Transition Periods & Timeline of the EU AI Act

Overview

The EU AI Act is the world's first comprehensive regulation for Artificial Intelligence. Unlike the GDPR, however, it does not enter full application all at once but follows a staggered timeline with clearly defined transition periods.

For companies, this means: The regulation is already taking effect -- even though individual obligations will not become fully applicable until 2025, 2026 or 2027. Anyone who develops, integrates or deploys AI systems should know the timeline precisely to minimise risks and build compliance in a structured manner.

This article provides a complete overview of:

• Entry into force
• Application dates for individual chapters
• Deadlines for GPAI models
• Deadlines for high-risk systems
• Action steps for companies

Entry into Force vs. Applicability -- The Difference

First, it is important to clearly distinguish two terms:

The EU AI Act entered into force in August 2024. Most substantive obligations, however, apply only progressively.

Complete Timeline of the EU AI Act

Overview of Key Milestones

Phase 1 -- February 2025: Prohibited AI Practices

From February 2025, the prohibitions under Art. 5 EU AI Act are binding.

These include, among others:

• Social scoring by public authorities
• Manipulative AI systems
• Exploitation of vulnerable persons
• Real-time remote biometric identification in public spaces (with narrow exceptions)
• Emotion recognition in the workplace or educational institutions

What Companies Should Do by Then:

1. Take stock of all deployed AI systems
2. Review for possible prohibited practices
3. Document the intended purpose
4. Adapt or shut down problematic functions

Phase 2 -- August 2025: GPAI Models & Governance

From August 2025, special rules apply for:

• Providers of General Purpose AI (GPAI)
• Operators of systemic GPAI models

Two Tiers for GPAI:

Important: Companies using an API-based LLM (e.g. via cloud providers) are generally not providers of a GPAI model -- but may become deployers of a high-risk system.

Phase 3 -- August 2026: High-Risk AI Systems (Annex III)

From August 2026, the comprehensive compliance requirements for high-risk systems under Annex III apply.

Affected areas include:

• Biometric identification
• Critical infrastructure
• Education
• Employment
• Credit scoring
• Law enforcement
• Migration
• Justice

Core Provider Obligations

1. Risk management system
2. Data governance
3. Technical documentation
4. Logging
5. Transparency obligations
6. Human oversight
7. Accuracy & robustness
8. Declaration of Conformity + CE marking

Phase 4 -- August 2027: Full Application

From August 2027, the AI Act applies in full, including:

• High-risk AI as a safety component of products
• Full market surveillance
• EU-wide database obligations
• Post-market monitoring

Practical Implementation -- What Companies Should Do NOW

Step 1 -- AI Inventory

• What systems do we use?
• In-house development or third-party provider?
• In which business processes?

Step 2 -- Initial Risk Classification

• Prohibited practices?
• High-risk under Annex III?
• GPAI relevance?

Step 3 -- Gap Analysis

• Is technical documentation available?
• Is logging implemented?
• Is human oversight defined?
• Is training data documented?

Step 4 -- Governance Structure

• Has a responsible person been appointed?
• Is an AI compliance process defined?
• Is the data protection / AI governance interface clarified?

Timeline as a Decision Basis

Many companies underestimate the organisational effort:

The regulatory clock is already ticking.

Connection to the GDPR

The AI Act does not replace the GDPR.

Both apply in parallel.

Typical interfaces:

• Data Protection Impact Assessment (DPIA)
• Transparency obligations
• Purpose limitation
• Data minimisation
• Data subject rights

Companies therefore need integrated governance structures.

Next Steps

1. Conduct a structured AI inventory.
2. Classify your systems according to AI Act risk classes.
3. Identify regulatory gaps.
4. Develop an internal AI governance roadmap.
5. Plan budget and resources for 2025--2027.