On 1 August 2024 the EU Artificial Intelligence Act entered into force. For companies offering products or services in the EU, the date marks not the end of compliance but the start of a timetable. Obligations are not all pressed onto entry into force; they apply in stages by risk category. Putting the three dates into the product roadmap is more realistic than assembling materials before a deadline.
Three transition periods
Prohibited practices apply from 2 February 2025, the first substantive milestone. General-purpose AI obligations apply from 2 August 2025, and high-risk obligations from 2 August 2026. The three periods correspond to three kinds of preparation: prohibited practices require screening of product features, general-purpose AI obligations require model information and downstream interface arrangements, and high-risk obligations require a risk management system, technical documentation and conformity assessment. A company may sit in all three periods at once; parallel workstreams by team are more workable than a sequential approach.
Prohibited practices draw the outer boundary
The prohibitions address uses that are not accepted within the EU. The list includes social scoring of individuals, untargeted scraping of facial images to build or expand facial recognition databases, emotion recognition in the workplace and in education, exploitation of vulnerabilities such as age, disability or economic situation to manipulate behaviour, and certain real-time remote biometric identification in public spaces. These uses do not become permissible through user consent or full disclosure.
The immediate task is to compare product features against the list and distinguish technical capability from actual use. A model may have a capability, but it must not be deployed in a prohibited scenario. Products offered in the EU also require review of sales materials, demonstrations and customer guidance, so restricted uses are not presented as selling points.
General-purpose AI and high-risk systems are two preparation lines
General-purpose AI provisions target model providers and focus on the completeness of model information and the predictability of downstream use; high-risk provisions target system use and focus on risk management, technical documentation, record-keeping and conformity assessment. The materials are not interchangeable: a thorough model description does not replace conformity assessment for a high-risk system, and conformity assessment does not cover model-level obligations.
Companies with limited resources can start by identifying their role: provider, deployer, or both. The role determines the obligations and the contracts with upstream and downstream parties; deciding it before drafting reduces rework.
Penalties change the level at which compliance is decided
Penalties reach up to EUR 35 million or 7% of global annual turnover, whichever is higher. At that scale, compliance is no longer a legal department matter; it requires decisions from product, engineering, marketing and management. Penalties also affect how investors assess exposure, the representations customers demand, and insurance arrangements.
Companies should make prohibited-practice screening a required step at project inception, high-risk determination a gate before launch, and keep a written record of each judgment. The record need not be long, but it should state the basis, the conclusion and the responsible person.
A compliance roadmap
A workable sequence is: identify roles and points of contact with the EU market; screen for prohibited uses; classify risk by purpose; map applicable obligations to documents, testing and contracts; and set the schedule. Companies serving several jurisdictions should also compare EU requirements with US and Southeast Asian rules so that the same function is not described inconsistently. Although 2 August 2026 looks distant, conformity assessment capacity and testing cycles need early booking.
For EU market access and obligation mapping, see EU AI Act services; for parallel multi-jurisdiction arrangements, see multi-jurisdiction compliance; for cross-border data flows, see GDPR cross-border services.
This article is based on the EU Artificial Intelligence Act, in force from 1 August 2024, and on public information. It is for reference only and does not constitute legal advice.