Article page checkbox is not checked in page info.

AI Act – Implementation timeline

21 October 2026

PDFs:

Languages:

Digital

AI Act – Implementation timeline

Tristan Marcelin, Members' Research Service

At a glanceLast updated: 21 October 2026Reading time: 5 min.

Photograph of colourful and futuristic lines of code on a screen.

Summary

The Artificial Intelligence (AI) Act regulates AI systems according to the risks they pose, and general‑purpose AI (GPAI) models according to their capabilities. Published in July 2024 and amended in 2026, the AI Act already applies in part and will take full effect in 2028.

History and framework

The European Commission published its proposal for an AI regulation in 2021. The proposal suggested a risk‑based approach differentiating between 'unacceptable' risks, 'high‑risk', and 'limited risk'. The Council and the European Parliament made several changes; these included a chapter on general‑purpose AI (GPAI) models, which comprise large language models such as OpenAI's GPTs, Google's Gemini and Mistral's models. The final version of the regulation, the AI Act, was published in the Official Journal of the EU on 12 July 2024.

However, two years later, on 29 May 2026, the Council and the Parliament adopted Regulation (EU) 2026/1744, known as the Digital Omnibus on AI. This amends the AI Act to address implementation challenges, such as missing standards and the establishment of governance at national level.

The graph lists the thirteen chapters and article ranges (Articles one to one hundred and thirteen), colour-coded by theme: general and final provisions (Chapters one, thirteen); rules for artificial intelligence systems – prohibited practices, high-risk systems and transparency (Chapters two to four); general-purpose artificial intelligence models (Chapter five); innovation measures (Chapter six); and governance, database for high-risk artificial intelligence systems, post-market monitoring, information sharing, and market surveillance, code of conducts and guidelines, delegation of power and committee procedure, and penalties (Chapters seven to twelve). A side pyramid illustrates the risk-based approach: prohibited, high-risk, transparency risks, and minimal-to-no risk (not regulated). — Figure 1 – Structure of the Artificial Intelligence Act

Harmonised standards

The AI Act presumes high‑risk AI systems and GPAI models that conform to harmonised standards, published in the Official Journal of the EU, to be in compliance with the corresponding requirements and obligations.

The Commission requested that the European Committee for Standardisation (CEN) and the European Committee for Electrotechnical Standardisation (CENELEC) provide standards related to high‑risk AI systems in May 2023, with an initial deadline of April 2025. This deadline was missed. The request was updated in June 2025, with a deadline extended to August 2025, which was also missed.

The Digital Omnibus on AI explains that the delay in preparing the standards required is one of the reasons that the deadlines related to high‑risk AI systems were postponed. Since then, one harmonised standard related to quality management system for organisations that provide AI systems was published in October 2026. As of that date, the rest are still under development.

Regarding standards for GPAI models, as of October 2026, the Commission has not yet issued a request. The Commission instead points to the GPAI Code of Practice, which it presents as a practical compliance tool comparable to harmonised standards. However, only harmonised standards can provide the added benefit of a presumption of conformity.

Implementation steps

The regulation's general date of application is 2 August 2026. However, several chapters, sections and articles have other dates of application and were changed by the Digital Omnibus on AI. As a result, the AI Act should be fully effective on 2 August 2028, when all rules for high‑risk AI will apply.

Seven milestones: second February 2025 – chapters on general provisions and prohibited artificial intelligence practices apply; second August 2025 – the section on notified authorities and notified bodies (Chapter three, section four), the chapter on general-purpose artificial intelligence models (Chapter five), the chapter on governance (Chapter seven), the chapter on penalties (Chapter twelve, without fines for providers of general-purpose artificial intelligence models, Article one hundred and one), and the article on confidentiality in the post-market monitoring chapter (Article seventy-eight) apply; second August 2026 – the majority of the Artificial Intelligence Act's rules come into force and enforcement starts for applicable rules; second December 2026 – prohibitions added by the Digital Omnibus on artificial intelligence apply, and Article fifty(two) on transparency applies to certain providers of artificial intelligence systems generating content already placed on the market before second August 2026; second August 2027 – Member States should have at least one Artificial Intelligence regulatory sandbox per country operational; second December 2027 – rules for high-risk Artificial Intelligence systems in Annex three apply; second August 2028 – rules for high-risk Artificial Intelligence embedded in regulated products covered by Annex one apply. — Figure 2 – Timeline of AI Act implementation

Classification of high‑risk AI systems

The AI Act defines high‑risk AI systems (HRAI) in two ways:

The product safety route: If the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, and if it has to go through a third‑party conformity assessment under an existing product safety law, then it is considered HRAI (with the exception that certain AI systems used for non‑safety aspects such as performance optimisation are not considered as high‑risk).

Annex I of the AI Act lists the product safety laws concerned. Each law has set up a conformity assessment procedure for the products it regulates. The annex is divided into two sections:
- Laws in section A integrate the AI Act's requirements into their existing conformity assessment procedures.
- AI systems linked to products covered by section B laws are classified as high‑risk but are exempted from most of the AI Act's obligations. Instead, the AI Act amends almost all listed sectoral laws.The amendments require the regulators to take those AI Act HRAI requirements into account when adopting their own AI rules.
The use‑case route: If the AI system corresponds to a usage listed in Annex III, in areas such as biometrics, critical infrastructure, law enforcement and migration, then it is considered to be a HRAI.

AI systems within the listed areas but conforming to strict conditions may however not be considered as HRAI. In addition, a provider who considers that an AI system referred to in Annex III is not high‑risk shall document its assessment before that system is placed on the market or put into service. The provider would still need to comply with the registration obligation and provide its assessment upon request from the enforcer.

Classification

Policy areas: Digital

Committees: Internal Market and Consumer Protection (IMCO), Civil Liberties, Justice and Home Affairs (LIBE)

Statement on the use of AI

Any AI‑generated content in this text has been reviewed by the authors. AI was used to improve the readability of the text, shorten the text and broaden the range of sources available to the authors.

Disclaimer

This document is prepared for, and addressed to, the Members and staff of the European Parliament as background material to assist them in their parliamentary work. The content of the document is the sole responsibility of its author(s) and any opinions expressed herein should not be taken to represent an official position of the Parliament.

Copyright

The reuse of this document is authorised under a Creative Commons Attribution 4.0 International (CC-BY 4.0) licence.

To use or reproduce elements that are not owned by the European Union, permission may need to be sought directly from the respective rightsholders.