The EU AI Act timeline for small organizations

If your organization uses AI tools in the EU, the parts of the AI Act that matter most to you already apply: the bans on certain AI practices, the AI literacy obligation and the transparency rules for chatbots and AI-made content. The heavier high-risk rules arrive later, in December 2027 and August 2028, and many small organizations will never fall under them. This guide sets out the EU AI Act timeline, what each date means for a small organization, and what to do now.

What the EU AI Act is

The AI Act is Regulation (EU) 2024/1689. The European Commission describes it as the first comprehensive legal framework on AI anywhere in the world. It sorts AI systems by how much harm they could cause and sets rules to match. Some practices are banned, some uses face strict requirements, some need clear disclosure, and most face no rules at all.

The Act puts duties on 2 main groups. Providers are the organizations that build AI systems and models. Deployers are the organizations that use those systems. A non-profit that runs a chatbot on its website, uses a writing assistant or relies on a spam filter is a deployer. For a short definition you can share with colleagues, see our glossary entry on the EU AI Act.

The EU AI Act timeline at a glance

The Act entered into force in 2024, but its rules switch on in stages. These are the EU AI Act dates as the European Commission lists them.

Date	What applies
1 August 2024	The Act enters into force
2 February 2025	Prohibited practices 1 to 8 are banned, and the AI literacy obligation applies
2 August 2025	Governance rules and obligations for providers of general-purpose AI models
2 August 2026	General application, including the transparency rules; the AI Office and Member States take on enforcement
December 2026	Prohibition 9: nudification tools and tools that produce child sexual abuse material
2 December 2027	High-risk rules for the use-case areas listed in Annex III
2 August 2028	High-risk rules for AI in regulated products listed in Annex I, such as lifts or toys

As of this guide’s last update in October 2026, the first 4 stages are already in effect. The remaining dates mostly concern banned tools and high-risk uses.

The risk levels

The Act groups AI systems into 4 risk levels. Where a tool sits decides which rules apply to it.

• Unacceptable risk. These practices are banned. The Commission counts 9 of them, including manipulation, social scoring, emotion recognition at work or in education, and nudification or child sexual abuse material tools.
• High risk. These are uses in critical infrastructure, education, employment, essential services, biometrics, law enforcement, migration and justice. The obligations are heavy: risk assessment and mitigation, high-quality datasets, activity logging, detailed documentation, clear information for deployers, human oversight, and accuracy and cybersecurity. Once a system is on the market, deployers monitor how it works, providers run post-market monitoring, and both report serious incidents.
• Transparency risk. These systems come with disclosure duties. Examples include telling people they are talking to a chatbot, making AI-made content identifiable, and labeling deepfakes.
• Minimal or no risk. No rules apply. The Commission says most AI systems fall here, with spam filters as the standard example.

General-purpose AI models, the large models behind many chatbots and writing tools, have their own track. Their providers must meet transparency and copyright rules, and models with systemic risk must be assessed and mitigated. In July 2025 the Commission published scope guidelines, a voluntary Code of Practice and a template for summarizing training data for these models.

For most small organizations, the picture is reassuring. You are probably a deployer of minimal-risk or transparency-risk tools, and your main duties are the bans, disclosure and AI literacy.

What each stage means for a small organization

February 2025: bans and AI literacy

Since 2 February 2025, the first 8 banned practices have been off limits to everyone, including deployers. Few small organizations would set out to use social scoring or manipulative AI. But some tools include features that could cross a line, such as emotion recognition in an employee monitoring or classroom product. If you work in education or manage staff with software, check what your tools actually do.

The AI literacy obligation has also applied since that date. The Commission’s page does not spell out its details, so treat it as a reason to make sure the people who use AI tools understand them well enough to use them sensibly.

August 2025: general-purpose AI rules

The rules that began on 2 August 2025 fall mainly on the companies that build large AI models, not on the organizations that use them. Your role here is indirect. When you choose a vendor, it is fair to ask how it meets these obligations.

August 2026: transparency rules and enforcement

This is the stage that touches most small organizations directly. From 2 August 2026, the Act applies generally, including the transparency rules. If you run a chatbot that talks to the public, people should know it is AI. If you publish AI-made images, audio or video, they should be identifiable, and deepfakes should be labeled.

From the same date, the AI Office and Member States take on enforcement responsibility. If you have not acted on disclosure yet, this is now overdue rather than upcoming.

December 2026: prohibition 9

The ban on nudification tools and tools that produce child sexual abuse material joins the list in December 2026. Ordinary office tools are not the target here, but your acceptable-use policy should already forbid this kind of use.

December 2027 and August 2028: high-risk rules

The high-risk rules for Annex III areas apply from 2 December 2027, and those for AI in regulated products under Annex I from 2 August 2028. A small organization is most likely to meet them if it uses AI in hiring, in education, or in deciding who gets access to services. If that describes you, start preparing well before the deadline.

What the AI Omnibus changed

The AI Omnibus is a package of changes to the Act. The Commission adopted it on November 19, 2025. Political agreement followed on May 7, 2026, and it entered into force on July 27, 2026. It made 4 changes that matter here:

• It added prohibition 9, the ban on nudification and child sexual abuse material tools.
• It strengthened the powers of the AI Office.
• It extended some simplifications that already existed for SMEs to small mid-cap companies. The example the Commission gives is simplified technical documentation.
• It widened access to regulatory sandboxes, which are controlled settings where organizations can test AI under supervision.

For a small organization that only uses AI tools, the Omnibus changes little day to day. The new ban and the stronger AI Office are the parts worth noting.

What to do now

These steps are practical advice, not legal advice. Most small organizations can work through them in a few weeks.

1. Check whether the Act reaches you. It is likely to apply if you operate in the EU, or if the AI systems you use, or their output, are used there. An organization based outside the EU that serves people in the EU should not assume it is exempt.
2. List the AI systems you use. Include chatbots, writing assistants, transcription tools, image tools and AI features built into software you already pay for. Note where each sits on the risk levels. Our AI risk assessment template gives you a structure for this.
3. Confirm you use no banned practice. Look closely at monitoring, emotion recognition and any tool that scores or ranks people.
4. Put disclosures and labels in place. Add a clear notice to any public-facing chatbot. Label AI-made images, audio and video you publish, and make sure deepfakes are always marked. These rules have applied since 2 August 2026.
5. Give staff basic AI literacy. A short session on what your tools do, where they go wrong and what your policy allows is a reasonable start. Keep a record that it happened.
6. Ask your vendors how they meet their obligations. Ask how they handle transparency, what documentation they can share, and how they would tell you about serious incidents.
7. Take legal advice on anything that could be high risk. AI used in hiring, in education or in deciding who gets access to services deserves a proper review before December 2027.

If you are building a wider approach to AI oversight, our guide to the AI governance framework shows how these steps fit into ongoing work.

Where to get help

The Commission names several sources of support for smaller organizations:

• The AI Pact. A voluntary initiative for organizations that want to prepare for the Act’s rules early.
• The AI Act Service Desk. A place to send questions about how the Act applies.
• SME and small mid-cap simplifications. Lighter requirements in some areas, such as simplified technical documentation, for smaller providers.

On this site, the frameworks lesson in our course puts the AI Act next to other AI frameworks. Many AI tools also handle personal data, so review your data protection duties alongside this work. Our GDPR glossary entry is a starting point.

Frequently asked questions

Does the EU AI Act apply to organizations outside the EU?

It can. The Act is likely to reach you if your AI systems, or the output they produce, are used in the EU, even if your office is elsewhere. If you serve people in the EU, run step 1 above before you decide the Act does not concern you.

Is a chatbot on our website high risk?

Usually not. A general chatbot that answers questions falls under the transparency rules, so you must make clear that people are talking to AI. It could move toward high risk if it helps decide who gets access to essential services, so check what yours actually does.

What is AI literacy and what do we have to do?

The Commission’s page confirms that the AI literacy obligation has applied since 2 February 2025, but it does not define the obligation in detail. A sensible approach is to make sure everyone who uses AI tools understands what they do, where they fail and what your policy allows. Write down what training you gave and when.

Do the high-risk rules apply to us?

For most small organizations, no. The high-risk rules cover specific uses such as employment, education, essential services and biometrics, and they apply from 2 December 2027 or 2 August 2028. If you use AI to screen job applicants or decide who receives a service, take legal advice now.