EU AI Act Enforcement Timeline: What's Already in Force and What's Coming

Regulatory Authority: Regulation (EU) 2024/1689, Article 113 (Entry into force and application dates), Article 5 and Article 113(1) (Prohibited practices — applicable February 2, 2025), Articles 51–56 and Article 113(2) (GPAI obligations — applicable August 2, 2025), Article 6 and Chapters III–VIII and Article 113(3) (General application — August 2, 2026), Annex I systems per Article 113(4) (Extended deadline — August 2, 2027), Article 74 (NCA designation deadline — August 2, 2025), Article 101 (EU AI Office enforcement procedures), Article 111 (Transitional provisions for existing AI systems)

Article 5 prohibited practices became applicable 6 months after entry into force. Companies deploying any system falling within the eight prohibited categories have been in violation-eligible territory since February 2, 2025. National competent authorities designated during 2025 are empowered to investigate and fine immediately.

Title VIII (GPAI model obligations, Articles 51–56) and Article 101 (EU AI Office enforcement) became applicable 12 months after entry into force. GPAI providers who had not established technical documentation processes, copyright compliance policies, and systemic risk assessment frameworks by August 2, 2025 have been in violation since that date.

Chapters III (high-risk AI requirements), IV (transparency obligations), V (general-purpose AI — except GPAI-specific rules already applicable), VI (market surveillance), VII (governance), and VIII (sanctions) all apply from August 2, 2026. This is the date when national competent authorities gain full enforcement authority and can impose the full penalty schedule against providers and deployers of non-compliant AI systems.

AI systems embedded in products regulated by EU safety legislation listed in Annex I (medical devices, civil aviation, industrial machinery, toy safety, etc.) have an extended compliance deadline of August 2, 2027. This reflects the fact that these products already undergo conformity assessment under their existing regulatory frameworks, and integrating AI Act requirements takes additional time.

Understand Your EU AI Act Penalty Exposure

Use ComplianceStack's free tools to identify gaps before regulators do.

Take the Quiz →   Gap Analyzer →

Which EU AI Act obligations are already in force as of April 2026?

As of April 2026, two tranches of EU AI Act obligations are already applicable and enforceable. First, since February 2, 2025: Article 5 prohibited practices — the eight categories of banned AI (subliminal manipulation, social scoring, real-time biometric identification in public spaces for law enforcement without exception, emotion recognition in workplaces, biometric categorization by sensitive attributes, untargeted facial recognition scraping, and predictive criminal profiling). Companies still operating systems that fall within these categories are in ongoing violation. Second, since August 2, 2025: Title VIII GPAI obligations — all providers of general-purpose AI models must have technical documentation, training data summaries, copyright compliance policies, and model cards in place; GPAI models with systemic risk (>10^25 FLOPs) must have adversarial testing and incident reporting procedures active. National competent authorities could formally launch investigations into violations of these already-applicable provisions at any point. The main August 2, 2026 deadline — covering high-risk AI, transparency obligations, and the full penalty framework — is still upcoming as of Q1 2026.

Do AI systems on the EU market before August 2026 need to comply immediately?

It depends on the obligation tier and whether the system has undergone changes. Article 111 of Regulation (EU) 2024/1689 provides transitional provisions: AI systems (other than GPAI models) that were already placed on the market or put into service before August 2, 2026 generally have until August 2, 2027 to comply with the Act's requirements — unless they undergo 'significant changes' in design or intended purpose after August 2, 2026. A 'significant change' triggers the full compliance obligation immediately, without the grandfathering period. GPAI models do not benefit from this transitional provision — GPAI obligations applied from August 2, 2025 regardless of when the model was first released. Prohibited practices under Article 5 have no transitional exception — systems violating Article 5 must have been withdrawn from the market by February 2, 2025.

How does EU AI Act enforcement actually work — who investigates and what happens during an investigation?

Enforcement operates through two parallel tracks. Track 1 — National competent authorities (NCAs): For most AI systems other than GPAI models, the NCA designated in each member state is the primary enforcer. Investigations are typically triggered by: market surveillance activities (NCAs proactively testing AI systems in their jurisdiction), complaint referrals from individuals, other regulators (DPAs, financial supervisors), or the European Commission, and serious incident notifications filed under Article 73. During an investigation, the NCA can: request technical documentation, require access to AI systems for testing, conduct on-site inspections, and impose interim measures (e.g., suspend market access) while the investigation proceeds. Investigations must comply with the member state's administrative law. Track 2 — EU AI Office: For GPAI models, the EU AI Office conducts its own investigations directly under Article 101. The Office can act on its own initiative or via a referral from an NCA or member state. It can impose fines on GPAI providers without going through a national court, though providers can appeal to the Court of Justice of the EU. Both tracks can run simultaneously for AI products that include both GPAI components and downstream high-risk applications.