EU AI Act timeline

High-risk AI systems placed on the market or put into service before the high-risk application date are not automatically pulled into the new rules on that date. Under Article 111, they come into scope only when they undergo significant changes in their design. An update that is routine maintenance or a security patch does not, on its face, change the design, but a change to the model, intended purpose or core architecture usually does. Whether a particular change is significant is a legal and technical judgment that should be documented and reviewed with counsel.

• Placement date: Record the date each system was first placed on the market or put into service, not the date you first deployed it internally.
• Design change log: Keep a dated record of model retraining, changes to intended purpose and architectural changes, with the reasoning for each significance decision.
• Scope trigger: Once a system is substantially modified, treat it as in scope for the obligations that apply on the date of that change.
• Ongoing duties: Legacy status does not remove existing obligations under other laws, such as data protection or sector rules.
• Documentation of the decision: Keep the reasoning behind each scope call so an assessor can follow it.

Check each system's placement date and change history against the Article 111 wording with counsel before you rely on legacy treatment.

Article 111 gives a longer runway for high-risk AI systems intended for use by public authorities. These systems must comply by 2 August 2030, which is later than the general high-risk dates. The extension is aimed at public bodies that may need more time to procure, migrate and document systems in use. It does not exempt a public authority from the Act for systems placed on the market after the general dates, and the boundary between a public authority system and a commercial one depends on intended use.

• Intended use test: Decide whether the system is intended for public authorities. A commercial product sold to a government body can still be a commercial system placed on the market.
• Deadline: Plan for 2 August 2030 as the outer date for compliance of qualifying systems.
• Procurement terms: Ask suppliers for their position on which date applies to the product and whether an update would move it into scope earlier.
• Interaction with other laws: Public sector duties under national administrative and data protection law continue to apply in parallel.
• Migration planning: Factor the replacement or upgrade cycle of public systems into the timeline, since the extension has an end date.

Confirm with counsel whether each public deployment qualifies and how the intended use is recorded in procurement files.

Article 111 also sets a separate date for components of large-scale IT systems listed in Annex X. These components must comply by 31 December 2030. Annex X covers large-scale IT systems used in the area of freedom, security and justice, such as shared EU databases operated by public bodies. Most organizations will not operate these systems directly, but a supplier, integrator or contractor working on one should confirm whether the component it provides is covered.

• Identify the component: Map which parts of your architecture form a component of an Annex X system rather than a standalone AI system.
• Confirm the Annex X listing: Check the annex text directly, since the scope depends on the listed systems rather than on the technology used.
• Date of compliance: Use 31 December 2030 as the outer date for qualifying components.
• Supplier questions: Ask integrators which compliance date they assume for the components they deliver.
• Change tracking: Record any modification to a covered component, since changes can affect the analysis.

Confirm the Annex X scope and the component boundary with counsel, because the date depends on the classification of each part of the system.

Providers of general-purpose AI models placed on the market before 2 August 2025 have until 2 August 2027 to comply with the general-purpose AI obligations under Article 111(3). This transition applies to the model, not to every product built on it. Organizations that fine-tune, host or build on such a model should check whether they have become a provider of their own model or system, because that status determines which duties apply and when.

• Placement date of the model: Confirm when the model was first placed on the EU market, since the 2 August 2025 cut-off depends on it.
• Transition deadline: Plan for 2 August 2027 as the compliance date for qualifying models.
• Downstream systems: A system built on a legacy model still has its own placement date and its own high-risk analysis.
• Supplier documentation: Request the provider's compliance documentation and its position on the transition date.
• Role check: Substantial modification or rebranding can change who is the provider.

Confirm the placement date of each model with its provider and with counsel before relying on the 2027 date.

Providers of generative AI systems placed on the market before 2 August 2026 must meet the marking duty in Article 50(2) from 2 December 2026, according to the transition provision in Article 111(4). Article 50(2) requires that synthetic audio, image, video or text output be marked in a machine-readable way and be detectable as artificially generated or manipulated. The transition gives legacy generative systems a short window to add these markings, while systems placed after the cut-off must meet the duty from the outset.

• Placement date: Record when each generative system was first placed on the market, since the transition covers only systems placed before 2 August 2026.
• Marking deadline: Plan for 2 December 2026 for the Article 50(2) marking duty on legacy systems.
• Technical scope: Confirm which output types your system generates, since the duty covers synthetic content of several kinds.
• Code of practice: Review the Code of Practice on Transparency of AI-generated Content, published on 10 June 2026, as a practical reference.
• Supplier evidence: Ask model and platform providers how their outputs are marked and how detection works.

Confirm with counsel whether a given system counts as placed on the market before the cut-off, and how the marking duty applies to its outputs.

Your organization owns the timeline. Only your management can decide which AI systems are in scope, which role you hold for each one and how each system maps to the application dates in the amended Act. Every later step depends on those decisions being recorded and assigned to named people.

• System inventory: Keep a register of every AI system you build, buy or deploy, with its intended purpose, supplier and EU use. A date cannot be applied to a system you have not listed.
• Legal and role decisions: Decide whether you act as provider, deployer, importer or distributor for each system, and whether it falls into a high-risk route. Counsel should record the reasoning for each decision.
• Deadline ownership: Assign one owner to each date, including 2 December 2026, 2 December 2027, 2 August 2028 and 2 August 2030 where legacy public authority systems are concerned.
• Supplier contracts: Ask each supplier which role it plans to hold, which dates it is planning for and which documentation it will hand over. Read the official text of the consolidated Regulation before you draft these clauses.
• Governance sign-off: Have executive leadership approve the plan, the owners and the evidence your organization must keep.

Check first that your inventory lists every system, because every other date in the plan depends on it.

An implementation partner such as DeployOpen works inside your environment to prepare systems and evidence against the plan you have agreed. DeployOpen plans and implements self-hosted open-source platforms in your own cloud accounts, data centers or air-gapped networks, then prepares the technical and documentation evidence an assessor will later review. It does not decide your legal role for any system, and it does not issue reports, attestations or certificates.

• Logging and records: Configure logging, retention and access records for high-risk systems, scoped to the retention rules your legal team sets.
• Technical documentation: Draft technical documentation and risk management records from your system inventory, for your review and approval.
• Quality management evidence: Prepare procedures, change records and test results that an independent assessor can sample.
• Fixed-scope delivery: Work runs to a written scope with agreed deliverables and timelines, settled in writing before work starts.
• Operation after go-live: Retainers can cover upgrades, monitoring and continuous testing when your plan runs past the first application date.

Check that the written scope names the systems, dates and evidence included, and that it states which decisions remain with your organization.

Where the Act requires an outside body, an independent assessor or notified body makes the conformity decision. Most Annex III high-risk systems use internal control under Annex VI, so the provider's own assessment is the route for them. Notified bodies are involved for some biometric systems and for Annex I products under Article 43, and notified bodies designated under Annex I Section A product legislation must apply for AI Act designation by 28 January 2028.

• Conformity outcomes: Notified bodies issue certificates where the route requires them. No partner can stand in for that decision.
• Route by system: Confirm with the assessor whether each system follows internal control or a notified body route under Article 43.
• Lead times: Ask about availability early, since designation deadlines and demand for assessment capacity may affect your schedule.
• Independence: Keep the preparation team and the assessment team separate in the contract so the assessor's judgment stays independent.
• Standards: Ask how the assessor reads harmonised standards. EN 18286:2026 on quality management was cited in the Official Journal on 14 October 2026.

Check the assessor's designation or accreditation status for your system type before you sign any engagement.