EU AI Act: deadlines, obligations and the legal and compliance capacity you need

Short answer: The EU AI Act (Regulation (EU) 2024/1689) applies in stages: the prohibitions in Article 5 and the AI literacy duty in Article 4 have applied since 2 February 2025, the obligations for general-purpose AI models since 2 August 2025 and the transparency obligations in Article 50 since 2 August 2026. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026) postponed the high-risk obligations: to 2 December 2027 for Annex III systems such as HR software and to 2 August 2028 for products covered by Annex I. On 2 December 2026, two new prohibitions and the labelling duty for legacy generative systems take effect.

This guide is for general counsel, heads of compliance and data protection leads in Germany and Switzerland. It sets out the AI Act deadlines after the Omnibus, explains which role your company plays, which workstreams fall to legal and compliance and how much capacity they realistically need.

AI Act deadlines: the timeline of obligations

The AI Act's obligations take effect in seven steps between February 2025 and August 2028. The table shows the position after the Digital Omnibus.

Beyond this window, 2 August 2030 applies to high-risk systems used by public authorities. Our regulatory calendar brings together all deadlines for legal and compliance teams in Switzerland, Germany and the EU.

What the Digital Omnibus changed

• High risk postponed: Annex III applies from 2 December 2027 instead of 2 August 2026, Annex I from 2 August 2028.
• AI literacy recast: providers and deployers must take measures to promote the AI literacy of their staff. Article 4 no longer prescribes a specific level of literacy. The Commission publishes practical examples.
• Two new prohibitions from 2 December 2026.
• Relief for small mid-caps (SMCs): simplified technical documentation and, for fines, whichever amount is lower (Art. 99(6a)).
• Bias detection: the new Article 4a exceptionally permits the processing of sensitive data.
• Unchanged: the GPAI obligations in place since 2 August 2025.

Who is affected: providers, deployers, importers

Which obligations apply depends on the role your company plays for a given AI system. One company can hold different roles for different systems. The terms are defined in Article 3(3) to (7) of the AI Act.

• Providers develop an AI system or GPAI model, or have one developed, and place it on the market under their own name. They carry the widest set of duties, such as documentation and labelling.
• Deployers use an AI system under their own authority, for example a candidate screening tool or a customer service chatbot. Most companies are in this role.
• Importers and distributors: importers are established in the EU and place systems from third-country providers on the EU market. Distributors make systems available on the EU market. For high-risk systems, both must check that the provider has met its obligations (Articles 23 and 24).

For deployers, three points matter most in 2026: AI literacy measures, the transparency obligations in Article 50 and preparing high-risk use cases for December 2027. A company that puts its name or trademark on a high-risk system, substantially modifies it, or changes the intended purpose of a system so that it becomes high-risk is itself treated as a provider (Article 25(1)).

Workstreams for legal and compliance

In practice, an AI Act programme consists of seven workstreams that legal and compliance run together with IT, HR and procurement.

1. AI inventory: record every AI system in use or in development, with purpose, provider, data categories and the accountable unit.
2. Roles and risk classes: determine the role (provider, deployer, importer) and risk class for each system; rule out prohibited practices under Article 5, including the new prohibitions from 2 December 2026.
3. AI literacy: define and document training and awareness measures under Article 4.
4. Transparency: implement notices and labels under Article 50, for instance for chatbots and generated content.
5. Contracts: add information, documentation and cooperation duties to purchase agreements with AI providers.
6. Data protection interface: carry out a data protection impact assessment where a high risk is likely (Art. 35 GDPR, Art. 22 Swiss FADP).
7. High-risk readiness: prepare Annex III systems, for example in recruiting, for the deployer obligations in Article 26 by 2 December 2027: use in line with the instructions, human oversight by trained staff, keeping automatically generated logs for at least six months, informing workers' representatives and affected employees before use in the workplace, and informing people about whom the system makes or supports decisions.

How to turn this into a lasting structure with roles and committees is covered in our guide on setting up AI governance. For AI features in new products, see our article on data protection in product launches.

Germany: supervision under the AI implementation act

In Germany, the KI-Durchführungsgesetz (KI-MIG, the German AI Act implementation law) entered into force on 29 July 2026. The Federal Network Agency (Bundesnetzagentur) is the central market surveillance authority and coordinating body, unless another sector authority is responsible. BaFin is responsible for AI systems that banks, insurers, payment institutions and other BaFin-supervised firms use in direct connection with their regulated financial activity (section 2(3) KI-MIG, Federal Law Gazette 2026 I No. 223).

Switzerland: exposure and the state of domestic regulation

Switzerland is not adopting the AI Act. Swiss companies can still be caught if they place AI systems on the EU market or if the output of their systems is used in the EU (Article 2(1)(a) and (c)). This concerns, for example, software providers with EU customers and groups with EU subsidiaries.

• AI Convention: on 12 February 2025 the Federal Council decided to ratify the Council of Europe's AI Convention and to amend Swiss law accordingly.
• Interim position: on 28 October 2026 the Federal Council took note of an interim report. It favours binding rules where fundamental rights are affected (data protection, transparency, non-discrimination), complemented by guidelines and voluntary commitments. According to the Federal Office of Communications (OFCOM), the consultation is planned for spring 2027 (as at October 2026).
• Data protection: where an AI application processes personal data, the revised Federal Act on Data Protection (FADP) applies, including an impact assessment where a high risk is likely (Art. 22 FADP).
• Financial sector: in Guidance 08/2024 on governance and risk management when using artificial intelligence, dated 18 December 2024, FINMA set out its expectations.

Roles and capacity for an AI Act programme

Most AI Act programmes need two to four roles that the permanent team does not have. The split below is an example for a mid-sized company, not a standard.

Alpinum Solutions provides these professionals through staff leasing or freelancing, part-time or full-time, individually or as a project team. Under staff leasing, the company directs the work and the professional is integrated into the team; under freelancing, the professional works independently within the agreed mandate. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together.

Limits and risks

Responsibility for AI Act compliance stays with the company and its management. Interim professionals prepare decisions, draft and implement. Alpinum is not a law firm. Binding interpretation questions, such as whether a borderline case is a high-risk system, remain with your legal department or external counsel. Because the Commission is still issuing guidelines and examples, classifications should be reviewed at least once a year.

Frequently asked questions about AI Act deadlines

Does the AI Act apply to Swiss companies?

Not as Swiss law, but through its territorial scope. Swiss companies are caught if they offer AI systems in the EU or if the output of their systems is used in the EU (Article 2(1)(a) and (c)). EU subsidiaries acting as deployers are also covered. For purely domestic use, the revised Swiss FADP applies, and in future the rules implementing the Council of Europe AI Convention.

What did the Digital Omnibus postpone?

The Digital Omnibus on AI (Regulation (EU) 2026/1744) postpones the high-risk obligations: Annex III systems, for example in HR, from 2 December 2027 instead of 2 August 2026; Annex I products from 2 August 2028. Article 50(2) labelling applies to legacy generative systems from 2 December 2026. The GPAI obligations and the other transparency duties were not postponed.

What fines apply?

For prohibited practices, Article 99 provides for fines of up to EUR 35 million or 7% of worldwide annual turnover, up to EUR 15 million or 3% for other breaches and up to EUR 7.5 million or 1% for supplying incorrect information (Article 99(3) to (5); in each case the higher amount applies). For SMEs and, since the Omnibus, small mid-caps, whichever amount is lower applies.

Do companies have to prove AI literacy?

Since 27 July 2026, the recast Article 4 requires providers and deployers to take measures to promote their staff's AI literacy. No specific level is prescribed. It is still sensible to document training and policies so the company can show supervisors and auditors what it has done.

Which authority is responsible in Germany?

Under the German AI implementation act, in force since 29 July 2026, the Federal Network Agency is the central market surveillance authority and coordinating body unless another sector authority is responsible. Other authorities are competent for specific sectors. In the financial sector, BaFin is responsible for AI systems directly connected with a regulated financial activity (section 2(3) KI-MIG).

Next step

Tell us which AI systems you use and which deadline matters to you first. We will show you suitable profiles for your AI Act programme.

• Data protection and AI governance
• Setting up AI governance
• Regulatory calendar for legal and compliance
• Discuss your requirements

Last updated: 30 October 2026.