Since its adoption in 2024, the European AI Act (Regulation (EU) 2024/1689) is regularly summed up in one sentence: "high-risk systems will have to comply by 2027". That's true, and at the same time it's the least urgent part of the text. That deadline, the most cited one, is also the furthest away. Two others are already behind us.
What's already in force
Since 2 February 2025, a list of practices has been purely and simply prohibited: social scoring, behavioral manipulation, exploitation of vulnerabilities, real-time remote biometric identification in public spaces, emotion recognition at work or in schools, biometric categorization of sensitive characteristics. Since 2 August 2025, the associated sanctions have been fully enforceable: up to €35 million or 7% of global revenue, whichever is higher.
That same date of 2 August 2025 also brings a more discreet but equally real obligation: every company that uses or develops AI systems must have dedicated governance in place (system inventory, designated owner, documentation), regardless of their risk level. A structural obligation, not a results-based one: it doesn't depend on the nature of the system used, only on the fact of using one.
Why this confusion persists
The AI Act is often presented as a single text to tick off once, when it actually layers four obligations with different deadlines: governance and prohibitions already active, transparency since 2 August 2026, high-risk only in 2027. Focusing only on the last deadline (the most structural, and therefore the most discussed) creates the illusion of a comfortable delay that no longer exists for the other three pillars.
What this means in practice
A company using a generative AI tool for writing, a customer-support chatbot, or an internal scoring system is already covered by the governance obligation, whether or not it has a "high-risk" system within the meaning of Annex III. The question isn't just "am I affected by high-risk in 2027?" but "do I, today, have an inventory of my AI systems and a designated owner?". For many companies, the honest answer is no, even though the obligation has been in force for over a year.
Source: Regulation (EU) 2024/1689 (AI Act), art. 5 (prohibited practices, sanctions enforceable since 02/08/2025); governance obligations in force since 02/08/2025