. We retain the latter, as more recent: the omnibus was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 [24].

For Article 50, one source mentions a transition after August 2026 without detailing it in the available extract [11]. Before finalising a compliance plan, this point must therefore be verified, like the omnibus dates, in the text published in the Official Journal of the European Union. The final assessment rests with the company and its advisers.

What did the Digital Omnibus change, and which date should be retained for high risk?

For high-risk systems in Annex III, the date to retain is 2 December 2027, not 2 August 2026. This postponement comes from Regulation (EU) 2026/1744 of 8 July 2026, known as the "Digital Omnibus IA", published in the Official Journal on 24 July 2026 and in force since 27 July 2026 [24][14].

What the Digital Omnibus modifies

The text postpones only one family of obligations, those for high-risk systems [22]:

• Annex III (recruitment, scoring, education, critical infrastructure...): application from 2 December 2027 [22][20].
• Annex I (systems integrated into regulated products): application in August 2028 [22].
• Everything else: the original timetable continues to apply [22]. The Article 50 transparency obligations, for example, have applied since 2 August 2026 [23].

Regulation (EU) 2024/1689 originally provided for phased implementation over 36 months, between August 2024 and August 2027 [14]. The Digital Omnibus has since postponed part of these deadlines [14].

Why the sources contradict each other

Much online content is dated. Some predates the omnibus, others do not take it into account, and they still indicate 2 August 2026 for high risk, such as [5]. Others, more recent, have been updated [24]. One article refers to the digital omnibus "adopted in trilogue on 7 May 2026" [10]. This is a political agreement, a stage prior to formal adoption and publication of the text.

In case of divergence, the amended, most recent version must be retained: that of Regulation (EU) 2026/1744 [24].

Verify before deciding

The references above rely on analysis websites. They agree on Regulation 2026/1744 and its dates [24][14][22][20], but do not replace the official text. Before any decision on timing, consult the Regulation published in the Official Journal of the European Union of 24 July 2026. The assessment of compliance rests with the company and its advisers.

Provider or deployer: what is the difference under the AI Act?

The provider designs an AI system, or has it designed, and places it on the market under its own name. The deployer uses it under its own authority in a professional context. The role therefore depends on the organisation's position relative to the AI system, not on its size.

The text of Article 3(4) refers to "a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity" [29]. The central criterion is therefore use under one's own authority, in a professional context [29]. A private individual who uses a tool for private purposes is not a deployer [29].

What this changes for a user company

A company that uses an AI system designed by a third party is a deployer [34]. As soon as it uses it in a professional context, it falls under this role, including for a general-purpose conversational assistant [31]. According to a practitioners' guide, this is "almost always" the case for user companies [18].

One actor can hold both roles

The role is determined tool by tool. The same organisation may be a deployer for the conversational assistant it subscribed to and a provider for the candidate-screening tool it had developed in-house [33].

The definitions above are reported by practitioners' guides [18][29][31][33][34], which are not the official text. Their reference source is Article 3 of Regulation (EU) 2024/1689, to be consulted directly. The qualification of each case rests with the company and its advisers.

What obligations apply to a provider?

Providers bear the heaviest obligations under the AI Act, particularly for high-risk systems. A provider designs an AI system and places it on the market [18], or has it developed in order to place it on the market under its own name [34].

For high-risk systems

For Annex III uses, a secondary source summarises the requirements in six points: risk management, data quality, technical documentation, transparency, human oversight and cybersecurity [19]. Another secondary source adds the compliance steps:

• a conformity assessment, either by self-assessment or through a notified body;
• the CE marking;
• registration in the European database;
• a quality management system [14].

Technical documentation must exist before any placing on the market [8].

These obligations do not yet apply. The Digital Omnibus, Regulation (EU) 2026/1744, postponed those for Annex III systems to 2 December 2027 [24]. Annex I systems (regulated products) are deferred to August 2028 [22].

For systems that interact with people

Article 50 covers a broader case than high risk. Providers of systems intended to interact directly with natural persons must inform them that they are dealing with an AI, unless this is clear from the context [35]. According to a secondary source, these transparency obligations have applied since 2 August 2026 [23].

This article contains other paragraphs, in particular on generated or manipulated content. Any transition deadlines for them are not confirmed by the file consulted here, and this section therefore does not settle them.

A note of caution

The lists of requirements above come from specialised websites [8][14][19], not from the official text. They provide a reading framework but do not replace Regulation (EU) 2024/1689, which must be consulted for the detail of each requirement. Determining whether a company is a provider, and for which systems, rests with its own assessment and that of its advisers. The same organisation may moreover be a deployer for a purchased tool and a provider for a tool it had developed [33].

What obligations apply to a deployer, and from when?

A deployer is the entity that uses an AI system under its own authority in a professional context. Its obligations are lighter than those of the provider, but nonetheless real [32]. As soon as a company uses an AI system in a professional context, it is a deployer within the meaning of the Regulation [31].

What the sources allow us to identify:

• AI literacy and team training. The teams that run these tools must have received sufficient training [32]. This AI literacy obligation has applied since 2 February 2025 [11][28].
• Information to affected persons. Deployers using systems that produce deepfakes must inform people that the content has been generated or artificially manipulated [35]. For chatbots, [32] lists informing people among the deployer's obligations, whereas [35] places the information about interacting with an AI on the provider's side. Both roles should therefore be checked in the text of Article 50, applicable since 2 August 2026 [11][15].
• Human oversight. Human oversight measures are among the deployer's obligations [14].
• Provider documentation. The deployer must request from its providers the documentation relating to the system [8].

For Annex III systems (recruitment, scoring, education, critical infrastructure), high-risk deployer obligations apply from 2 December 2027 [24][20]. This date results from Regulation (EU) 2026/1744, known as the "Digital Omnibus IA", published in the Official Journal on 24 July 2026 and in force since 27 July 2026 [24]. It replaces the original deadline of 2 August 2026.

Cumulative roles. The deployer's obligations add to those of the provider and do not replace them [20]. The fact that the provider complies with its own does not therefore exempt the user company from its own.

Limits of this section. The file of sources does not detail all the obligations of Article 26, which governs deployers of high-risk systems, so they are not listed here. The cited sources are moreover secondary syntheses, not the text of the Regulation. Before any decision, refer to the text published on EUR-Lex. The assessment of compliance rests with the company and its advisers.

How should a company using an AI tool such as Oupi position its obligations?

A company that uses Oupi, an AI tool, in its activity is a deployer within the meaning of the AI Act: it is enough to use a system designed by a third party in a professional capacity [31][34]. The Regulation defines the deployer as the one who uses an AI system under its own authority, outside a non-professional personal activity (Article 3, point 4) [29]. Four steps then help position its obligations.

1. Map the systems used. This means listing all AI systems in service, including those in project [4]. Each system must be analysed to determine the rules that apply to it [17].
2. Qualify the role for each system. The provider develops or has developed a system and places it on the market under its own name (Article 3, point 3) [34]. Roles can be cumulative: the same organisation may be a deployer of a subscribed conversational assistant and a provider of a candidate-screening tool developed in-house [33].
3. Assess the risk level. The Regulation distinguishes four risk levels [9], which must be applied to existing systems as well as to projects [4].
4. Attach each obligation to its date. The timetable serves to prioritise by deadline [17]. Articles 4 and 5 have applied since February 2025 and Article 50 since August 2026 [11]. For Annex III uses, the date retained is 2 December 2027, under Regulation (EU) 2026/1744, in force since 27 July 2026 [24]. This date comes from secondary sources: it must be verified in the official text.

This framework helps with organisation, but does not replace a legal analysis. The assessment of compliance remains the responsibility of the company and its advisers. Official texts and European Commission resources are the reference, in particular its implementation timetable [1] and the presentation of the Regulation by the Ministry of the Economy [2].

What about sanctions, and the limits of this overview?

This overview does not allow sanctions to be quantified, and its most recent dates rely on secondary sources to be checked against the Official Journal of the EU. Several sources in the file point to the existence of sanctions, in their title or content [4][6][20]. The available extracts detail neither their regime nor their amounts, so this article gives no figures. The text of Regulation (EU) 2024/1689 remains the reference on this point.

What the sources of this article are worth

Only two sources in the file are institutional: the European Commission's AI Act helpdesk [1] and the entreprises.gouv.fr website [2]. They confirm the principle of phased application, with full rollout planned by 2 August 2027 [1], and the milestones of February 2025, August 2025, August 2026 and August 2027 [2]. Their extracts do not mention the postponements decided since.

These postponements rely on secondary sources, which agree with one another:

• Regulation (EU) 2026/1744, known as the "Digital Omnibus IA", dated 8 July 2026, published in the Official Journal on 24 July 2026, entered into force on 27 July 2026 [24][14].
• The obligations for high-risk systems in Annex III are postponed to 2 December 2027 [24][22].
• Those for Annex I (regulated products) move to August 2028 [22].

Where these dates diverge from those in extracts [1] and [2], we have retained the most recent version, that of the omnibus. None of these secondary sources has the value of an official text. Before any decision, the dates must be verified in the text published in the Official Journal of the EU.

A snapshot dated 13 October 2026

This article reflects the state of the information available as of 13 October 2026. A new amending act, guidelines or implementing texts may change the timetable after that date.

It explains the text but does not replace a legal analysis. Qualifying an AI system, determining whether the company acts as a provider or a deployer, and assessing its compliance are matters for the company and its advisers.