Lesedauer 8 Minuten

The countdown to the deadlines of the EU AI Act is ticking. The EU states have published the final rules of the EU AI Act. On August 2, 2024, both the standard and exceptional periods will begin. They affect not only providers or operators, but also member states and authorities. Below is an overview of the “six plus 2” deadline model and the associated standards.

The different deadlines of the EU AI Act start to run 20 days after its publication.
The effective date is August 2, 2024. A distinction must be made between different deadlines on the basis of a rule-exception principle.
Overall, there is a model of “six plus 2” deadlines, which are presented in this article.
For all types of stakeholders, including providers, operators, member sites and authorities.

Articles of the EU AI Act mentioned in this post (German):

Article 48 EU AI Act
Article 55 (2) EU AI Act
Article 56 (9) EU AI Act
Article 57 EU AI Act
Article 70 (2) EU AI Act
Article 73 (8) EU AI Act
Article 99 (3) EU AI Act
Article 101 EU AI Act
Article 111 EU AI Act
Article 112 EU AI Act
Article 113 EU AI Act

Please note that the original text of this article is based on the official German translation of the EU AI Act. Its wording may differ in part from the English version of the EU AI Act.

Update: Entry into force of the EU AI Act

The final version was published in the Official Journal of the EU on 12 July 2024. You can find them here. According to Article 113 AI Act, the AI Regulation will enter into force 20 days after publication in the Official Journal of the EU. This is August 2, 2024. From then on, the deadlines start to run.

The following six deadlines are particularly important for:

general and overarching content (6 & 24 months) – deadline are therefore February and 2, 2025August 2, 2026
prohibited AI systems (6 months) – deadline is therefore February 2, 2025
High-risk AI systems (36 months) – deadline is August 2, 2027
General-purpose AI models (9 & 12 months) – deadlines are May 2, 2025 and August 2, 2025
Implementation of sovereign tasks (9-24 months) – deadline is thus May 2, 2025 to August 2, 2026
Sanctions (12 & 24 months) – deadlines are therefore August 2, 2025 and August 2, 2026

Overview of the most important deadlines

A closer look reveals a more differentiated model of “six plus 2” deadlines of the EU AI Act.

The “six plus 2” deadline model of the EU AI Act

As you can see, there are two other relevant deadline or timeline variants in addition to the six basic deadlines. They must be observed separately:

The deadline/timeline for grandfathering under Article 111 AI Act
The deadline/timeline for the re-evaluation of the AI Regulation under Article 112 AI Act

The following deadlines are not only important in terms of their duration. They are also aimed at different actors: there are deadlines that apply to all actors. Then there are deadlines that only affect providers and operators. In addition, there are deadlines that are important for various actors (e.g. also for manufacturers and importers). Finally, there are deadlines for member states as well as for national or EU authorities.

1. The six core deadlines

First, the six core deadlines of the EU AI Act are presented in more detail. Followed by the two special deadlines.

1.1 General deadlines: six and 24 months

They are regulated in Article 113 sentence 1 EU AI Act. After that, the AI Regulation will become generally applicable 24 months after the date of entry into force. As a regulation, it does not require further implementation by national laws.

Article 113 p.3 a) EU AI Act also stipulates that the general provisions of Chapter I (Articles 1-4) are valid for six months after their entry into force. This is important because Chapter I deals with the most important basics such as the scope and definitions:

Chapter I contains not only a large number of definitions in Article 3 AI Act, but also the subject matter and objectives of Article 1 EU AI Act.
In addition, Article 2 EU AI Act covers the scope of the EU AI Act. With the 6-month period, the legal basis for all other types of shortened deadlines is automatically given!

The provision of AI competence within the meaning of Article 4 EU AI Act has a special status in this respect, as it is also part of Chapter I. However, it is questionable in any case what consequences a violation in this respect has that is not based on a violation of provisions of other chapters, e.g. the training obligations within the meaning of Article 9 (5) c) EU AI Act for high-risk AI systems. A breach solely of Article 4 EU AI Act cannot be sanctioned under Article 99 EU AI Act either. In this respect, the relevant deadline appears to be rather declaratory.

Note: From August 2026, the majority of the EU AI Act will be valid! The basics after just six months

Perhaps the most important application of the 24-month period is chatbots. As an application of the medium risk group, there are no special deadlines for them. See this article on the Kärcher AI chatbot.

1.2 Prohibited AI systems: Six months

Article 113 sentence 1 EU AI Act provides for prohibited AI systems within the meaning of Chapter II, Article 5 EU AI Act.

The ban is not only addressed to the (downstream) providers of the banned AI systems.
The use and placing on the market of such AI systems is also explicitly prohibited under Article 5 EU AI Act.
Thus, more or less all potential actors within the meaning of Article 3 No. 8, 9 EU AI Act are affected by this deadline, i.e. the product manufacturers, the operators, the users, the authorised representatives, the importers and/or the distributors.

Even if the ban applies after six months:

The sensitive sanctions can only be imposed 12 months after the entry into force.
This follows from Article 113 sentence 3 b) EU AI Act, which in turn refers to Chapter XII.

Article 99 (3) EU AI Act regulates the sanctions there, see also below.

Note: The six-month period applies to prohibited AI systems. However, sanctions are only threatened after 12 months

According to the view taken here, the time difference between the ban and the sanction is particularly important with regard to the later amount of the sanction: the longer a prohibited AI system is used after the six months, the higher the sanction can and should be after 12 months. An actor who negligently continues to operate a banned AI system after six months is certainly to be sanctioned somewhat differently than an actor who deliberately does so for a year. The time buffer accommodates this.

1.3 High-risk AI systems: 36 months

Article 113 sentence 3 c) EU AI Act determines for high-risk AI systems within the meaning of Chapter III, Article 6 et seq. EU AI Act.

The ban is not only addressed to the (downstream) providers of high-risk AI systems within the meaning of Article 3 No. 3, 68 EU AI Act.
It is particularly important that the obligations for operators only take effect after three years.
Overall, however, almost all potential actors within the meaning of Article 3 No. 8, 9 EU AI Act are also affected by this deadline, i.e. the product manufacturers, the operators, the users, the authorised representatives, the importers and/or the distributors.

Note: The 36-month deadline applies to high-risk AI systems!

It is important to note that after the 36 months, a CE marking within the meaning of Article 48 EU AI Act must also be available. Since this process can take some time, the implementation of all requirements should be started early. And: In the case of high-risk AI, the exception of grandfathering must be observed in particular. More on that below.

1.4 GPAI models: 12 & 9 months

These are May 2, 2025 to August 2, 2025!

For general-purpose AI models, there is generally a 12-month period until August 2, 2025. This results from Article 113 sentence 3 b) EU AI Act in conjunction with Chapter V.

The obligations primarily concern the (downstream) providers
But they must also be known by authorised representatives.

A special administrative deadline applies with regard to the creation of codes of practice for GPAI-Models, see Article 56 (9) EU AI Act. This is only nine months until May 2, 2025 – this is important for AI models with general purpose and systemic risks, see Article 55 (2) EU AI Act..

Note: For GPAI models, the 12-month deadline is the rule! But: Codes of Practice for GPAI models must be in place in 9 months.

As can be seen here too nicely, there are always rule-exception constellations. With the EU AI Act, it is often not enough to just know the standard deadline.

1.5 Administrative deadlines: 9-24 months

This is the period from August 2, 2025 to August 2, 2026!

The deadlines for public authorities are also quite relevant for providers of AI systems. Above all, because in many places they concern the operational feasibility of specifications and the clarity of undefined legal terms:

Perhaps the most important deadline is the obligation of the European AI Bureau, already mentioned under point 1.4, to develop the practical guidelines for GPAI models prescribed in Article 56 (9) EU AI Act within nine months, i.e. by May 2, 2025 at the latest.
According to Article 6 (5) EU AI Act, there is a deadline of 18 months for the preparation of guidelines for high-risk AI – consequently until February 2, 2026. In view of the many ambiguities surrounding the question of when a high risk exists, this is an enormously important deadline.
The Major Incident Reporting Directive within the meaning of Article 73 (8) EU AI Act is also relevant. This guideline, which is to be implemented within 12 months by 2 August 2025, actually only applies to AI systems, but is presumably also relevant for AI models, see Article 55 (1) c) EU AI Act.
Last but not least, the possibility of contacting authorities is also a central challenge in the implementation of requirements. According to Article 70 (2) EU AI Act, it must also be made possible in 12 months – i.e. by August 2, 2025. However, this applies primarily to electronic contact channels.
Last but not least, the entire governance structure on the part of the authorities must be set up in 12 months in such a way that it functions halfway – consequently by August 2, 2025. This follows from Article 113 sentence 3 b) EU AI Act in conjunction with Chapter VII.

In addition to the deadlines mentioned for the market surveillance authorities, member states also have to observe a deadline – namely for AI real-world laboratories within the meaning of Article 57 EU AI Act. The relevant paragraph 1 allows 24 months for this – until 2 August 2026..

Note: Authorities and member states must also observe deadlines!

Almost all of the deadlines listed above should not only be of practical relevance for authorities and state organisers. Much depends on the implementation of these tasks for the actors involved in AI systems and models. It will be exciting if the authorities do not fulfil their own obligations in time, e.g. in the case of the guidelines for high-risk AI. Anyone who is dependent on these guidelines will find it quite difficult to implement the deadlines that apply to them. This creates mutual dependencies!

1.6 Sanctions

In general, the provision of Article 113 sentence 3 b) EU AI Act must be observed here, but this time in combination with Chapter XII. There is already a deadline for sanctions of 12 months until August 2, 2025. However, there is no rule without exceptions here either: Article 101 EU AI Act, which must be observed for the obligations for AI models, has been excluded. Thus, the general 24-month period until 2 August 2026 applies to him as an “exception to the exception”.

Note: For sanctions, 12 months are the rule – but there is also the 24-month period with regard to AI models.

As mentioned above, sanctions can also only be imposed on banned AI systems after 12 months (i.e. on 2 August 2025), although they may no longer be operated after six months (i.e. on 2 February 2025).

2. Two special deadlines

Finally, let’s take a look at the two special deadlines for grandfathering and the reassessment of the EU AI Act:

The deadlines with regard to grandfathering under Article 111 EU AI Act
The deadlines for the re-evaluation of the EU AI Act under Article 112 EU AI Act

At this point, it is important to know that there are these two additional deadlines in the first place. In particular, the grandfathering period is of great practical importance for providers of high-risk AI systems. However, it is not only a question of the deadline whether this provision applies. Therefore, the topic will be highlighted in a separate article shortly. The same applies with regard to the reassessment: The deadlines make it clear above all that the EU AI Act is subject to dynamic change cycles. These must be observed in any case – if you don’t want to be surprised by change

Links to the articles of the EU AI Act mentioned in this post (German):

About the author:

Oliver M. Merx

Oliver M. Merx is the initiator and publisher of CAIR4. He has been working as a digital consultant and business development manager in the Munich area for many years. As a bavarian legal assessor specializing in administrative law, he worked for several years as a tutor in adult legal education and as head of a legal publishing house. Oliver is particularly interested in the interplay between normative law and voluntary Corporate Digital Responsibility (CDR). He is co-publisher of the CDR Magazine, founder of the CDR LinkedIn group founded in 2019, author of the CDR Playbook, co-creator of the CDR Building Bloxx and the international CDR Manifesto. Oliver is also a well-known speaker at numerous events. His professional focus is on digital health, agile legislation and AI techniques.

Countdown to the deadlines of the EU AI Act