EU’s AI Act published in Official Journal, transition periods now known

Following the adoption of the "Regulation laying down harmonised rules on Artificial Intelligence" (AI Act) by the European Parliament and the Council of the European Union, this act was published in the Official Journal of the European Union on 12 July 2024. This marks the end of a long road of tough negotiations that began in 2021 with the European Commission's proposal for a Union-wide regulation on artificial intelligence (AI).

The AI Act will enter into force on 1 August 2024. As a European regulation, it will apply directly in all 27 member states, but the AI Act provides for a graduated system of transitional periods along with some exceptions to the rules governing its implementation date. In this blog post, we provide an overview of the most important deadlines that now apply.

Starting point: applicability after 24 months 

The majority of the provisions of the AI Act will only be applicable after a 24-month transitional period and thus from 2 August 2026 (i.e. general applicability). During this period, the numerous accompanying measures such as delegated acts, guidelines and standards will be published and the European AI governance structure will be established in order to ensure standardised, legally compliant and coordinated implementation and enforcement of the AI Act. 

Applicability of provisions on prohibited practices from 2 February 2025 

The AI Act is characterised by a risk-based and graduated regulatory approach, which is also reflected in the structure of the transitional periods. In simple terms, it can be said that the higher the risk posed by the respective category of AI, the earlier the provisions of the AI Act will apply. 

For this reason, the provisions on prohibited practices (Art. 5 AI Act) will already apply from 2 February 2025 – six months after entry into force (Art. 113 p. 2 lit. a) AI Act. 

These prohibited practices include AI systems that are used for emotion recognition in workplaces and in education, social scoring, predictive policing, the manipulation of human behaviour or the exploitation of human vulnerabilities, as well as AI systems that carry out biometric categorisation systems based on sensitive characteristics, untargeted facial image scraping on the Internet and closed-circuit television recordings with the aim of strategically creating a facial recognition database.

Applicability of provisions on general purpose AI models, governance and sanctions from 2 August 2025

The following chapters and articles of the AI Act will apply from 2 August 2025 – 12 months after entry into force (Art. 113 p. 2 lit. b) AI Act): 

• Chapter III, Section 4 ("Notifying authorities and notifying bodies")
• Chapter V ("General purpose AI models") 
• Chapter VII ("Goverance") 
• Chapter XII ("Sanctions") with the exception of Art. 101 
• Art. 78 ("Confidentiality")

Of particular relevance to companies here is the preemption of the obligations of providers of general purpose AI models regulated in Chapter V. It should be noted that a breach of these obligations is only sanctioned or subject to fines from the time of general applicability due to the exclusion of Art. 101 of the AI Act.

Applicability of provisions on certain high-risk AI systems from 2 August 2027 

As a final exception to the general date of application, Art. 113 sentence 2 lit. (c) AI Act provides that the rules for certain high-risk AI systems within the meaning of Art. 6 para. 1 AI Act apply from 2 August 2027 (i.e. 36 months after the entry into force of the AI Act). These AI systems are products covered by EU harmonisation legislation referred to in Annex I of the AI Act or a safety component of such products, which are also subject to a third-party conformity assessment procedure before being placed on the market. 

Grandfathering clauses for AI placed on the market before 2 August 2024

In addition, in connection with the transitional periods, the grandfathering provisions provided for in the AI Act for AI systems and GPAI models already placed on the market at the time the AI Act enters into force. 

Unfortunately, the European legislator failed to clearly formulate the grandfathering rules in Art. 111 of the AI Act, which means that there is currently a degree of legal uncertainty. It can be expected that the European Commission will follow up on this with guidelines in the coming months. At present, however, the provisions of Art. 111 of the AI Act should be interpreted restrictively. 

Grandfathering rules for AI systems that are part of large-scale IT systems 

The first grandfathering provision in Art. 111 para. 1 of the AI Act has been precisely formulated. According to this provision, AI systems that are components of certain large-scale IT systems created by EU law in the areas of freedom, security and justice and are placed on the market or put into operation in the EU before 2 August 2027 (i.e. 36 months after the entry into force of the AI Act) need not comply with the provisions of the AI Act until 31 December 2030. One example of such a large-scale IT system is the Schengen Information System. 

Grandfathering for operators of high-risk AI systems 

Of central practical importance is the grandfathering rule in Art. 111 para. 2 of the AI Act, which sets out special rules for operators of high-risk AI systems. In principle, the AI Act does not apply to operators of high-risk AI systems that were placed on the market or put into operation before 2 August 2025. 

This grandfathering, however, does not apply if the high-risk AI systems have been "substantially modified in their design". This term is likely to refer to the term "substantial modification" of high-risk AI systems referred to in Art. 25 of the AI Act. Yet, it is currently unclear when this is the case, especially since there is no legal definition of the terms in the AI Act. Nevertheless, Article 96(1)(c) of the AI Act explicitly states that the EU Commission may issue guidelines on the practical implementation of the provisions on substantial changes. 

Grandfathering rules for providers of general purpose AI models

The grandfathering provision in Art. 111 para. 3 of the AI Act is not clearly formulated. According to this provision, providers of general purpose AI models that were placed on the market before 2 August 2024 (i.e. 12 months before the AI Act enters into force) must "take the necessary measures" to comply with the obligations set out in the AI Act by 2 August 2027 (i.e. 36 months after the AI Act enters into force). 

First, it should be noted that this provision does not grant grandfathering, but rather postpones certain deadlines for providers of general purpose AI models. Systematically, Art. 111 (3) of the AI Act would therefore have been better suited to the provisions at the start of the application process, which are conclusively regulated in Art. 113 of the AI Act. Furthermore, it is unclear to which obligations Art. 113 (3) AI Act refers. From the mere wording, the provision could be understood to mean that all obligations of the AI Act only apply to providers from the specified date. In terms of meaning and purpose, however, this should only refer to the provider obligations from Chapter 5 Sections 2 and 3 of the AI Act.

AI Act timeline reflects risk-based approach

The AI Act contains a complex system of deadlines and transitional provisions. This is essentially an expression of the risk-based approach that runs through the AI Act. There is currently still considerable legal uncertainty regarding the grandfathering provisions. In this respect, it is hoped that the European Commission will issue corresponding guidelines in the near future in order to create more clarity.
In simplified terms, this system of deadlines can be illustrated as follows: 

For more information on the AI Act, contact your CMS client partner or these CMS experts: Italo de Feo, Tom de Cordier, Björn Herbers, Markus Kaulartz, Maria González Gordon, Ian Stevens, David Rappenglück