EU AI Act: the compliance timeline for companies (2025–2027)

Regulation (EU) 2024/1689, known as the AI Act, entered into force on 1 August 2024. Unlike the GDPR, it does not apply all at once: lawmakers chose a staged timeline so organisations have time to prepare. For a company, this means some obligations already apply while others arrive gradually through 2027.

The AI Act assigns obligations by role. The provider is whoever develops an AI system or places it on the market under its own name. The deployer is the organisation that uses an AI system under its authority in a professional capacity.

Most companies are deployers: they use a conversational assistant, a scoring module inside an ERP or a recruitment tool bought from a third party. The role can change, though. If you put your brand on a system, substantially modify how it works, or use it for a high-risk purpose it was not designed for, you can end up with a provider's obligations.

• You bought a SaaS product with AI features and use it internally — you are usually a deployer.
• You built your own model and sell it to customers — you are a provider.
• You integrated a general-purpose model into a product you sell — check the provider obligations carefully.

The regulation does not treat all AI the same way. Obligations grow with the risk to health, safety and fundamental rights.

For an ordinary company the most sensitive area is HR: a tool that filters CVs, ranks candidates or evaluates employee performance will usually fall into the high-risk category.

The transparency tier reaches more companies than it seems. If you publish a support chatbot on your website, people must be told they are talking to an AI system, unless that is obvious. If you use AI-generated or manipulated images, video or audio that could be mistaken for real, Art. 50 requires that this be disclosed, with limited exceptions for artistic or satirical content.

Article 4 requires providers and deployers to take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other people dealing with AI systems on their behalf. The level is measured against their technical knowledge, experience, education and the context in which the systems are used.

The obligation has applied since 2 February 2025 and does not depend on the risk tier: if your employees use a general-purpose chatbot for emails or summaries, it concerns you. The regulation does not require any particular certificate. What matters is being able to show what you did: who was trained, on which topics, when, and how you adapted the content to different roles.

• What a language model can and cannot do (including “hallucinations”).
• Which data must never reach public tools: personal data, trade secrets, source code.
• How to check an output before relying on it in a decision.
• Who to report misuse or an incident to.

If you use a system listed in Annex III, the regulation asks you, as a deployer, for a few concrete things:

1. Use the system in accordance with the provider's instructions.
2. Assign human oversight to competent people with the training and authority to act.
3. Make sure input data under your control is relevant and sufficiently representative.
4. Monitor operation and inform the provider about risks or serious incidents.
5. Keep the automatically generated logs under your control for at least six months.
6. Inform workers' representatives and affected employees before using the system in the workplace.

In some cases a fundamental rights impact assessment is added: for public bodies, for certain private entities providing public services, and for systems used for credit scoring or for pricing life and health insurance.

For large companies the higher of the two amounts applies; for SMEs and start-ups, the lower. These are ceilings, not fixed tariffs: authorities weigh severity, duration and cooperation.

1. Build an inventory of the AI systems in use, including those adopted by teams without approval (shadow AI).
2. Determine the role (provider or deployer) and the risk tier of each system.
3. Stop any prohibited practice — that deadline has already passed.
4. Run AI literacy training and keep the evidence.
5. For high-risk systems, appoint oversight owners and check log retention.
6. Adopt an AI usage policy and tie it to your existing security and GDPR processes.

The operational details are in our guide to AI governance in practice. If you are also a NIS2 entity, it is worth aligning the effort with management accountability under NIS2.