Skip to content

Get the monthly AI briefing: what matters for your business, in plain English.Subscribe

Menu

ExplainerAI RegulationBuilding Capability

EU AI Act implementation: key dates and milestones

Every EU AI Act milestone, updated for the July 2026 Digital Omnibus: what already applies, what starts next and who each date affects.

Phil Evans

Co-Founder & CEO

The EU AI Act is coming into force in stages. Some obligations already apply. Others start in December 2026, December 2027 and beyond.

This timeline sets out what has changed, what is coming and who each milestone is likely to affect, including UK businesses whose use of AI reaches EU customers, EU-based staff or EU markets.

The dates below reflect the Act as amended by the Digital Omnibus on AI, which came into force on 27 July 2026 and moved several deadlines. Many guides written before then still show the old dates.

A UK business is in scope when it supplies AI into the EU, operates in the EU, or produces AI output intended for use there. If you are not sure which applies to you, our beginner’s guide to the EU AI Act for UK businesses explains how the Act reaches across the Channel.

Already in force

  • 1 August 2024. What changes: The Act enters into force, following publication in the Official Journal on 12 July 2024. No obligations apply yet. Who it affects: Staged introduction.
  • 2 February 2025. What changes: Banned practices take effect, such as social scoring and inferring the emotions of people at work. The Commission publishes non-binding guidelines on banned practices (4 February) and on what counts as an AI system (6 February). Who it affects: Every provider and deployer in scope.
  • 2 February 2025. What changes: The AI literacy duty applies. Businesses must take measures to build the AI literacy of their staff and of others using AI on their behalf. Apart from the bans, it is the only duty that applies to every business in scope, whatever AI it uses. Who it affects: Every provider and deployer in scope, including UK firms whose AI is used in the EU.
  • 7 May 2025. What changes: The Commission publishes questions and answers on AI literacy. External certification is not required, but businesses should record and document the measures they take. Who it affects: Every provider and deployer in scope.
  • 10 July 2025. What changes: The Commission publishes the voluntary General-Purpose AI Code of Practice, covering transparency, copyright and, for the most capable models, safety and security. Who it affects: Developers of general-purpose AI models.
  • 2 August 2025. What changes: Obligations for general-purpose AI models apply. The governance framework and national penalty regimes come into effect. Who it affects: Model developers directly; everyone indirectly, as penalties are now live.
  • 20 July 2026. What changes: The Commission adopts guidelines on the transparency obligations in Article 50. Who it affects: Anyone offering chatbots or publishing AI-generated content to EU audiences.
  • 27 July 2026. What changes: The Digital Omnibus on AI (Regulation (EU) 2026/1744) comes into force. It delays the high-risk rules, adds new bans and revises the AI literacy duty so that firms must take measures to support literacy rather than guarantee a level. Who it affects: Everyone in scope: check any guidance written before this date.
  • 2 August 2026. What changes: Most of the Act applies, including the transparency rules. People must be told when they are dealing with an AI system, deep fakes must be disclosed, and AI-generated text published on matters of public interest must be disclosed unless it has been through human review and someone holds editorial responsibility for it. The Commission’s AI Office and national authorities begin enforcement, and public complaints and whistleblowing channels open. Who it affects: Businesses whose AI interacts with, or publishes content to, people in the EU.
  • 3 August 2026. What changes: According to the Commission, national market surveillance authorities can begin supervising and enforcing the AI literacy duty from this date. Penalties are set by each Member State. Who it affects: Every provider and deployer in scope.

Why AI literacy deserves particular attention

AI literacy is easy to overlook. It took effect in February 2025, while attention was on banned practices and the high-risk rules, and it applies whatever the risk level of the AI in use, so a business using nothing more than a chatbot or a writing assistant is still covered. It reaches UK businesses on the same terms as EU ones when they fall within the Act’s scope.

Since the July 2026 amendment, the duty is to take measures to support AI literacy rather than to guarantee a particular level, and no certificate is required. The Act sets no specific fine for this duty; penalties are left to each Member State. In practice, though, a supervisor, client or insurer asking what a business has done will expect to see something: who received guidance or training, on what, and when. Only 27% of people in the UK say they have had any AI education or training, which suggests many businesses have ground to make up.

Coming next

  • 2 December 2026. What changes: New bans apply to AI systems designed to create non-consensual intimate imagery or child sexual abuse material. Generative AI systems already on the market before 2 August 2026 must mark their output in a machine-readable format. Who it affects: Everyone (bans); providers of generative AI tools (marking).
  • 2 August 2027. What changes: General-purpose AI models placed on the market before 2 August 2025 must comply. Each EU Member State must have at least one AI regulatory sandbox operating. Who it affects: Model developers; businesses wanting to test AI under supervision.
  • 2 December 2027. What changes: High-risk rules apply to the uses listed in Annex III, including recruitment and staff management, education, credit scoring, and life and health insurance pricing. Deployers of credit scoring and of life and health insurance pricing must also complete a fundamental rights impact assessment before first use. Who it affects: Providers and deployers of those systems, including UK firms serving EU customers or staff.
  • 2 August 2028. What changes: High-risk rules apply to AI built into products already covered by EU safety legislation, such as lifts and toys. Who it affects: Manufacturers and suppliers of regulated products.
  • 2 August 2030. What changes: High-risk systems used by public authorities must comply, including those already in service. Who it affects: Suppliers of AI to the public sector.

One detail matters for businesses already using high-risk AI. A high-risk system already in use before its rules apply is only brought within the Act if its design is significantly changed afterwards. Systems used by public authorities are the exception: they must comply by 2 August 2030 regardless. This is not a reason to rush systems into service, but it does mean that a major redesign should be treated as a compliance decision.

Developments to watch

  • High-risk classification guidance. The Commission published draft guidelines on how to tell whether an AI system is high-risk on 19 May 2026. At the time of writing the final version has not been published.
  • Northern Ireland. The Commission considers that parts of the Act apply there under the Windsor Framework. The UK government’s position has been that its substantive provisions do not currently apply without UK agreement through the Joint Committee. No decision has been published at the time of writing.
  • UK legislation. The UK has no equivalent AI statute, and one is not expected before late 2027 at the earliest. UK GDPR, including the safeguards for significant automated decisions in Articles 22A to 22D that apply from 5 February 2026, continues to apply in parallel.

Ten steps to get your business ready

No checklist can make every business compliant, because what the Act requires depends on your role and on the risk level of each use of AI. These ten steps will, however, put most UK businesses on solid ground and show that reasonable steps have been taken.

  1. Find your AI. List the AI tools in use across the business, including AI features that suppliers have added to software you already own.
  2. Follow the output. For each one, note whether its output reaches EU customers, people located in the EU or EU markets. That decides whether the Act is likely to apply.
  3. Know your role. Work out whether you are a provider, because you build or brand the AI, or a deployer, because you use it. Putting your name on a high-risk system, or substantially modifying one, can make you its provider.
  4. Rule out the banned practices. Check that nothing in use falls into a prohibited category, including the two new bans that apply from 2 December 2026.
  5. Put AI literacy in place. Give staff short, role-relevant guidance on what the tools can and cannot do, what must never be entered into them and when human judgement is needed. Keep a dated record of what was provided, to whom and when.
  6. Get transparency right. Make sure EU customers know when they are dealing with an AI system, and label deep fakes. Ask your generative AI suppliers how they will meet the marking deadline of 2 December 2026.
  7. Identify high-risk uses early. Flag any use in recruitment, staff management, credit, or life and health insurance pricing, and start planning for 2 December 2027, including any fundamental rights impact assessment.
  8. Treat major changes as compliance decisions. Before significantly redesigning an existing high-risk system, check whether the change will bring it within the Act.
  9. Ask your suppliers. Find out where your data goes, how your suppliers are meeting their obligations and what your contracts say. Expect EU clients to ask you the same.
  10. Name an owner and set a review date. Give one senior person responsibility for AI governance and diary a regular review. The dates have moved once already, and guidance is still being published.

Where to start

Most businesses find the first two steps the hardest: knowing where AI is already in use, and which of these dates apply. Turma helps UK businesses answer both, and put proportionate governance in place, with support ranging from largely automated assessment for smaller firms to hands-on, integrated support for regulated and larger organisations.

To talk through where your business stands, contact a Turma specialist at turma.io.

Dates checked against the consolidated text of Regulation (EU) 2024/1689 as at 27 July 2026, incorporating Regulation (EU) 2026/1744, and against Commission publications. Reviewed October 2026. Dates and guidance may change and should be re-checked before reliance.

This article provides general information and does not constitute legal advice. How the EU AI Act applies to a particular business depends on its specific facts, and qualified legal advice should be taken where that is uncertain.

References

Legislation

Commission publications

AI literacy

Commentary and analysis

UK and Northern Ireland

ShareLinkedInEmail

Keep learning

AnalysisAI Governance

The evolving role of the AI leader

AI started as an IT project. Now it is a question of strategy, people and accountability. How AI leadership is changing and what the role must cover.

Phil Evans

Co-Founder & CEO

Building Capability

Put it into practice

The AI Jargon Buster

Starter PackAI Adoption

The AI Jargon Buster

Twenty words you will hear in every AI conversation, in plain English. What each one actually means, and a way to picture it

Isaac Ward

AI Practitioner · 14 Oct 2026

Free downloadGetting Started

Stay informed

A short monthly briefing on the AI developments that actually matter for your business. No sales pitches.

Monthly. Unsubscribe in one click. We never share your details.