AI regulation dates engineering teams should put on a calendar

The dates engineering teams most need are in the EU AI Act: transparency and most remaining rules from 2 August 2026, a ninth prohibition from December 2026, and high risk obligations from 2 December 2027. NIST's AI framework is voluntary but under revision. Keep a dated register and recheck it, because dates move.

Which EU AI Act dates matter most?

From the public implementation timeline, last updated 31 August 2026, and the Commission's overview:

• 2 February 2025: prohibitions on certain AI systems, and AI literacy requirements, began to apply.
• 2 August 2025: rules for general purpose AI models, governance and some penalty provisions began to apply.
• 2 August 2026: the remainder of the Act starts to apply unless stated otherwise, including the transparency rules the Commission describes.
• 2 December 2026: the prohibition on systems generating non-consensual intimate imagery and child sexual abuse material applies. Providers of generative systems already on the market before 2 August 2026 must meet the content marking duty in Article 50(2) by then.
• 2 August 2027: general purpose models placed on the market before 2 August 2025 must be compliant.
• 2 December 2027: high risk systems under the Annex III categories become subject to the Chapter III obligations.
• 2 August 2028: the same obligations apply to high risk systems under the Annex I product legislation route.

What about the United States?

NIST's AI Risk Management Framework is voluntary. NIST states that AI RMF 1.0 is being revised as part of the White House AI Action Plan, and that in April 2026 it released a concept note for a critical infrastructure profile. There is also the Generative AI Profile, NIST AI 600-1, from July 2024. None of this is a deadline, but customers cite it in questionnaires.

State and sector rules exist too. We did not verify any here, so ask counsel and check primary sources before adding them to your register.

Why keep a register at all?

Because dates in this field have shifted as amending proposals passed. The Commission's own page mentions the AI Omnibus when describing the ninth prohibition. A register with a source link and a review date for each row lets you notice when something changed, and shows an auditor that you track obligations on purpose.

A constructed example

A team sells an HR screening feature in Europe. Their register has four rows. The first says the feature likely falls in an employment category the Commission lists as high risk, with a planned review by legal. The second records 2 December 2027 as the date high risk obligations start. The third lists the logging and documentation work with owners. The fourth sets a quarterly check of the Commission page. When the next quarter's check shows a date changed, one row is edited and one meeting is cancelled.

Checklist

1. List your AI systems and whether you provide, deploy or both for each.
2. Classify each against the Commission's risk categories, and record who decided.
3. Create the register with columns for obligation, date, source link, owner and next review.
4. Add the EU dates above with source links, and mark which apply to your products.
5. Add NIST AI RMF and AI 600-1 as references, noting the revision in progress.
6. Ask counsel about state, sector and customer contract rules, and add confirmed items.
7. Review the register every quarter and after any announced amendment.
8. Link each obligation to the engineering work item that satisfies it.

Safeguard's policies and gates and compliance automation can help turn register items into checks. They do not replace legal advice on which rules apply.

Quick check

Sources

• European Commission, regulatory framework for AI
• EU AI Act implementation timeline, last updated 31 August 2026
• NIST AI Risk Management Framework

Last reviewed: 18 October 2026.