The AI Act is the first comprehensive regulatory framework for AI in the European Union. It does not apply all at once: its entry into force is staggered. The first obligations have already been in force since 2025, others arrive in 2026, and the rules on high-risk systems have been postponed further out. Rather than aiming for legal exhaustiveness (the text is evolving and its interpretation is still being refined), let us focus on the actual timeline and on what concretely changes for the IT department.

This article is a plain-language overview, not legal advice. For your precise obligations, rely on your legal counsel or your DPO.

The actual timeline, step by step

Contrary to a widespread belief, the AI Act does not “start” in 2026: several obligations already apply. Here are the main deadlines.

  • Since 2 February 2025: prohibition of unacceptable-risk practices (Article 5) and the AI literacy requirement (Article 4, training teams for informed use).
  • Since 2 August 2025: obligations on general-purpose AI models (GPAI) and the establishment of governance.
  • 2 August 2026: transparency obligations (Article 50) directed at users come into play.
  • 2 December 2027: obligations on standalone high-risk systems (Annex III, including CV screening in recruitment). This deadline results from a postponement decided under the “Digital Omnibus” and remains subject to the formal adoption of the text.
  • 2 August 2028: obligations on high-risk systems integrated into a regulated product (Annex I).

The postponement of high-risk requirements to late 2027 / 2028 stems from a political agreement between the European Council and Parliament on 7 May 2026 (the “Digital Omnibus”). This agreement is in the process of formal adoption: until it is published in the Official Journal, the new dates are not final. The direction, however, is clear: prepare now, the deadline merely gives you more time.

A logic based on risk levels

The AI Act classifies AI systems according to their risk. This is the most useful lens:

  • Unacceptable risk: certain uses are prohibited (social scoring, manipulation, etc.).
  • High risk: strictly regulated uses (for example the automatic screening or ranking of CVs in recruitment, explicitly considered high-risk under Annex III). Obligations covering documentation, human oversight, traceability and logging of use (Article 12). Note: a simple CV summary intended for a human, without scoring or automatic ranking, is far less exposed than automated screening.
  • Limited risk: transparency obligations (Article 50). Users must know they are interacting with an AI, and AI-generated content must be flagged as such. Logging of use does not fall under this level, but under high risk.
  • Minimal risk: the vast majority of uses, with few or no specific obligations.
Key takeaway

Most enterprise AI uses fall under limited or minimal risk. But as soon as an AI touches a decision that affects a person (screening applications, access to a service), you move into high risk with mandatory human oversight, traceability and logging. These high-risk obligations have been postponed to December 2027 (Annex III) by the Digital Omnibus, an agreement still in the process of adoption: time to prepare, not an exemption.

The three obligations that come up most often

1. Human oversight

For sensitive uses, a decision cannot be fully automated. A human must be able to understand, verify and, if necessary, take back control. This is the logic of human-in-the-loop: the AI proposes, the human decides on what carries consequences.

2. Traceability

You must be able to document what the AI did: which data, which decision, when. An immutable audit log is no longer a luxury, it is a condition of compliance.

3. Transparency and data protection

The AI Act combines with the GDPR. Personal data processed by an AI remains subject to the rights of the individuals concerned. And reconstituting this evidence after the fact, by hand, for every request, is costly in time.

How to prepare without blocking everything

When faced with a new regulation, the temptation is to freeze all uses. This is rarely the right answer: the compliance debt grows while teams work around it. A healthier approach:

  • Map your uses by risk level (most will be minimal - so much the better).
  • Put human oversight wherever a decision affects a person.
  • Enable a log now, so you do not have to reconstitute the evidence later.
  • Keep data under control: the less your real data circulates to third parties, the smaller your compliance surface.

Going further

CLEVYA was designed with these principles by default: human validation on critical actions, an audit log, and local anonymization so that the real data does not leave your server. See the Security page and the article Shadow AI: the invisible risk.