What is the EU AI Act compliance deadline?

The EU AI Act entered into force on 1 August 2024 and applies in phases. Prohibited AI practices have applied since 2 February 2025, and GPAI model obligations since 2 August 2025. Transparency obligations under Article 50 (chatbot disclosure, deepfake labelling) apply from 2 August 2026; providers of generative AI systems placed on the market before that date have until 2 December 2026 to meet Article 50(2)'s machine-readable marking duty. The omnibus adopted in June 2026 also postponed the high-risk deadlines: stand-alone Annex III systems (employment, education, essential services, law enforcement, etc.) must comply by 2 December 2027, and AI embedded in Annex I regulated products by 2 August 2028. Organisations should keep preparing now, conformity assessments take time and the first Article 50 duties land in August 2026.

How does ISO 42001 relate to the EU AI Act?

ISO 42001 is an AI management system standard that provides a framework for managing AI responsibly. It is related to the EU AI Act in that implementing ISO 42001 will help organisations meet many EU AI Act requirements, particularly around governance structures, risk management, documentation, and accountability. However, ISO 42001 certification does not provide automatic EU AI Act compliance, and the EU AI Act has specific technical requirements (bias testing, explainability, accuracy benchmarks) that go beyond the ISO 42001 management system scope. The two frameworks are complementary, many organisations use ISO 42001 as the management backbone and map EU AI Act technical requirements on top.

What are the penalties for EU AI Act non-compliance?

EU AI Act penalties are tiered by violation type: deploying a prohibited AI system (Article 5 violations) carries fines of up to €35 million or 7% of global annual turnover, whichever is higher; non-compliance with other obligations for providers and deployers of high-risk AI systems carries fines of up to €15 million or 3% of global annual turnover; supplying incorrect or misleading information to national authorities carries fines of up to €7.5 million or 1.5% of global annual turnover. These penalties are comparable to GDPR enforcement levels and are applied per violation, not per organisation, multiple simultaneous violations could stack.

Get your Free 30 Days Gen AI Risk Discovery Trial -30 Days Gen AI Risk Trial -Start Now

Book a demo

Free Template · Regulatory Compliance

AI Regulatory Compliance
Tracker

Track compliance across the EU AI Act, NIST AI RMF, ISO 42001, and emerging US and UK AI regulations. Includes requirement mapping, gap analysis, and remediation tracking for your AI governance programme.

Download Template Book Demo

Updated July 2026

4 frameworks

EU AI Act, NIST, ISO 42001, US state laws

Dec 2027

EU AI Act Annex III high-risk deadline

€35M

max penalty for prohibited AI

Free

to use and customise

Why You Need an AI Regulatory Compliance Tracker

AI regulation has accelerated dramatically since 2024. Organisations now face overlapping compliance obligations across multiple jurisdictions and frameworks, and without a structured tracker, gaps are inevitable.

Dec 2027

EU AI Act high-risk deadline moved to December 2027

The digital omnibus adopted in June 2026 deferred Annex III high-risk obligations to 2 December 2027, and to 2 August 2028 for AI embedded in Annex I products. Article 50 transparency duties still start on 2 August 2026; only the Article 50(2) machine-readable marking duty gets a transition, to 2 December 2026, for generative AI systems already on the market before that date. The work continues.

3 frameworks

Overlapping requirements need unified tracking

EU AI Act, ISO 42001, and NIST AI RMF have overlapping but non-identical requirements. Without a unified tracker, gaps appear between frameworks.

Jan 2026

US state AI laws are now in force

Texas TRAIGA and Illinois HB 3773 took effect on 1 January 2026, California SB 53 is live, and Colorado's rewritten SB 26-189 arrives on 1 January 2027. Organisations with US operations need to map which laws cover which systems.

Audit

Compliance evidence must be maintained over time

Regulators expect evidence of ongoing compliance, not a point-in-time snapshot. A tracker provides the audit trail that demonstrates systematic compliance management.

The Compliance Tracker

Expand each section to view the compliance requirements and assessment framework. Complete the status fields for each requirement to build your gap analysis.

Step 1: Classify Each AI System by Risk Tier

Unacceptable Risk (Prohibited)

Compliance required: 2 Feb 2025 (in force)

Real-time biometric surveillance in public spaces; social scoring by public authorities; exploitation of vulnerabilities of specific groups; subliminal manipulation. The June 2026 omnibus added AI-generated non-consensual intimate imagery and CSAM. These systems must be withdrawn immediately.

High Risk (Annex III)

Compliance required: 2 Dec 2027 (deferred by the June 2026 omnibus)

Employment and HR decisions; education and vocational training; access to essential services (credit, insurance, benefits); law enforcement; migration and asylum; administration of justice. Full obligations apply.

Limited Risk

Compliance required: 2 Aug 2026 (Art. 50(2) marking for systems on the market before then: 2 Dec 2026)

AI systems that interact with natural persons (chatbots); AI that generates or manipulates content (deepfakes, synthetic media). Transparency obligations only, must disclose AI nature.

Minimal Risk

No additional obligations

All other AI systems, spam filters, AI-powered games, recommendation systems not in Annex III contexts. No additional obligations under the EU AI Act beyond existing law.

Key High-Risk AI Obligations (Annex III systems)

Risk Management System (Art. 9)