AI Act Timeline: What Applies When

The AI Act timeline in brief

The AI Act timeline changed significantly in 2026. The Artificial Intelligence Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. Prohibited practices and the AI literacy obligation have applied since 2 February 2025, and the rules for general-purpose AI models, governance and penalties since 2 August 2025. The general date of application was 2 August 2026.

However, the Digital Omnibus on AI — Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July 2026 — postponed the core high-risk obligations to 2 December 2027 and 2 August 2028, added new prohibitions and replaced the AI literacy obligation with a softer duty.

As of November 2026, companies in Germany therefore face a mixed picture: some obligations already apply and are enforced, transparency duties for generated content apply with a short grace period, and high-risk obligations lie one to two years ahead. In Germany, the AI Market Surveillance and Innovation Promotion Act (KI-Marktüberwachungs- und Innovationsförderungsgesetz, KI-MIG) of 22 July 2026, in force since 29 July 2026, designates the Federal Network Agency as the main market surveillance authority.

Key dates of the AI Act timeline

What has applied since 2025

Prohibited practices and AI literacy

Since 2 February 2025, the practices listed in Article 5 have been prohibited. They include manipulative and exploitative AI, social scoring, untargeted scraping of facial images to build recognition databases, emotion recognition in the workplace and in education (with exceptions for medical and safety reasons), certain biometric categorisation and, subject to narrow exceptions, real-time remote biometric identification in publicly accessible spaces for law enforcement. Breaches can be fined up to EUR 35 million or 7% of worldwide annual turnover (Article 99(3)).

The AI literacy obligation in Article 4 also applied from 2 February 2025. In its original wording, it required providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff. The Digital Omnibus replaced it with an obligation to take measures to support the development of AI literacy, expressly without requiring any specific level for individuals. See our insight on AI literacy under Article 4.

General-purpose AI models

Since 2 August 2025, providers of general-purpose AI (GPAI) models have had to comply with Chapter V: technical documentation, information for downstream providers, a copyright policy and a public summary of training content, with additional duties for models with systemic risk. Models placed on the market before 2 August 2025 must comply by 2 August 2027. The Commission's power to fine GPAI providers under Article 101 has applied since 2 August 2026. See our insight on general-purpose AI provider duties.

What applies from August and December 2026

From 2 August 2026, the AI Act applies generally. This includes the transparency obligations of Article 50: providers must design AI systems that interact with people so that users know they are interacting with AI, providers of generative systems must mark synthetic audio, image, video and text in a machine-readable way, and deployers must disclose deepfakes and certain AI-generated texts published to inform the public. Under the new Article 111(4), providers of generative systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking obligation in Article 50(2).

From 2 December 2026, two new prohibitions inserted by the Digital Omnibus apply: AI systems that generate or manipulate realistic intimate images, videos or audio of an identifiable person without explicit consent, and AI systems that generate child sexual abuse material. See our insight on labelling AI-generated content.

The postponed high-risk obligations

The Digital Omnibus postponed the requirements for high-risk AI systems in Sections 1 to 3 of Chapter III — risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness, and the obligations of providers and deployers. They now apply from 2 December 2027 for stand-alone systems listed in Annex III (for example AI in employment, credit scoring, education and access to essential services) and from 2 August 2028 for AI that is a safety component of, or itself, a product covered by EU harmonisation legislation in Annex I (for example machinery and medical devices).

The recitals explain the delay by the late availability of harmonised standards, common specifications and guidance and the delayed establishment of national authorities.

Legacy systems are treated favourably. High-risk systems placed on the market or put into service before the relevant date of application are covered only if their design changes significantly afterwards. According to the recitals, the grace period applies at the level of type and model: if one unit of a type and model was lawfully placed on the market before the date, further units of that unchanged design may continue to be supplied. High-risk systems intended for use by public authorities must comply by 2 August 2030 in any case. See our insight on high-risk AI systems and conformity assessment.

Other changes made by the Digital Omnibus

Besides shifting dates, Regulation (EU) 2026/1744 made a number of structural changes that affect planning:

• Small mid-caps: support measures and some simplifications previously reserved for SMEs were extended to small mid-cap enterprises (SMCs).
• Bias detection: a new Article 4a allows providers of high-risk systems, exceptionally and subject to safeguards, to process special categories of personal data where strictly necessary to detect and correct bias.
• Machinery: the Machinery Regulation (EU) 2023/1230 was moved from Section A to Section B of Annex I. AI in machinery will therefore be addressed mainly through the sectoral machinery framework rather than directly through the AI Act's high-risk requirements.
• Registration: registration of systems that a provider considers not to be high risk under Article 6(3) was simplified.
• Quality management: the simplified way of complying with the quality management system obligation, previously available only to microenterprises, was extended to all SMEs, including start-ups.
• Real-world testing: Member States may also allow real-world testing of high-risk AI systems related to products under the sectoral legislation in Section B of Annex I.

These changes mean that earlier compliance plans drawn up on the basis of the original text should be revisited. In particular, manufacturers of machinery should re-examine which regime applies to AI-enabled safety functions, and HR and finance functions should note that the Annex III date of 2 December 2027 now governs AI in recruitment, performance management and credit scoring.

Enforcement in Germany

Under § 2 KI-MIG, the Federal Network Agency is the competent market surveillance authority unless otherwise provided. Market surveillance authorities responsible for product legislation listed in Annex I, Section A remain competent for AI in those products, and BaFin supervises AI systems directly connected with regulated financial activities of supervised firms. The KI-MIG also sets up a central complaints office, a coordination and competence centre at the Federal Network Agency, and rules on AI regulatory sandboxes and testing in real-world conditions.

Fines follow Article 99 AI Act: up to EUR 35 million or 7% of turnover for prohibited practices, up to EUR 15 million or 3% for most other obligations including transparency, and up to EUR 7.5 million or 1% for incorrect information to authorities, with lower caps for SMEs.

Planning around the AI Act timeline

A practical compliance programme should follow the AI Act timeline rather than wait for the high-risk dates:

1. Inventory: list all AI systems the company develops, places on the market or uses, and classify the company's role (provider, deployer, importer, distributor).
2. Prohibitions: confirm that no use falls under Article 5, including the new December 2026 prohibitions.
3. Literacy: maintain and document measures supporting AI literacy.
4. Transparency: implement marking and disclosure for chatbots, generative AI and deepfakes.
5. GPAI: if the company fine-tunes or places GPAI models on the market, check whether it becomes a GPAI provider.
6. High risk: identify Annex III and Annex I use cases and plan quality management, documentation and conformity assessment for 2027 and 2028.
7. Governance: align AI compliance with data protection, employment law (including works council rights) and product safety.

In Germany, the use of AI tools to monitor employee behaviour or performance will also usually trigger co-determination rights of the works council under § 87(1) no. 6 of the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG), regardless of the AI Act timeline. Works council agreements on AI are therefore a practical first step for many employers. Such agreements can also document AI literacy measures, transparency towards employees and the rules for human oversight, which will help when the high-risk obligations for employment-related AI apply from December 2027.

The Digital Omnibus has not eliminated obligations but shifted them. Companies that use the extra time to build documentation and governance will be better placed when standards are published and authorities start supervising high-risk systems.

How TRW & Co helps with the AI Act timeline

We help companies map their AI systems to the AI Act timeline, classify roles and risk categories, and build compliance programmes for prohibited practices, AI literacy, transparency, general-purpose AI and high-risk systems. We advise on contracts with AI vendors, works council agreements on AI tools, and proceedings before the Federal Network Agency and other authorities. See our pages on the AI Act and data and digital, or contact us.