AI regulation timeline and key dates

AI regulation in the UK and EU is moving on different timelines. If your business develops or deploys AI systems, you need to track dates across multiple jurisdictions and regulators.

EU AI Act milestones

The EU AI Act affects UK businesses in two main ways. First, if you sell AI products or services to EU customers, you must comply with the Act's requirements for your risk category. Second, the Act's classification system and conformity assessment procedures are likely to influence UK regulatory expectations over time, even without direct transposition.

Businesses that export AI systems to the EU should begin compliance work well ahead of each deadline. The high-risk AI system requirements, which apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI in regulated products, involve conformity assessments, technical documentation, and registration in the EU database — processes that take months to complete.

UK regulatory milestones

Key UK dates already in force

• 5 February 2026: Data (Use and Access) Act 2025 data protection provisions commenced, with rules on automated decision-making and recognised legitimate interests
• 17 March 2025: Online Safety Act 2023 illegal-content compliance duties took effect — platforms must conduct risk assessments and take proactive measures, including for AI-generated content
• January 2025: Digital Markets, Competition and Consumers Act 2024 CMA powers commenced — Strategic Market Status designations can now be made for large AI-powered platforms

Expected UK milestones

• 2026 (expected): AI Bill introduced to Parliament — expected to place the five AI principles on a statutory footing and strengthen regulator mandates
• 2026 (expected): Statutory code on AI and automated decision-making from the Information Commission (formerly the ICO) — will provide binding guidance under DUAA 2025 powers
• 2026 (expected): Product Regulation and Metrology Act 2025 secondary legislation — may bring AI-enabled products within scope of product safety regulation
• 2026-2027 (expected): Government response on AI and copyright — will set rules on text and data mining, transparency obligations, and creator opt-out mechanisms

Penalties reference

Penalty regimes are already in force across all the regulators listed above. You do not need to wait for the AI Bill to face enforcement action. If your AI system breaches existing data protection, consumer protection, financial services, health and safety, or equality law, the relevant regulator can act now using its current powers.

The EU AI Act introduces its own penalty regime for non-compliance, with fines of up to 35 million euros or 7% of global annual turnover for prohibited AI practices. UK businesses selling into the EU market should factor these into their compliance planning.