Playbook 2 — What's Already Live

The AI Act phased in, so the useful question is not whether it applies but which parts are already enforceable. Read as a calendar, it splits cleanly into what is due now and what sits on a runway.

Already live. The prohibition on unacceptable practices and the duty of AI literacy — ensuring staff who work with AI have a sufficient understanding of it — took effect in February 2025. Obligations for providers of general-purpose AI models, the large foundation models behind many tools, came into force in August 2025. The transparency duties took effect in August 2026. Those last ones are the ones most SMBs meet, because they attach to the limited-risk systems a company is most likely to run.

Still ahead. The main high-risk obligations land in December 2027, though the Digital Omnibus agreed in May 2026 moved that date once already. High-risk systems embedded as safety components in regulated products — medical devices, machinery, toys — have until August 2028. Watermarking for AI-generated content and two new prohibitions take effect December 2026 regardless of company size. Treat the calendar as current but moving; the Commission is still issuing guidance through this period.

The penalties are the reason the calendar matters. Breaches run to a tiered scale, and the top tier reaches €35 million or 7% of global annual turnover, whichever is higher — the same order of magnitude as the GDPR’s ceiling. That figure applies to the most serious breaches, not to a missed disclosure, but it is the number that should stop a company treating the near-term duties as optional.

Two things to do with this.

First, separate your list by date. Anything in a limited-risk tier with a live transparency duty belongs in this quarter. Anything high-risk goes on a deliberate runway with a date before December 2027, because notified-body capacity for the assessments that may be required is expected to tighten as that deadline approaches. Starting in late 2026 avoids the crunch.

Second, do not read the calendar as permission to wait. The parts already live include the cheapest obligations to meet — a notice, a label, a short literacy briefing — and the most expensive to ignore, because they are the ones a customer or a regulator can point to today.

A calendar check:

• Prohibited practices and AI-literacy duty: are staff briefed?
• Transparency duties: are your customer-facing AI uses disclosed?
• High-risk uses: do they have an owner and a pre-December-2027 plan?
• Watermarking and the newest prohibitions: on the December 2026 list?
• Someone owns the calendar, so a moving date does not go unnoticed.

This is general information, not legal advice.

Next: Playbook 3 shows what you have already written counts toward ISO 42001.