On 12 July 2024 the AI Act was published in the Official Journal of the European Union. Under the Act’s own terms, it enters into force twenty days after publication, on 1 August 2024. Entry into force is only the start of the timetable: prohibited practices apply from 2 February 2025, general-purpose AI obligations from 2 August 2025, high-risk obligations from 2 August 2026, and the obligations for products listed in Annex I from 2 August 2027.
The logic behind four dates
The staging is not arbitrary drafting. Prohibited practices target unacceptable uses, which are easier to identify and command broader consensus, so they get the shortest transition. General-purpose AI obligations address foundation-model providers and require agreed methods for evaluation and disclosure. High-risk obligations involve quality management systems, technical documentation and conformity assessment, which take longest to prepare. Annex I products must also align with existing product-safety legislation, which pushes the date further out.
The timetable determines the order in which resources are committed. Compressing everything into 2026 collides with conformity assessment, notified-body queues and supply-chain coordination. Handling only the prohibitions in 2025 misses the design window for high-risk products.
Roles before obligations
The Act allocates duties by role: provider, deployer, importer, distributor, with separate rules for providers of general-purpose AI models. The same company can hold different roles across products. Integrating an open-source model into a proprietary product and offering it to the market can move a company from user to provider.
A misjudged role distorts every document that follows. The common error is to classify by company size or place of registration rather than by whether the system is placed on the EU market and offered under one’s own name or trademark. Once the role is fixed, the obligation list, contract terms and documentation duties have somewhere to land.
The shortest window is the prohibitions
Before 2 February 2025, the task is a use-case screen, not a full compliance rebuild. The screen covers existing products, features in development and custom work for clients. Sales and pre-sales teams belong in the process, because use is often fixed during requirements discussions.
The screen should leave a record: which uses were excluded, on what basis, and who reviewed the conclusion. The record is not only for regulators. It gives a consistent test when a customer asks for custom work, so that the same kind of feature does not receive different answers in different projects.
Sequencing the roadmap
A workable order is inventory, classification, gap analysis, documents and processes, contracts and monitoring. The inventory covers models, data, uses and target markets. Classification fixes risk tier and role. Gap analysis maps each obligation to an existing control. Documents and processes determine whether conformity assessment can be passed. Contracts and monitoring address upstream and downstream duties and post-market obligations.
The timetable is statutory; the preparation is not. Working backwards from each date into internal milestones is more reliable than quarterly planning. Companies operating in several markets should also compare EU requirements with other regimes, so that one set of controls does not generate duplicate paperwork.
For EU market access and risk classification, see our EU AI Act service; for parallel regimes, see multi-jurisdiction compliance; for upstream and downstream terms, see commercial contracts.
This article is based on the AI Act published in the Official Journal of the European Union on 12 July 2024, and on public information. It is for reference only and does not constitute legal advice.