The AI Act provides for a graduated framework for the temporal scope of the provisions. The different dates take into account the risk potential of certain practices and the necessary adaptation effort.
Entry into force of the AI Act
On the 20th day following publication in the Official Journal of the European Union.
+ 6 Months
6 months after the AI Act comes into force, the practices classified as "prohibited" may no longer be used. The regulations on AI competence ("literacy") also apply. This means that providers and operators of AI systems are obliged to take measures to ensure that their staff and other persons involved in the operation and use of AI systems on their behalf have sufficient knowledge.
+ 12 Months
The provisions on general purpose AI must be applied 12 months after the AI Act comes into force.
Furthermore, the regulations on notification bodies also apply. Member States are obliged to designate at least one notifying authority that is responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring.
The governance provisions also apply, requiring the Commission at Union level and the Member States at national level to set up or designate the authorities and institutions provided for.
In addition, the penalty provisions apply from this date.
+ 24 Months
24 months after the AI Act comes into force, all obligations apply in principle. This means that the requirements for high-risk AI systems in accordance with Annex III (but not Annex I) and AI systems with low and minimal risk must be complied with.
+ 36 Months
36 months after the AI Act comes into force, the requirements for high-risk AI systems in accordance with Annex I apply.
Deviating provisions for AI systems already on the market or in operation
- High-risk AI systems must be brought into compliance with the AI Act from the time of a material change.
- High-risk AI systems intended for public authorities must be brought into compliance with the AI Act within 6 years of the effective date of the AI Act.
- GPAI systems must be brought into compliance with the AI Act within 3 years of the effective date of the AI Act.
- AI systems that are part of large-scale IT systems in the area of freedom, security and justice (Schengen Information Systems [SIS], visa information systems, Eurodac, etc.) must be brought into compliance with the AI Act by 2030.
Weitere Fristen
- Codes of practice for operators initiated by the AI Office are to be published at least 3 months before the relevant provisions come into force. This results in the following dates for the respective risk categories:
- 9 months after the AI Act comes into force for GPAI systems (mandatory);
- 21 months after the entry into force of the AI Act for high-risk AI systems (Annex III) and AI systems with low and minimal risk (optional);
- 33 months after the entry into force of the AI Act for high-risk AI systems (Annex III) and AI systems with low and minimal risk (optional).
- Guidelines for the practical implementation of high-risk AI systems (Annex I) are to be published 18 months after the date of entry into force of the AI Act.