EU AI Act Timeline: What SMEs Need to Know in 2025-2027

The EU AI Act (Regulation 2024/1689) entered into force on August 1, 2024, but enforcement is phased over three years. For SMEs deploying AI, understanding these dates is critical.

What's Already in Force

February 2, 2025 — AI Literacy (Article 4) Every organization that provides or deploys AI systems must ensure their staff have "sufficient AI literacy." This isn't optional — it's legally binding. Training programs should cover what AI systems you use, their limitations, and potential risks.

August 2, 2025 — Prohibited Practices (Title II) Eight categories of AI are now banned: social scoring, real-time biometric identification in public spaces (with narrow exceptions), manipulation techniques, exploitation of vulnerabilities, emotion recognition in workplaces and schools, untargeted facial image scraping, biometric categorization for sensitive attributes, and predictive policing for individuals.

What's Coming

August 2, 2025 — GPAI Obligations (Chapter V) General-purpose AI providers (like foundation model companies) must provide technical documentation, copyright policies, and training data summaries. Models with "systemic risk" need adversarial testing and incident reporting.

August 2, 2026 — High-Risk AI Systems (Annex III) This is the big one. If your AI system operates in biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, or democratic processes, and it makes or influences decisions about people, you need full compliance: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy testing. A conformity assessment is required.

August 2, 2027 — Full Enforcement All remaining provisions take effect, including AI in products covered by EU harmonized legislation (medical devices, machinery, toys, etc.).

What This Means for SMEs

Start with AI literacy — it's already required. Then inventory your AI systems and classify them. If any fall into high-risk categories, you have until August 2026 to achieve full compliance. That sounds far away, but conformity assessments, documentation, and risk management systems take months to build.

The fines are real: up to €35M or 7% of global turnover for prohibited practices, €15M or 3% for high-risk violations.