The EU AI Act applies in stages, with most rules in effect from 2 August 2026 and high risk obligations pushed to December 2027 and August 2028 after the Digital Omnibus on AI. NIST's AI Risk Management Framework is voluntary. Keep a dated tracker and recheck the official pages each quarter.
What are the main EU AI Act dates?
The European Commission's AI Act Service Desk publishes a timeline that takes the Digital Omnibus on AI amendments into account. As of our review on 18 October 2026, it lists these milestones.
- 1 August 2024: entry into force.
- 2 February 2025: definitions, AI literacy and prohibitions apply.
- 2 August 2025: rules for general purpose AI apply, and governance must be in place.
- 2 August 2026: most rules apply and enforcement starts for applicable rules, including transparency rules under Article 50.
- 2 December 2026: new prohibitions on AI systems generating non consensual sexual deepfakes and child sexual abuse material, and a transition deadline for certain providers to comply with Article 50(2) for systems already on the market.
- 2 August 2027: each Member State should have at least one AI regulatory sandbox.
- 2 December 2027: rules for high risk AI systems in Annex III apply.
- 2 August 2028: rules for high risk AI embedded in regulated products under Annex I apply.
The Commission's regulatory framework page adds that from 2 August 2026 the AI Office and national authorities are responsible for implementing and enforcing the Act, and that the AI Office holds enforcement powers over general purpose AI models.
Why do the dates keep moving?
The Commission notes that certain provisions were amended by the Digital Omnibus on AI, and the later high risk dates reflect that. Older articles may quote different dates. Always check the Service Desk timeline and the text of the Act in the Official Journal before relying on a number from a blog, ours included.
What else belongs on the tracker?
The NIST AI Risk Management Framework was released on 26 January 2023 and is intended for voluntary use to help incorporate trustworthiness into the design, development, use and evaluation of AI systems. NIST also published a Generative AI Profile of the framework. They carry no deadlines, but customers and regulators reference them.
You should also track national and state laws in the places you sell. We have not reviewed those here, so add rows for each after checking official sources.
A constructed tracker
Constructed example: a 50 person company ships a support chatbot in the EU and uses a third party model.
- Article 50 transparency: users must be told they are talking to an AI where the rule applies. Owner: product. Date: 2 August 2026, already live.
- AI literacy: staff using AI should be trained. Owner: people team. Date: since 2 February 2025.
- General purpose model obligations: mostly fall on the model provider, but you should hold the provider's documentation. Owner: engineering. Date: since 2 August 2025.
- High risk classification check: confirm the chatbot does not fall under an Annex III use. Owner: legal. Date: before 2 December 2027.
The point is to give every line an owner and a date, not to build a perfect legal map.
How does this connect to security work?
Many obligations rely on knowing which AI systems and components you use. An inventory of models, data sources and software dependencies is a prerequisite. Safeguard offers SBOM generation and dependency scanning, and teams can use that inventory as one input to AI governance. It does not decide legal classification.
What to do
- Create a tracker with date, source link, owner and status for each obligation.
- Check the Commission's Service Desk timeline quarterly and log changes.
- Inventory the AI systems you build, buy or embed, including model providers.
- Run a first pass classification of each system with legal.
- Train staff who use or supervise AI, and record it.
- Add rows for other jurisdictions once you confirm them from official sources.
Quick check
When do the EU AI Act high risk rules apply?
According to the Commission's timeline on 18 October 2026, Annex III high risk rules apply from 2 December 2027, and Annex I product rules from 2 August 2028.
Is the NIST AI RMF mandatory?
No. NIST says it is intended for voluntary use.
Sources
- Timeline for the Implementation of the EU AI Act, AI Act Service Desk
- Regulatory framework for AI, European Commission
- NIST AI Risk Management Framework
Last reviewed: 18 October 2026.
