ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The EU AI Act deadlines moved in 2026, so the timeline below is the current one. Updated: these dates changed in July 2026. Regulation (EU) 2026/1744, the “Digital Omnibus on AI”, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 — six days before the original high-risk deadline.
It postpones the obligations for high-risk AI systems designated under Article 6(2) and Annex III from 2 August 2026 to 2 December 2027, and those for high-risk AI embedded in products regulated under Annex I to 2 August 2028. It also adds new prohibited AI categories and expands the AI Office’s enforcement role. The prohibitions and AI-literacy duties from February 2025, and the general-purpose AI model obligations from August 2025, are unaffected and remain in force.
Compliance with the EU AI Act is not a single date — it is a phased rollout. Knowing the EU AI Act deadlines lets you sequence your work, prioritise what is already due, and avoid a last-minute scramble as the heavier obligations land. This guide lays out the full timeline and what each milestone requires.
For the obligations behind these dates, see our complete EU AI Act guide. To find out where you stand against them, run our free EU AI Act gap assessment, which scores what already applies separately from what does not. The Act itself is Regulation (EU) 2024/1689.
Three milestones have passed. Since February 2025, prohibited AI practices are unlawful and every organization must ensure a baseline of AI literacy among staff who build or use these systems. Since August 2025, providers of general-purpose AI models carry documentation, transparency, and copyright obligations. Since August 2026, the Act applies generally, which brings the Article 50 transparency duties into force: telling people when they are interacting with an AI system, marking synthetic content as machine-generated, and disclosing deep fakes. If you have not addressed these, they are overdue — not future planning.
The most demanding wave now arrives on 2 December 2027, when the high-risk obligations take effect for Annex III systems: risk management, data governance, technical documentation, human oversight, logging, and conformity assessment. Systems embedded in regulated products get a further eight months, to August 2028.
Before that, 2 December 2026 closes the transition window for the prohibited practices the Digital Omnibus added to Article 5. Prohibitions are not a build project — they are a stop-doing-it decision — so the work there is screening your systems and use cases rather than producing documentation.
Treat the 2027 date as generous only if you have started. Conformity for a high-risk system routinely takes twelve months or more to build and evidence, and the postponement mostly buys back the runway organizations had already lost.
Start now, regardless of your latest applicable date. Build your AI inventory and classify each system by risk — our free EU AI Act gap assessment walks you through both and scores what already applies separately from what lands later. Stop any prohibited uses, close AI-literacy gaps, and check your Article 50 disclosures, since all three are already due. Then begin the heavy lifting on high-risk systems — documentation and management systems are the long pole in the tent. Organizations that treat December 2027 as the deadline to finish, not to start, will be under far less pressure.
Beat the December 2027 deadline.
Our EU AI Act Toolkit gives you the risk assessments, technical documentation, and management-system templates to build conformity now — editable in Word and Excel, so you adapt rather than start from scratch.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
It entered into force on 1 August 2024 and applies in stages: prohibitions from February 2025, GPAI rules from August 2025, general application from August 2026, most high-risk obligations from December 2027, and product-embedded high-risk systems from August 2028.
For most organizations it is now 2 December 2027, when obligations for Annex III high-risk systems become enforceable — postponed from 2 August 2026 by Regulation (EU) 2026/1744.
Yes. Prohibited-AI bans and AI-literacy duties have applied since February 2025, general-purpose AI model obligations since August 2025, and the Article 50 transparency duties since August 2026.
No. The postponement changed the date, not the requirements. A high-risk system still needs a risk management system, data governance, technical documentation, logging, human oversight and a conformity assessment, and those take many months to produce and evidence.
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026
October 12, 2026