Skip to main content

Explainers

Is the EU AI Act in Force? What Vendors Must Show Now

The EU AI Act entered into force in 2024 but phases in through 2027. Here is the real timeline, and the ISO 42001 evidence vendors are publishing early.

Solomon AmosPublished 22 Oct 202610 min read

Buyers keep asking the same question in different words: is the EU AI Act in force, and if so, why do most vendor trust centres still say nothing about it? Both things are true at once. The Act is law today, but it was written to land in phases over three years, and the phase that matters most to software buyers does not begin until 2 August 2026. This piece lines up the actual dates against what the index sees vendors publishing now, and explains why ISO 42001 certificates are starting to show up ahead of that milestone.

Is the EU AI Act in force? Yes, but not all of it at once

Regulation (EU) 2024/1689, generally called the EU AI Act, entered into force on 1 August 2024, twenty days after its publication in the Official Journal of the European Union on 12 July 2024. Entry into force is a legal starting gun, not a compliance deadline. The Act itself sets out a staged schedule of application dates, so different obligations switch on at different times rather than everything becoming enforceable on day one. That staging is the reason a vendor can say, accurately, that the Act applies to it while also saying that its full high-risk obligations do not bite yet. Our regulations page tracks each of these dates against the obligations they trigger.

Is the EU AI Act a regulation, and what that means for vendors

Yes. It is a Regulation, not a Directive, and the distinction matters for anyone reviewing a vendor's claims. A Directive sets an outcome that each EU member state then transposes into its own national law, on its own timetable, sometimes with local variation. A Regulation is directly applicable: once its application date passes, the text binds companies and public bodies across all 27 EU member states without any national implementing law required. That is why you will not find 27 separate national AI Acts the way you sometimes find 27 slightly different data protection statutes. It also means the obligation dates in the Regulation itself are the only dates that count. There is no member state free to delay implementation the way some did with earlier EU directives.

The phased timeline, 2024 to 2027

The practical confusion comes from treating the AI Act like a single deadline rather than a sequence. The table below sets out the application dates that matter for a vendor security review, separate from the entry into force date above.

DateWhat starts applyingWho it mainly affects
1 August 2024Entry into force of the RegulationAll parties in scope, as a legal matter
2 February 2025Prohibited AI practices (Article 5) and AI literacy duties (Article 4)Anyone deploying banned practices such as social scoring or certain biometric categorisation
2 August 2025Obligations for providers of general-purpose AI models, governance structure, confidentiality and penalty provisionsFoundation model providers and the EU's new AI Office and national authorities
2 August 2026Main application date: most remaining provisions, including high-risk system obligations under Annex III and transparency duties under Article 50Providers and deployers of high-risk AI systems, most SaaS vendors embedding AI features
2 August 2027Obligations for high-risk AI systems that are safety components of products already regulated under Annex I sectoral lawVendors supplying AI embedded in regulated hardware or machinery

Application dates under Regulation (EU) 2024/1689, set out in Article 113.

The AI Act entered into force on 1 August 2024, and will become fully applicable on 2 August 2026, with some provisions applying earlier and some sectoral obligations delayed to 2027.

What the 2025 milestones already require

Two 2025 dates are already behind us and already enforceable. From 2 February 2025, the prohibitions in Article 5 apply across the EU: practices such as social scoring by public authorities, certain forms of biometric categorisation, and manipulative AI that exploits vulnerabilities are simply banned, regardless of a vendor's size or sector. The same date brought AI literacy duties into force, requiring providers and deployers to ensure staff operating AI systems have a reasonable level of understanding of them. From 2 August 2025, obligations for providers of general-purpose AI models took effect, alongside the governance architecture: the AI Office, national competent authorities, and the penalty framework that will eventually back enforcement. None of this requires a vendor to publish a certificate. It requires internal policy, documentation and, for general-purpose model providers, technical documentation and copyright policy summaries that regulators can request.

What changes on 2 August 2026

This is the date most buyers actually mean when they ask whether the Act is in force, because it is when the obligations that look like a conventional compliance regime switch on for most SaaS vendors. From 2 August 2026, providers of high-risk AI systems listed in Annex III, think AI used in recruitment, credit scoring, education access or certain biometric uses, must run a conformity assessment, maintain a risk management system, keep technical documentation and logs, and register the system in the EU database before it goes to market. Transparency duties under Article 50 also apply more broadly: users must be told when they are interacting with an AI system such as a chatbot, and certain synthetic content must be labelled. Deployers, meaning the organisations buying and using these systems rather than building them, pick up their own obligations around human oversight and monitoring. This is also the date most member states are expected to have market surveillance authorities fully operational, since enforcement capacity has to exist before enforcement is meaningful.

Timeline graphic showing the EU AI Act's phased obligation dates from entry into force in 2024 through to 2027
One Regulation, five separate application dates, spread across 2024 to 2027.

Why ISO 42001 is showing up early

ISO/IEC 42001, the international standard for an AI management system, is not a legal requirement under the EU AI Act and certification against it does not by itself satisfy any article of the Regulation. What it does is give a vendor a structured way to show a risk management process, documented roles, monitoring of AI system performance, and a cycle of internal review, which overlaps substantially with what Annex III conformity assessment will expect from 2026 onward. That overlap is why a growing number of vendors are pursuing ISO 42001 certification now rather than waiting for the deadline, treating it as a head start on the paperwork the Act will eventually require rather than a substitute for it. Our earlier piece on what the ISO 42001 certificate actually covers goes through the scope statement in detail, including which parts of a vendor's AI stack are usually in scope and which are quietly excluded.

The standard sits alongside the vendor's existing security certifications rather than replacing them. A trust centre that lists ISO/IEC 42001 next to ISO 27001 and SOC 2 is signalling that AI governance has been folded into the same management system discipline as information security, which is a reasonable proxy for readiness even though it is not formal proof of Article 9 risk management compliance.

Miro's trust centre entry is a useful one to open side by side with the Act's timeline, not because of any specific date it shows but because of the range of evidence rows sitting on one page. Look at how the ISO/IEC 42001 row sits next to the ISO 27001 and SOC 2 Type II rows, whether the scope note names the product lines covered, and how the subprocessor list is maintained alongside the Data Privacy Framework listing. That combination is roughly what a buyer doing AI due diligence in 2026 should expect to find, evidence of a management system rather than a single certificate standing alone.

Miro logo

Miro · Trust report

Collaboration · Public evidence as of 26 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 8 vendor-stated.

1Documents and agreements

Legal and review documents Miro publishes or offers, as of 26 Oct 2026.

12Subprocessors

Named on Miro's public subprocessor list, last seen 26 Oct 2026.

Miro's trust centre lists ISO/IEC 42001 alongside ISO 27001, SOC 2 Type II and an active DPF listing. Every line is a dated public record from the Data Privacy Framework list and Miro's trust centre. A framework not shown means no public evidence was found, not that Miro lacks it.CertReports

How to check a vendor's AI governance evidence today

  1. 1

    Start with the regulation, not the vendor

    Read the EU AI Act regulation page first so you know which obligation date actually applies to the system you are buying, rather than assuming the Act is either fully live or fully dormant.

  2. 2

    Check the ISO 42001 framework page

    Use the ISO/IEC 42001 framework page to see which vendors in your shortlist carry a certificate and what scope statement comes with it.

  3. 3

    Open the trust centre

    Read the trust centre entry directly rather than relying on a sales deck; our guide on how to read a trust centre covers what each badge and report type actually means.
  4. 4

    Match the scope to your use case

    Confirm the certificate's scope statement covers the specific product or model you will deploy, not just the vendor's corporate entity.

  5. 5

    Ask what happens after August 2026

    Ask the vendor directly how it plans to meet Annex III conformity assessment and Article 50 transparency duties if its product falls into a high-risk category, since a current ISO 42001 certificate is preparation, not proof of that future compliance.

1 Aug 2024
Entry into force
Regulation (EU) 2024/1689, published in the Official Journal on 12 July 2024
2 Feb 2025
Prohibited practices apply
Article 5 bans and AI literacy duties under Article 4
2 Aug 2026
Main application date
High-risk Annex III obligations and Article 50 transparency duties
27
EU member states bound directly
No national transposition required, since it is a Regulation, not a Directive

What buyers should ask for between now and the 2026 deadline

  • Ask whether the vendor's AI features fall into a high-risk category under Annex III, and get that assessment in writing rather than a verbal assurance.
  • Ask for the current ISO 42001 scope statement if one exists, and confirm it names the specific product or model in question.
  • Check the vendor's SOC 2 report and ISO 27001 certificate for overlapping controls, since AI governance rarely stands apart from the rest of the information security programme.
  • Use Check my stack to see which regulations apply to your specific vendor list and what each vendor currently evidences against them.
  • Put a review date in your contract or vendor file for August 2026, so the question gets revisited rather than forgotten once the sales cycle closes.

A Regulation does not need a local law to bite

Unlike GDPR-adjacent national statutes that sometimes vary by member state, the EU AI Act applies the same text, on the same dates, in every EU country. A vendor cannot plausibly argue that its home market has not yet transposed the Act, because there is nothing to transpose.
Diagram mapping ISO 42001 management system clauses against EU AI Act high-risk system obligations
ISO 42001's risk management and monitoring clauses overlap with, but do not replace, Annex III conformity assessment.

Where this fits against the rest of the index

The AI Act is one of several EU regulatory regimes now showing up in vendor security reviews alongside more familiar frameworks. Our broader look at what 3,000 vendors actually publish found that AI-specific certifications remain rarer than SOC 2 reports or ISO 27001 certificates, which tracks with a standard still in its early adoption phase ahead of a 2026 deadline rather than an established baseline expectation. Treat an ISO 42001 certificate the way you would treat an early SOC 2 Type I report: useful evidence of intent and process, not proof that the full regime has been tested end to end.

People also ask

Is eu ai act in force?

Yes. Regulation (EU) 2024/1689 entered into force on 1 August 2024. It applies in stages rather than all at once: prohibited practices and AI literacy duties since 2 February 2025, general-purpose AI model obligations since 2 August 2025, and the main body of high-risk system rules from 2 August 2026, with a final sectoral tranche in 2027. Check the regulations page for the date that applies to a specific vendor's system.

Is eu ai act a regulation?

Yes, it is formally Regulation (EU) 2024/1689, not a Directive. That distinction matters because a Regulation applies directly in every EU member state on the same dates, with no national transposition law required. A Directive would have let each country implement it on its own schedule, which the AI Act does not allow.

What is eu ai act compliance?

Compliance depends on your role and the system's risk tier. Providers of unacceptable-risk systems face an outright ban. Providers and deployers of high-risk systems, listed in Annex III, face conformity assessment, risk management, logging and registration duties from 2 August 2026. Limited-risk systems carry transparency duties such as disclosing AI interaction. The regulations page sets these tiers out in full.

What is eu ai act 2026?

2 August 2026 is the Act's main application date. Most remaining provisions take effect on this day, including high-risk system obligations under Annex III, conformity assessment requirements, and the broader transparency duties in Article 50. It is the date most vendors mean when they talk about being ready for the AI Act, rather than the 2024 entry into force date.

What is the eu ai act 2025?

2025 was a transitional year with two live dates. From 2 February 2025, prohibited AI practices and AI literacy duties applied. From 2 August 2025, obligations for general-purpose AI model providers and the Act's governance structure, including the AI Office and penalty rules, took effect. The full high-risk regime most SaaS buyers care about did not start until 2026.

EU AI ActISO 42001AI governanceregulationsvendor evidence
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like