The EU AI Act's high-risk AI deadlines have been pushed back to 2027-2028, while new prohibitions and transparency rules are now in force. Here's what AI developers, startups, and investors need to know.
TL;DR
- The EU AI Act's high-risk AI deadlines have been extended to 2027-2028, with new prohibitions and transparency rules now enforceable.
- The Act's scope reaches providers and deployers outside the EU, making it relevant for US and UK companies.
- In-house teams should complete AI inventory, map Article 50 use cases, and audit GPAI model supply chains.
What happened
The EU AI Act's high-risk AI deadlines have been extended, with standalone high-risk systems now applying from 2 December 2027 (previously 2 August 2026) and high-risk AI embedded in products from 2 August 2028 (previously 2 August 2027).
New prohibitions and transparency rules are now in force, including a ban on AI systems generating non-consensual intimate imagery and child sexual abuse material, and transparency obligations for chatbots, synthetic content, and other AI systems.
The EU's AI Office and national market surveillance authorities are now responsible for implementing, supervising, and enforcing the Act, with fines of up to €35 million or 7% of total worldwide annual turnover for non-compliance.
Why it matters
The EU AI Act's scope reaches providers and deployers outside the EU, making it relevant for US and UK companies selling AI-enabled products or services into the EU or with output reaching EU-based individuals.
The Act's enforcement infrastructure is now active, with the EU's AI Office holding investigative and sanctioning powers over GPAI model providers.
In-house teams should complete AI inventory, map Article 50 use cases, and audit GPAI model supply chains to ensure compliance with the Act's obligations.
Key facts
- Standalone high-risk AI systems (biometrics, critical infrastructure, education, employment, migration, asylum, and border control) now apply from 2 December 2027 (previously 2 August 2026).
- High-risk AI embedded in products (machinery, toys, lifts, medical devices) moves to 2 August 2028 (previously 2 August 2027).
- New prohibition on AI systems generating non-consensual intimate imagery and child sexual abuse material applies from 2 December 2026.
- Transparency obligations under Article 50 are now enforceable, with fines of up to €35 million or 7% of total worldwide annual turnover for non-compliance.
- The EU's AI Office and national market surveillance authorities are now responsible for implementing, supervising, and enforcing the Act.
- The Code of Practice on Transparency of AI-generated Content has been signed by approximately 190 organisations, including major providers like Anthropic, Google, Meta, Microsoft, Mistral, and OpenAI.
- The UK has opted for a principles-based, regulator-led model rather than standalone AI legislation, with existing regulators interpreting and applying AI within their respective remits.
- In-house teams should complete AI inventory, map Article 50 use cases, and audit GPAI model supply chains to ensure compliance with the Act's obligations.
Context
The EU AI Act is the first comprehensive regulatory framework for AI, aiming to ensure that AI systems placed on the EU market are safe, transparent, and respect fundamental rights.
The Act's risk-based classification, prohibited-practices regime, and general-purpose AI (GPAI) rules remain intact, with the recent amendments focusing on practical rather than political changes.
The Act's extraterritorial reach echoes the GDPR's approach, with the enforcement infrastructure behind it now active.