EU AI Act timeline: what applies on each date and how to prepare
The EU AI Act timeline already has its first date behind it. Since 2 August 2026, your AI agent has to identify itself as AI to the user, and it’s worth knowing which third-party model it uses and under what conditions.
If you haven’t looked at this yet, it’s the first thing to sort out — now. And it’s also what you need ready for the two dates that come after, in December 2027 and August 2028, so you don’t arrive at them the same way.
- 2 August 2026 (already enforceable): transparency obligations (Article 50).
- 2 December 2027 (what to prepare): standalone high-risk systems (Annex III).
- 2 August 2028 (what to prepare): AI embedded in a regulated product (Annex I).
2 August 2026 on the EU AI Act timeline: your AI agent already has to say it’s AI
What Article 50 already requires
Since 2 August 2026, the EU Artificial Intelligence Act requires you to, where applicable:
- Identify any agent or AI system that interacts with people as such, without the user having to ask.
- Mark or label artificially generated content — image, audio, video — with provenance metadata.
That’s Article 50, and it hasn’t moved a single day in the delay that did affect the other two dates. As good practice — and also in line with Spain’s draft AI Governance Law — it’s also worth documenting which general-purpose AI (GPAI) models you use, from which provider and under what conditions. That said, this isn’t an Article 50 obligation: the GPAI duties in the regulation (Articles 51-55) sit with the providers of those models, not with the companies using them, and they have applied since 2 August 2025.
Why there’s no margin here
The fine isn’t symbolic: up to €15 million or 3% of global turnover, whichever is higher. Unlike the other two dates, this obligation is enforceable today, with no preparation window.
“Identifying as AI” is a design decision about the agent: which turn of the conversation the notice shows up in, whether it lives in the system prompt or in the interface, whether the user can ignore it. That’s why it lands badly when it gets handled as a last-minute formality instead of as part of the conversational architecture.
Checklist for 2 August 2026
Before you read on, check that you already have:
- Your agent or conversational assistant identifies itself as AI on first contact, without the user having to ask.
- AI-generated content (image, audio, video) carries a provenance mark or metadata.
- A channel where a user can report a problematic response.
- Recommended: an inventory of the general-purpose AI (GPAI) models you use and their providers.
Designing that notice as part of the agent’s architecture, rather than as a last-minute legal patch, is exactly the kind of decision we work through with the teams building theirs right now. If that’s where you are, let’s talk.
2 December 2027: your AI decision system still has no documented human oversight
What changed with the delay
The EU Council gave its final green light to moving this date by 16 months:
- Before: 2 August 2026, the same date as Article 50.
- Now: 2 December 2027.
- Applies to: “standalone” high-risk systems (Annex III), meaning the ones that make decisions about people in HR, credit, education, health or access to public services.
The risk of treating it as breathing room
In the conversations we have with teams that have spent months building this kind of system, we see the same pattern: the extra room gets used to breathe, not to get ahead. The system stays in production, keeps growing, and still lacks the four pieces we already documented in AI governance for development teams:
- Negative testing.
- Algorithmic transparency.
- Human oversight.
- Traceability.
The cost depends on the order. Documenting a system while it’s still being designed is cheap: these are architecture decisions you make once. Rebuilding that evidence on top of a system that already serves real users, with scattered logs and models that have changed several times, is a separate project. And it almost always happens in a hurry, exactly when a hurry helps least.
Human oversight is where this shows up first: it means deciding at which exact point in the flow a person steps in before the decision has real effect. Adding it after launch means touching the whole flow. It’s the same principle behind documenting decisions so they’re auditable, not just functional: the earlier it’s built in, the less it hurts.
Checklist for 2 December 2027
Before that date, check that you have:
- Every system classified according to whether it operates in an Annex III area (HR, credit, education, health, decisions with impact).
- A record of negative tests per system, not just proof that it works.
- A human oversight point defined before the decision has real effect.
- Traceability of which model, which version and which output was used in each case.
2 August 2028: it isn’t clear who answers for the AI embedded in your regulated product
What changed with the delay for Annex I
- Before: 2 August 2027.
- Now: 2 August 2028.
- Applies to: AI embedded in a regulated product (Annex I), meaning medical devices, industrial machinery, radio equipment.
Unlike the other two dates, here the sector-specific regulation that already certifies that product also comes into play.
Why the ambiguity gets expensive
- The problem is how responsibility is split. When a manufacturer integrates a third party’s model, or an integrator builds on someone else’s hardware, it’s almost never settled up front who takes on the “provider” role for AI Act purposes.
- A physical product doesn’t update the way software does. If the conformity assessment doesn’t cover the AI component from the design stage, the alternative is recertifying afterwards — and recertifying a medical device or an industrial machine isn’t as simple as shipping a patch.
- The coordination doesn’t exist yet at most companies. The team building the model, the one integrating the hardware and the one managing sector certification rarely share a single reference document.
The first step here is organizational: deciding who in the company answers, today, the question of who the provider is.
Checklist for 2 August 2028
Before that date, check that you have:
- Identified whether your AI lives inside a product with its own sector regulation (medical devices, machinery, radio equipment).
- A conformity assessment for the product that already covers the AI component from the design stage.
- Decided, in writing, who takes on the provider role for AI Act purposes: the manufacturer or the integrator.
Classifying every system, deciding who the provider is and getting it documented before the date arrives is the work we do alongside the teams who ask us for it. If you’re not sure where to start, ask us and we’ll be glad to help.
Frequently asked questions
How does the AI Act affect me if my company doesn’t develop AI, only uses it?
The obligation to train employees in the responsible use of AI (Article 4, AI literacy) has been in force since 2 February 2025, not 2 August 2026. Keeping an inventory of the models you use, even third-party ones, is good practice — and it is a duty under Spain’s draft AI Governance Law, still going through parliament — but it isn’t an AI Act requirement in itself.
What happens if I don’t comply with the date that’s already in force?
The fine can reach €15 million or 3% of global turnover, whichever is higher (Article 99(4) of the AI Act; the €35M/7% tier applies only to prohibited practices under Article 5). For identifying conversational agents (Article 50(1)), there’s no grace period: it’s been enforceable since 2 August 2026. For marking AI-generated content (Article 50(2)), the AI Act transitional provisions introduced an extension for providers of systems already on the market before that date an extension until 2 December 2026.
How do I know which date on the EU AI Act timeline my system falls under?
It depends on what it does and where it lives. If your system interacts directly with people as AI or generates content covered by the transparency obligations in Article 50, 2 August 2026 already applies to you. If it decides autonomously about people in areas such as HR, credit, education or health, it falls under 2 December 2027. If it’s embedded in a regulated product, like a medical device or an industrial machine, it falls under 2 August 2028.
Could these dates change again?
It’s possible. The current timeline is the result of the Digital Omnibus approved in 2026, but the Commission has left the door open to further adjustments depending on how the Regulation’s practical application evolves. Treating any date as final before official publication is a risk in itself.
