PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
As of 13 October 2026, the EU AI Act and Cyber Resilience Act (CRA) are on different implementation tracks. The AI Act applies in stages: its general application date was 2 August 2026, while high-risk obligations for many systems arrive on 2 December 2027 or 2 August 2028. The CRA entered into force on 10 December 2024, began applying reporting duties on 11 September 2026, and reaches full application on 11 December 2027. Dates alone do not decide whether a particular product, model, organisation or use is covered; you must first classify the technology and the actor’s role under the relevant law.
EU AI Act and CRA timelines at a glance
These regulations address different regulatory objects. The AI Act establishes a risk-based framework for AI systems and general-purpose AI models. The CRA is a horizontal cybersecurity law for hardware and software products with digital elements made available on the EU market. A product can raise obligations under both, but compliance with one does not automatically satisfy the other.
| Comparison | EU AI Act | Cyber Resilience Act |
|---|---|---|
| Main subject | AI systems and general-purpose AI models, organised by risk and use | Hardware and software products with digital elements made available on the Union market |
| Implementation pattern | Several phases, with provisions already applying and high-risk dates delayed for different categories | Early provisions for conformity-assessment bodies and reporting, followed by broad application in December 2027 |
| Primary starting resource | AI Act Service Desk timeline and FAQs | European Commission CRA implementation page and Regulation (EU) 2024/2847 |
| First classification question | Which AI-system or model category, risk level and provider, deployer or other role applies? | Whether the item is a product with digital elements and which manufacturer, importer, distributor or other actor duties apply |
The dates in the table are legal milestones published by the European Commission and its AI Act Service Desk, not statistical forecasts or a case-specific legal opinion.
EU AI Act timeline
The Commission’s implementation schedule contains several effective dates. The AI Omnibus entered into force on 27 July 2026 and changed the schedule for certain high-risk obligations. Older material that places all high-risk requirements in August 2026 or August 2027 is therefore incomplete unless it explains those changes.
| Date | Milestone | Practical meaning |
|---|---|---|
| 1 August 2024 | AI Act entered into force | The regulation became part of EU law, while most obligations followed its staged timetable. |
| 2 February 2025 | Prohibitions, definitions and AI-literacy provisions began applying | Organisations must assess prohibited practices and the literacy duties relevant to people operating or using AI systems. |
| 2 August 2025 | Governance rules and general-purpose AI model obligations began applying | Governance arrangements and duties for providers of general-purpose AI models entered the schedule before the general application date. |
| 2 August 2026 | General application date for most remaining provisions | Most provisions not assigned a later date apply. Transparency rules and enforcement for provisions applicable on this date also start. |
| 2 December 2026 | Additional prohibitions apply; a transition ends for certain pre-existing systems’ Article 50(2) marking and detection duties | Providers of systems already placed on the market before 2 August 2026 should check whether the stated transition applies to their system and obligations. |
| 2 December 2027 | High-risk systems in Annex III | The Annex III high-risk regime applies on this date under the current Commission schedule. |
| 2 August 2028 | High-risk AI embedded in Annex I regulated products | High-risk AI incorporated into products regulated under the Annex I legislation follows this later date. |
What already applies
By October 2026, the prohibitions, definitions and AI-literacy provisions have applied since 2 February 2025. Governance rules and obligations for general-purpose AI models have applied since 2 August 2025. The 2 August 2026 general application date has passed, so provisions assigned to that date—including the relevant transparency and enforcement provisions—are no longer future deadlines.
The 2 December 2026 milestone is narrower than the general application date. It covers certain new prohibitions and the end of a transition for specified providers of systems placed on the market before 2 August 2026. Do not treat it as a second general start date or assume that every AI provider has a new obligation on that day.
Why the high-risk dates differ
The current schedule separates high-risk AI systems in Annex III from high-risk AI embedded in Annex I regulated products. Annex III systems have a 2 December 2027 application date. AI that is part of an Annex I regulated product has a 2 August 2028 date. These dates reflect the AI Omnibus changes that entered into force on 27 July 2026.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
Neither date answers the classification question by itself. A provider must determine whether its system meets the relevant high-risk definition, whether an exception or transition applies, and which obligations attach to its role. The Commission’s timeline gives the dates; the regulation and official guidance determine the legal conditions.
Cyber Resilience Act timeline and scope
The CRA is Regulation (EU) 2024/2847. The Commission describes it as a horizontal framework for hardware and software products with digital elements made available on the Union market. The scope includes relevant remote data-processing solutions and separately placed software or hardware components. It is therefore broader than a rule aimed only at a device manufacturer or only at software code.
| Date | CRA milestone | What to check |
|---|---|---|
| 10 December 2024 | CRA entered into force | Use the regulation’s definitions and transition provisions when deciding whether a product is in scope. |
| 11 June 2026 | Provisions concerning notification of conformity-assessment bodies begin applying | Assessment infrastructure and notified-body processes become subject to the applicable CRA rules. |
| 11 September 2026 | Article 14 reporting obligations begin applying | Covered manufacturers must follow the CRA’s reporting process for the incidents and vulnerabilities specified by Article 14. |
| 11 December 2027 | Full application of the CRA | The broad body of CRA obligations applies, subject to the regulation’s own transitional details. |
What the CRA regulates
The CRA follows the product placed on the Union market rather than an AI risk category. Its core subject is a product with digital elements: hardware, software, relevant remote data-processing solutions, and separately placed components that meet the regulation’s scope. The responsible actor depends on the supply chain, so manufacturers, importers and distributors should map their roles before choosing a conformity route.
Rank #3
Manufacturers are expected to perform a cybersecurity risk assessment and take its results into account throughout product planning, design, development, production, delivery and maintenance. That lifecycle approach means a launch checklist alone is insufficient. Vulnerability handling, updates, documentation and post-market processes need owners and evidence that can be maintained after release.
Reporting from 11 September 2026
Article 14 reporting obligations began on 11 September 2026. A company selling a covered product should establish an internal route for identifying the events and vulnerabilities that trigger reporting, recording the required information and meeting the applicable deadlines. The implementation page lists guidance and standardisation work, but projected deliverables can change; use the page’s current timeline and the regulation itself when setting procedures.
How the AI Act and CRA differ
Different objects and tests
The AI Act asks what kind of AI system or general-purpose AI model is being provided or used, what risk category applies and which organisation has the relevant role. The CRA asks whether a product with digital elements is made available on the Union market and which economic operator has the duties attached to that product. An AI-enabled appliance, industrial controller or software service can therefore require two separate analyses.
Different deadline shapes
The AI Act has a sequence of already-applicable provisions, a general application date, a December 2026 transition milestone and two later high-risk dates. The CRA has a shorter sequence: entry into force, conformity-assessment-body provisions, reporting from September 2026 and full application in December 2027. Do not collapse either schedule into one “EU technology compliance” deadline.
When both laws may matter
Dual applicability is possible where a product contains or provides an AI system and is also a product with digital elements. The AI Act may govern the AI system’s risk, transparency, governance or model duties, while the CRA governs the product’s cybersecurity design, vulnerability handling, reporting and conformity obligations. The two regimes remain legally distinct, and satisfying a CRA requirement does not prove conformity with the AI Act.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsA practical timeline workflow for organisations
- Inventory the technology. Record each AI system, general-purpose model, software component, device and remote data-processing function, along with where and when it is made available in the EU.
- Assign legal roles. Identify provider, deployer, manufacturer, importer, distributor and any other role that the applicable regulation uses. Contract labels do not replace the statutory definitions.
- Classify before scheduling. For AI, determine whether the system is prohibited, subject to transparency, high-risk under Annex III, embedded in an Annex I product or a general-purpose model. For the CRA, determine whether the item is a product with digital elements and which conformity and supply-chain duties apply.
- Map each obligation to its effective date. Use the AI Act dates of 2 February 2025, 2 August 2025, 2 August 2026, 2 December 2026, 2 December 2027 and 2 August 2028 where relevant. Use the CRA dates of 10 December 2024, 11 June 2026, 11 September 2026 and 11 December 2027.
- Build evidence, not just policy. Keep risk assessments, technical documentation, governance records, literacy measures, transparency notices, vulnerability processes, update records and reporting decisions in a retrievable form.
- Review transitions and updates. Check whether a product or system was placed on the market before a stated cutoff, whether an Omnibus amendment changed the schedule and whether new Commission guidance or harmonised standards affect the implementation path.
- Escalate uncertain classifications. A timeline page cannot decide a borderline case. Obtain qualified legal or conformity-assessment advice when the classification, exemption or transition changes the required controls.
Official resources and how to use them
AI Act timeline and legislation
Start with the AI Act Service Desk timeline for the milestone list. Pair it with the Commission’s AI Act policy page for the broader regulatory framework and links to implementation material. The timeline is a navigation aid; the legal text controls the obligation.
Best Value
AI Act guidance, FAQs and resources
The Commission’s Navigating the AI Act page addresses implementation questions, including enforcement and the Digital Omnibus. The Service Desk’s enforcement FAQ helps explain when enforcement begins for provisions with different application dates. The Service Desk resources page collects legislation, policy documents and communication material.
The Commission’s AI Pact is a voluntary preparation and exchange initiative. Participation can support readiness, but it is not a substitute for binding AI Act duties and does not change an organisation’s legal classification.
CRA implementation and legal text
Use the Commission’s CRA implementation page for the current timeline, implementation actions, guidance and standardisation work. Because projected deliverables can move, record the page’s update date when you rely on a milestone. For the binding requirements, consult Regulation (EU) 2024/2847 in the Official Journal.
The Commission’s CRA legislative summary is useful for orientation and states that the CRA is a horizontal framework applying to hardware and software products with digital elements made available on the Union market. The page expressly says it is not representative of the Commission’s official position, so use the regulation for authoritative interpretation.
Common timeline mistakes to avoid
- Using an obsolete high-risk date: the current Commission schedule places Annex III obligations on 2 December 2027 and Annex I product obligations on 2 August 2028 after the AI Omnibus changes.
- Treating 2 August 2026 as the only AI Act deadline: several duties applied earlier, a transition ends on 2 December 2026, and the two high-risk categories have later dates.
- Calling the CRA an AI law: its scope is products with digital elements, whether or not they contain AI.
- Assuming “entered into force” means “all duties apply”: both regulations separate entry into force from application dates.
- Relying on a summary instead of the legal text: summaries and implementation pages explain the framework but cannot replace the regulation’s definitions, exceptions and transition rules.
- Assuming one conformity result covers both laws: AI Act and CRA assessments address different legal questions, even where the same product is involved.
The Bottom Line
Track the AI Act and CRA separately: classify the technology first, then map each applicable obligation to its exact effective date. For current changes, use the Commission’s AI Act Service Desk and CRA implementation pages, and verify decisive requirements in the regulations themselves.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
