Entry into Force and Application Are Different
Regulation (EU) 2024/1689 entered into force on 1 August 2024. Article 113 sets different application dates for different provisions. Article 111 also contains transitional rules. A single date in a slide deck cannot determine every organisation’s obligations.
The table below describes the timetable in the regulation as originally adopted. Confirm the current legal text and any amendments when applying it to a specific system.
The Original Timetable
| Date | Main provisions in the adopted text |
|---|---|
| 2 February 2025 | Chapters I and II, including AI literacy and prohibited practices |
| 2 August 2025 | Specified governance, general-purpose AI, notified-body and penalty provisions, with exceptions set out in Article 113 |
| 2 August 2026 | General application of the regulation, subject to the specific exceptions and transitional rules |
| 2 August 2027 | Article 6(1) and corresponding obligations for the regulated-product high-risk route |
The last row does not mean that all remaining AI systems are high-risk. It concerns the particular product/safety-component route under Article 6(1).
Prohibited Practices and AI Literacy
Article 5 prohibits specified practices involving manipulation, exploitation of vulnerabilities, social scoring, certain crime-risk assessments, facial-image scraping and biometric uses. Each prohibition has a precise scope; some contain narrowly defined exceptions.
Article 4 addresses AI literacy for staff and other people dealing with AI on behalf of providers and deployers, taking account of their knowledge, experience, context and affected people. Training should relate to the actual system and work, not simply attendance at a generic presentation.
General-Purpose AI Models
Chapter V creates duties for providers of general-purpose AI models, including documentation, information for downstream providers, copyright policy and a training-content summary. Additional duties apply to models with systemic risk. Some provisions have qualified open-source exceptions; open-source availability does not remove every obligation.
A company integrating a model is not automatically the provider of that model. It may nevertheless be the provider of the resulting AI system. Contractual access to documentation and an assessment of the supply chain remain important.
High-Risk Systems and Other Obligations
For high-risk systems, consider the requirements for risk management, data, documentation, oversight, monitoring and conformity assessment, together with the obligations attached to the organisation’s role. Article 50 sets transparency duties for certain AI uses outside as well as inside high-risk scenarios.
The high-risk classification guide explains why the intended purpose matters. The roles guide separates system-provider, model-provider and deployer responsibilities.
Check the Transitional Rules
Article 111 contains provisions for systems and models already placed on the market, as well as particular legacy uses. Relevant facts can include the date the system was placed on the market or put into service, its purpose, changes to its design and the type of operator. Do not infer an exemption merely because a supplier launched a product before a headline deadline.
Penalties Are Not One Universal Percentage
Article 99 distinguishes prohibited-practice infringements, specified operator obligations and the supply of misleading information. Its headline ceilings include EUR 35 million/7%, EUR 15 million/3% and EUR 7.5 million/1%, respectively, subject to the regulation’s detailed conditions. SME treatment differs from the general turnover/amount comparison. GPAI-model-provider fines have a separate basis in Article 101.
These ceilings do not predict the penalty in an individual case. Classification, the relevant provision and the authority’s assessment matter.
Turn Dates into a Working Register
For each system, record the role, intended use, applicable provision, relevant date or transition, evidence needed, owner and unresolved questions. Maintain links to the legal sources and the supplier’s documentation. Revisit the record when the system or law changes; do not treat an old article’s future tense as proof that a deadline is still ahead.
From the Inventory to an Implementation Plan
Q-Journey includes AiP Express and Platinum, with Lean and Muda consulting in Platinum. The agreed project scope determines which processes and technical gaps are examined. A technical review does not itself certify legal compliance; legal classification and any required assessment need the appropriate accountable specialists.
Primary Source
Regulation (EU) 2024/1689 on EUR-Lex. This article explains the framework in the adopted regulation. For a deployment decision, use the current consolidated text, applicable guidance and the facts of the system; publication of this article does not establish the status of later amendments.