Vibe Engines is free, interactive AI engineering & system design — runs in your browser. Pick a learning path
EU AI Act Timeline
An engineering-oriented timeline of the EU AI Act: the statutory milestones (entry into force, prohibitions, GPAI obligations, high-risk rules) and what each one asks a builder to produce — model cards, logging, risk documentation, human-oversight design. Filter by your system type to see which obligations land and when. This is a plain-language planning aid for engineers, not legal advice, and it flags where proposed changes (the Digital Omnibus) may move dates that are not yet settled.
Pick a system type above to see the artifact checklist it implies.
The EU AI Act reaches engineers as a list of deliverables with deadlines, so this tool reads it as a timeline mapped to artifacts rather than as legal text. Pick the kind of system you build and it shows which milestones bind it and what you will have to produce. It is a planning aid for builders, not a compliance opinion.
What it computes
There is no arithmetic here: the tool is a filter over five statutory milestones, each tagged with the system types it binds. The rule is simple:
milestone is lit = (selected type is All) or (selected type is in its tags)
checklist = artifacts for the selected type (none for All)| Date | Milestone | Lit for |
|---|---|---|
| 1 Aug 2024 | Entry into force | every type |
| 2 Feb 2025 | Prohibited practices + AI literacy | GPAI, high-risk, limited-risk |
| 2 Aug 2025 | GPAI models + governance + penalties | GPAI |
| 2 Aug 2026 | High-risk (Annex III) + most of the Act | high-risk, limited-risk |
| 2 Aug 2027 | High-risk embedded in regulated products (Annex I) | high-risk |
The four system types are a general-purpose AI (GPAI) model, a high-risk system under Annex III, a limited-risk system with transparency duties, and a minimal-risk system. Each has its own checklist of engineering artifacts.
A worked example
The tool opens on All: all five milestones are lit and, instead of a checklist, it asks you to pick a system type. Choose High-risk (Annex III) and the view changes:
- Four milestones stay lit: 1 Aug 2024, 2 Feb 2025, 2 Aug 2026 and 2 Aug 2027. The 2 Aug 2025 GPAI milestone dims.
- The checklist shows seven artifacts: a risk-management system across the lifecycle; data governance and documentation of training and validation data; technical documentation plus a declaration of conformity; automatic logging of events for traceability; designed-in human oversight controls; accuracy, robustness and cybersecurity evidence; and registration in the EU database before going to market.
- Read together, the plan is: confirm nothing you do is a prohibited practice and that staff AI literacy is in place (2025), then have all seven artifacts ready for an Annex III system by 2 Aug 2026, or by 2 Aug 2027 if the system is a safety component of a product under Annex I.
| Filter | Milestones lit | Checklist items |
|---|---|---|
| GPAI model | Aug 2024, Feb 2025, Aug 2025 | 4 |
| High-risk (Annex III) | Aug 2024, Feb 2025, Aug 2026, Aug 2027 | 7 |
| Limited-risk | Aug 2024, Feb 2025, Aug 2026 | 3 |
| Minimal-risk | Aug 2024 | 3 |
Assumptions and limits
- Not legal advice. It is a plain-language summary that can be incomplete or lag amendments.
- Dates may move. The Commission floated simplification proposals, discussed broadly as the Digital Omnibus, that could defer or reshape some obligations, high-risk timelines especially. They are proposals, not settled law, and the timeline itself does not mark which dates they would touch.
- One filter, two high-risk deadlines. The high-risk filter lights both the 2026 Annex III date and the 2027 Annex I date. Your system belongs to one group or the other.
- A dimmed row is not an exemption. Under Minimal-risk only entry into force stays lit, yet the February 2025 milestone is when certain practices were banned outright and AI literacy became a duty on organizations.
- Checklists are summaries. They name the main artifacts, not every requirement, and a real product can fit more than one system type.
How to use the result
- Classify before you plan. Agree with your compliance team which system type applies, then use that filter.
- Turn the checklist into a backlog. Each artifact becomes tickets with an owner and a due date taken from the lit milestones.
- Build artifacts into the system. Event logging, oversight controls and data documentation are far cheaper to design in than to retrofit before a deadline.
- Re-check dates before relying on them. Confirm the current status of any proposed change against the official text before it drives a launch date.
How it works
- Five statutory milestones, from entry into force (1 Aug 2024) to product-embedded high-risk (2 Aug 2027).
- Filter by system type: GPAI model, high-risk (Annex III), limited-risk or minimal-risk.
- Each system type shows the engineering artifact checklist it implies.
- Proposed Digital Omnibus changes could move some dates; they are not settled law.
Frequently asked questions
What are the key EU AI Act dates?
The Act entered into force on 1 August 2024. Prohibited practices and the AI-literacy duty applied from 2 February 2025. Obligations for general-purpose AI models, the governance structure and the penalty regime followed on 2 August 2025. The bulk of the Act, including the full obligation set for high-risk systems listed in Annex III and transparency duties for limited-risk systems, applies from 2 August 2026. High-risk systems built into products already covered by EU product law follow on 2 August 2027.
What applies under the EU AI Act on 2 August 2026?
Most of the Act. For high-risk systems listed in Annex III that means a risk-management system across the lifecycle, data governance and documentation of training and validation data, technical documentation with a declaration of conformity, automatic event logging, designed-in human oversight, evidence of accuracy, robustness and cybersecurity, and registration in the EU database before going to market. Limited-risk systems take on their transparency duties on the same date.
When do general-purpose AI (GPAI) model obligations apply?
From 2 August 2025. The tool lists the artifacts a GPAI model provider prepares: technical documentation of the model covering architecture, training and evaluation; a public summary of the training-data content; and a policy to respect EU copyright law. Models designated as carrying systemic risk add adversarial evaluation plus incident tracking and reporting. Under the GPAI filter, the timeline keeps entry into force, the February 2025 milestone and the August 2025 milestone lit and dims the later two.
What is the difference between the 2026 and 2027 high-risk deadlines?
They cover different kinds of high-risk system. The 2 August 2026 date is for high-risk systems listed in Annex III. The 2 August 2027 date is for high-risk systems that are safety components of products already covered by EU product law, which the Act lists in Annex I. The tool shows both dates under its single high-risk filter, so check which group your system belongs to before planning around either date.
Does a minimal-risk AI system have any obligations?
The tool lists no mandatory obligations under the Act for minimal-risk systems, encourages voluntary codes of conduct, and reminds you that general law such as GDPR, product safety and consumer protection still applies. Do not read the filter as a full exemption, though. The February 2025 milestone, which the filter dims for minimal-risk systems, is when certain practices were banned outright and AI literacy became a duty on organizations.
Is this legal advice, and can the dates change?
It is not legal advice. It is an engineering planning aid that turns the published milestones into work items, and a plain-language summary can be incomplete or lag amendments. The dates can also move: after the Act passed, the Commission floated simplification proposals, discussed broadly as the Digital Omnibus, that could defer or reshape some obligations, high-risk timelines especially. Those are proposals, not settled law, so confirm anything decision-critical against the official text and your compliance team.