Deadlines and fine caps in the AI Act and GDPR
Short answer
The GDPR has applied since 25 May 2018. The AI Act's prohibitions and AI literacy requirement apply from 2 February 2025, the transparency duty for chatbots and AI content from 2 August 2026, and the requirements for high-risk AI in Annex III from 2 December 2027 under the Digital Omnibus. The fine caps go up to €35 million or 7% of global turnover.
Deadlines
| Date | What applies |
|---|---|
| 25 May 2018 | GDPR applies, including Art. 22 on automated decisions and Art. 35 on DPIAs. (GDPR) |
| 2 February 2025 | The rules on prohibited AI practices and AI literacy apply. (Art. 4 and 5 AI Act) |
| 2 August 2026 | Transparency duties for chatbots and AI-generated content apply. (Art. 50 AI Act) |
| 2 December 2027 | Requirements for the use of high-risk AI (e.g. recruitment and HR cases) apply. (Art. 26 and Annex III AI Act (Digital Omnibus)) |
Fine caps
| Infringement | Maximum fine | Legal basis |
|---|---|---|
| Prohibited use of AI | €35 million or 7% of global turnover | Art. 99(3) AI Act |
| Other AI Act requirements, e.g. human oversight, logs and transparency | €15 million or 3% | Art. 99(4) AI Act |
| Automated decisions, data subjects' rights and transfers outside the EU | €20 million or 4% | Art. 83(5) GDPR |
| E.g. a missing DPIA or data protection by design | €10 million or 2% | Art. 83(4) GDPR |
The fine caps are the highest amounts the law allows. Lower caps can apply to small and medium-sized businesses. Read more about the deadlines in AI Act Article 4.