Why the EU AI Act Phases In
The EU AI Act did not switch on overnight. The legislators chose a staggered application schedule so that the most dangerous uses are banned first, while the heavy compliance machinery for high-risk systems — documentation, conformity assessment, notified bodies, and a working EU database — has time to stand up. The result is a calendar with four main checkpoints between 2025 and 2027. Knowing which checkpoint each of your AI systems falls under is the single most useful planning step you can take.
2 February 2025 — AI Literacy
The first obligation to bite was Article 4: providers and deployers must ensure their staff and anyone operating AI on their behalf have a sufficient level of AI literacy, proportionate to their role and the systems they use. There is no certification requirement, but you should be able to show a training programme exists and is tailored to risk. This is the cheapest deadline to meet and the easiest to forget.
2 August 2025 — Prohibited Practices & GPAI
This is the date enforcement became real. Two things happened at once. First, the Article 5 bans took effect: no organisation may now place on the market, put into service, or use any of the eight prohibited AI practices in the EU. Second, obligations for providers of general-purpose AI (GPAI) models applied — technical documentation, training-data summaries, copyright policies, and, for models with systemic risk, adversarial testing and incident reporting.
If you have not yet screened your AI portfolio against Article 5, do it now. This tier carries the highest fines (up to €35 million or 7% of turnover) and is already enforceable, so there is no runway left.
2 August 2026 — High-Risk Annex III Systems
This is the deadline that defines most compliance programmes. From this date, the full obligation set applies to high-risk AI systems listed in Annex III: biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services (including credit scoring and insurance pricing), law enforcement, migration and border control, and the administration of justice.
To be ready, a provider needs a quality and risk management system, Annex IV technical documentation, demonstrated data governance, logging and human-oversight design, a completed conformity assessment, the CE marking, and registration in the EU AI database. Deployers need their own controls: human oversight, usage logs, fundamental-rights impact assessments where required, and operation within the system's intended purpose.
2 August 2027 — Annex I Regulated Products
The final major milestone covers high-risk AI that is a safety component of products already governed by EU harmonised legislation in Annex I — medical devices, in-vitro diagnostics, machinery, lifts, radio equipment, toys, and more. These get an extra year because they already pass through third-party conformity assessment under their sectoral rules; the AI Act obligations are layered onto those existing processes. GPAI models on the market before August 2025 must also reach full compliance by this date.
Back-Planning From Your Deadline
Because a high-risk programme takes 9–18 months, you should work backwards from your applicable date. Targeting August 2026 means classification should already be done, the risk-management system and Annex IV file should be drafting now, and conformity assessment should be scheduled. Targeting August 2027 gives a little more room, but Annex I products typically have the most complex documentation, so the extra year is quickly consumed.
Start by confirming your tier with the free GeraCompliance risk classifier, then use our compliance checklist to sequence the work. If the deadline is tight, the AI Act sprint compresses documentation into 5–15 business days.