EU AI Act Enters Into Force
The EU AI Act (Regulation (EU) 2024/1689) officially entered into force, starting the clock on its phased compliance deadlines. The first obligations, covering AI literacy requirements and prohibited AI practices, became applicable six months later on 2 February 2025, with general-purpose AI model obligations following on 2 August 2025. The high-risk system timeline was later extended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026): obligations for Annex III high-risk systems now apply from 2 December 2027, and obligations for high-risk AI embedded in regulated products under Annex I apply from 2 August 2028.
Key Analytics
Impact Analysis
With the regulation in force, the compliance timeline is legally binding and organizations can no longer treat AI governance as a future concern. The AI literacy, prohibited practice, and general-purpose AI obligations are already applicable, so gaps in those areas represent live compliance exposure. The Digital Omnibus deferral of high-risk obligations to December 2027 (Annex III) and August 2028 (Annex I) gives organizations additional preparation time, but companies in regulated industries such as healthcare and financial services still face the most complex requirements given the likely classification of their AI systems as high-risk, and should use the extension to complete gap assessments rather than pause them.
Recommended Actions
- Implement AI literacy training programs for staff involved in the development, deployment, or oversight of AI systems, as required under Article 4 (applicable since 2 February 2025).
- Immediately assess whether any AI systems in your portfolio fall under the prohibited practices provisions (social scoring, real-time remote biometric identification, emotion recognition in workplace/education) and plan for discontinuation if applicable.
- Maintain a phased compliance roadmap aligned to the current enforcement dates: February 2025 (prohibited practices and AI literacy), August 2025 (GPAI obligations), December 2027 (Annex III high-risk systems), and August 2028 (Annex I product-embedded high-risk systems), per Regulation (EU) 2026/1744.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›AI literacy curriculum rollout for development and oversight staff
- ›Prohibited practice assessment and discontinuation plan
- ›Roadmap reset to the current enforcement dates
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 90 to 195 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.