Short answer: The EU AI Act and the Cyber Resilience Act (CRA) are separate laws with different scopes and compliance clocks. The AI Act is already applying in stages, with general obligations in force and later deadlines for high-risk systems. The CRA entered into force earlier, starts reporting duties before its broad application date, and covers hardware and software products with digital elements sold or supplied in the EU. Use the timelines below to identify the date that matters to your role, then confirm scope and duties in the regulation itself.
At a glance: two laws, two compliance calendars
The AI Act regulates artificial-intelligence systems and general-purpose AI models through a risk-based framework. The CRA is a horizontal cybersecurity law for products with digital elements. A product can raise questions under both laws, but meeting one does not automatically satisfy the other.
As an Amazon Associate I earn from qualifying purchases.
| Comparison point | EU AI Act | Cyber Resilience Act |
|---|---|---|
| Primary subject | AI systems and general-purpose AI models, classified by risk and use | Hardware and software products with digital elements made available on the Union market |
| How obligations phase in | Several staged dates: prohibitions and literacy first, governance and general-purpose-model rules next, then general and high-risk provisions | Initial institutional and reporting provisions, followed by broad application to products and their economic operators |
| First official starting point | AI Act Service Desk implementation timeline and FAQs | European Commission CRA implementation page and Regulation (EU) 2024/2847 |
| Critical classification question | Which AI system or model category applies, and which transition rule covers it? | Whether the item is a product with digital elements and which manufacturer, importer, distributor or other actor duty applies |
The dates are legal implementation milestones, not a determination that a particular product or organisation is in scope. Classification, intended purpose, market activity and transition provisions must be checked separately.
EU AI Act timeline
The Commission’s current schedule incorporates changes made by the AI Omnibus, which entered into force on 27 July 2026. In particular, the dates for two groups of high-risk systems now extend into 2027 and 2028. Older articles that place those obligations in August 2026 or August 2027 are no longer an accurate description of the current schedule.
#1 Best Overall
1 August 2024 — the Act enters into force
The AI Act entered into force on 1 August 2024. Entry into force starts the legal framework and the later application periods; it did not make every obligation operative on that day.
2 February 2025 — prohibitions, definitions and AI literacy begin
From 2 February 2025, the Act’s prohibited-practice rules, core definitions and AI-literacy provisions began applying. Organisations using or supplying AI should therefore treat prohibited-use screening and staff competence as live compliance work rather than a future project.
2 August 2025 — governance and general-purpose AI model rules begin
Governance provisions and obligations for providers of general-purpose AI models started applying on 2 August 2025. The obligations concern the model layer, while downstream deployers may have separate duties when they operate an AI system built on such a model.
Free tools Windows power users keep installed
One-click scans. No signup required.
2 August 2026 — general application for most remaining provisions
2 August 2026 is the general application date for most provisions that had not already started. Transparency requirements and enforcement for provisions applicable on that date also begin. “General application” does not mean that every high-risk obligation starts simultaneously: the Act contains later dates for specified high-risk categories and transition rules.
Rank #2
2 December 2026 — additional prohibitions and an Article 50(2) transition end
On 2 December 2026, certain new prohibitions apply. A transition also ends for certain providers of systems that were already placed on the market before 2 August 2026 and that must meet the marking and detection obligations in Article 50(2). Whether the transition applies depends on the system’s facts and the relevant legal conditions; do not assume that an earlier market placement removes the obligation.
2 December 2027 — Annex III high-risk systems
Rules for high-risk AI systems listed in Annex III apply from 2 December 2027 under the Commission’s current, post-Omnibus timeline. Annex III covers high-risk uses identified by their application area, so a provider or deployer must still assess the system’s intended purpose and classification rather than relying on the date alone.
2 August 2028 — high-risk AI in Annex I regulated products
Requirements for high-risk AI embedded in products regulated under the legislation listed in Annex I apply from 2 August 2028. These systems follow a different path from Annex III systems because the AI is part of a product subject to the listed Union harmonisation legislation.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow to read an AI Act date correctly
- Start with the role: provider, deployer, importer, distributor, manufacturer or another actor may have different duties.
- Identify the object: distinguish an AI system from a general-purpose AI model and from a conventional software feature that may not meet the Act’s definitions.
- Check the risk category: prohibited, high-risk, transparency-related and lower-risk uses do not share one deadline.
- Apply transition language: an existing system, a new substantial modification and a system embedded in a regulated product can fall under different provisions.
- Record the basis: keep the intended purpose, deployment date, market-placement evidence and classification rationale with the compliance file.
Cyber Resilience Act timeline and scope
The CRA is Regulation (EU) 2024/2847. The Commission describes it as a horizontal framework applying to “hardware and software products (‘products with digital elements’) that are made available on the Union market.” That can include relevant remote data-processing solutions and software or hardware components placed on the market separately. Manufacturers are expected to perform a cybersecurity risk assessment and use it throughout planning, design, development, production, delivery and maintenance.
10 December 2024 — the CRA enters into force
The CRA entered into force on 10 December 2024. This established the regulation and began the runway toward its staged application.
11 June 2026 — conformity-assessment-body provisions
Provisions concerning notification of conformity-assessment bodies begin applying on 11 June 2026. These provisions support the assessment infrastructure that manufacturers may need for products requiring a notified-body route.
11 September 2026 — Article 14 reporting obligations
Article 14 reporting obligations begin applying on 11 September 2026. Organisations should establish an intake, triage and escalation process for reportable actively exploited vulnerabilities and severe incidents, including ownership, evidence preservation and communication with the required authorities.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →11 December 2027 — full CRA application
The CRA’s full application date is 11 December 2027. By then, the regulation’s product, economic-operator and conformity obligations apply according to the product’s classification and the applicable assessment route. “Full application” is not a guarantee that every product follows identical paperwork: category, criticality and actor role still matter.
What the CRA expects manufacturers to do
- Assess cybersecurity risks for the product and keep the assessment connected to engineering decisions.
- Build security into planning, design, development, production, delivery and maintenance rather than treating it as a final inspection.
- Maintain vulnerability-handling and incident-reporting processes that can meet the Article 14 reporting start date.
- Determine the conformity-assessment route and work with a notified body when the regulation requires one.
- Identify duties for importers and distributors as well as the manufacturer; placing a third-party product on the EU market can create separate responsibilities.
The Commission’s CRA implementation page lists guidance, standardisation work and other expected deliverables. Those project milestones can change, so use the current page for status. The Commission’s CRA summary is useful for orientation but expressly says it is not representative of the Commission’s official position; the regulation published in the Official Journal is the binding text.
Where the AI Act and CRA overlap—and where they do not
| Question | AI Act approach | CRA approach |
|---|---|---|
| What is regulated? | AI systems and general-purpose AI models, with duties determined by risk, use and role | Products with digital elements, including relevant hardware, software and remote data-processing solutions |
| What drives the deadline? | The provision involved and the system’s category, including Annex III or Annex I status | The staged CRA provisions, product scope, criticality and economic-operator role |
| What evidence should be assembled? | Intended purpose, risk classification, model or system documentation, transparency measures and deployment records | Cybersecurity risk assessment, secure-development records, vulnerability handling, incident reports and conformity evidence |
| Does compliance with one law satisfy the other? | No | No |
For example, a connected device that uses an AI diagnostic feature may need an AI Act assessment for the AI function and a CRA assessment for the product as a whole. The fact that the same company supplies both does not merge the legal tests.
A practical way to use the timelines
- Inventory what you supply or use. List AI systems, general-purpose models, connected hardware, software products, cloud or remote-processing components and versions already placed on the EU market.
- Map your legal role. Identify whether you are acting as provider, deployer, manufacturer, importer, distributor or another economic operator for each item.
- Classify before scheduling. For AI, determine whether the use is prohibited, high-risk, transparency-related or otherwise covered. For the CRA, determine whether the item is a product with digital elements and whether a critical-product category or specific conformity route applies.
- Attach the applicable date. Use the AI Act milestone for the exact provision or the CRA milestone for the reporting, assessment-body or full-application duty. Keep the date and legal basis together in the compliance register.
- Build evidence ahead of the date. Preserve design decisions, risk assessments, technical documentation, instructions, logs, vulnerability records and market-placement information. Reconstructing them after an incident is slower and less reliable.
- Monitor official updates. Recheck Commission timelines, FAQs, guidance and standards work when a deadline approaches. Implementation pages can change as delegated acts, guidance and standards develop.
- Escalate uncertain classifications. A timeline is not a legal opinion. Where the intended purpose, substantial modification, product category or transition status is unclear, obtain specialist legal or conformity advice.
Official resources worth bookmarking
AI Act timeline and implementation guidance
The AI Act Service Desk timeline provides the milestone list in a concise format. The Commission’s main AI Act page provides the regulatory framework and related materials.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For practical interpretation, consult the Commission’s Navigating the AI Act FAQ, including its treatment of implementation questions. The Service Desk’s “When does enforcement start?” FAQ addresses enforcement timing, while the Service Desk resources page collects legislation, policy material and communication resources.
Best Value
CRA implementation and legal text
Use the Commission’s CRA implementation page for the current timeline and implementation actions. The Commission’s CRA legislative summary explains the framework in plain language but should not replace Regulation (EU) 2024/2847 in the Official Journal when you need a binding requirement or definition.
AI Pact
The Commission’s AI Pact is a voluntary preparation and information-sharing initiative. Participation can help organisations organise early work, but it does not replace obligations that apply under the AI Act.
Common timeline mistakes
- Using an old high-risk date: the current Commission schedule places Annex III obligations in December 2027 and Annex I product obligations in August 2028 after the AI Omnibus change.
- Treating entry into force as full application: both laws have staged calendars; the first date is not the date every duty starts.
- Assuming “AI” means AI Act only: the CRA can apply to the digital product that contains or delivers an AI function.
- Ignoring products already on the market: transition provisions can preserve or end duties based on placement date, modification and the specific article involved.
- Waiting for standards to finish: standards and guidance can support conformity, but they do not erase a duty whose legal application date has arrived.
- Relying on a summary as the law: Commission summaries and FAQs aid orientation; the regulation and applicable implementing materials control the legal analysis.
The Bottom Line
The AI Act and CRA are complementary but independent EU regimes. Track the AI Act’s provision-specific dates—including the December 2027 and August 2028 high-risk deadlines—and the CRA’s September 2026 reporting and December 2027 full-application dates. Then verify your product, system and organisational role against the current Commission guidance and the binding legal texts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
