Four of the EU AI Act's obligation clocks are already running
The Act is discussed as though it arrives in the future. Four of its obligations took effect before most organisations finished reading it.
Most conversations about the EU AI Act still use the future tense. That framing is wrong, and it is producing programmes that are late before they start.
The Act does not switch on at a single moment. It phases in, and the phases that carry the sharpest consequences arrived first. By August 2026, four separate obligation clocks were already running.
The prohibitions have been live since February 2025
Article 5 — the prohibited practices — took effect on 2 February 2025. Not the high-risk regime, not the conformity assessments: the outright bans. Social scoring, certain biometric categorisation, emotion inference in the workplace and in education, untargeted scraping of facial images.
The practical problem is that these prohibitions do not announce themselves inside an enterprise. Nobody proposes a social scoring system. What gets proposed is a vendor tool that ranks employees on engagement signals, or a contact-centre platform that infers customer sentiment from voice, or a security product that categorises people by biometric attributes. The prohibition bites on what the system does, not on what the procurement request called it.
If your AI inventory does not record enough about each system to test it against Article 5, the inventory is not doing its job.
Article 4 reaches every provider and every deployer
AI literacy under Article 4 also applied from 2 February 2025, and it is the obligation most often mistaken for a soft one. It is not scoped to high-risk systems. It reaches every provider and every deployer, for every AI system, in proportion to the role the person plays.
“We ran an awareness campaign” is not a defence. The obligation is to ensure a sufficient level of literacy among the people who operate and are affected by these systems — which means the evidence has to show who needed what, what they received, and that it landed.
General-purpose AI, from August 2025
The GPAI obligations began on 2 August 2025. If your organisation fine-tunes a foundation model and places the result on the market, read the provider definition carefully before assuming it does not apply to you. The line between deployer and provider is thinner than most governance functions have assumed, and crossing it changes the obligation set entirely.
Transparency, from August 2026
Article 50 — the transparency obligations — applied from 2 August 2026. Users must be told when they are interacting with an AI system. Synthetic content must be marked in a machine-readable form. Deep fakes must be disclosed.
The machine-readable marking requirement is the one that catches organisations out, because it is an engineering change rather than a policy statement. A line in a privacy notice does not satisfy it.
What this means for a programme
The instinct is to sequence an AI governance programme against the high-risk regime, because that is where the weight of the text sits. That sequencing puts the obligations already in force at the end of the plan.
A more defensible order:
- Inventory first, and record enough to test. You cannot assess Article 5 exposure from a list of system names.
- Article 4 literacy, evidenced by role. It applies now, it applies broadly, and it is cheap to satisfy and expensive to have missed.
- Article 50 transparency as an engineering change, not a notice update.
- Then the high-risk regime, on its own timetable.
The common thread is that the obligations already in force are the ones that depend least on the Commission’s implementing acts and most on what your organisation already knows about its own systems. That work is available to start today, and none of it is wasted when the later phases arrive.
This is drawn from Chapter 4 of AI Cybersecurity Governance, second edition. Positions should be verified against the current consolidated text on EUR-Lex before being relied on.