The rules for AI in Germany and the EU, in one timeline.
From the AI Act to the new Product Liability Act, obligations on companies that use and build AI arrive in stages. This page lists what applies when, who it affects and what evidence it asks for.
What applies when.
Status as of November 2026. This is an overview, not legal advice.
- 1 August 2024In force
EU AI Act enters into force
Regulation (EU) 2024/1689. Its obligations apply in stages over the following years.
- 17 January 2025In force
DORA applies
Digital operational resilience for financial entities, including oversight of ICT third-party providers such as AI vendors.
- 2 February 2025In force
AI Act: prohibited practices and AI literacy
Prohibited AI practices are banned. Providers and deployers must ensure their staff have sufficient AI literacy.
- 2 August 2025In force
AI Act: general-purpose AI models
Obligations for providers of general-purpose AI models apply.
- 24 July 2026In force
AI Act Omnibus published
Regulation (EU) 2026/1744 moves the high-risk deadlines: Annex III to 2 December 2027, Annex I to 2 August 2028.
- 29 July 2026In force
German AI Market Surveillance Act (KI-MIG)
The Bundesnetzagentur becomes the market surveillance authority for AI in Germany.
- 11 September 2026In force
Cyber Resilience Act: reporting
Manufacturers of products with digital elements must report actively exploited vulnerabilities.
- 14 October 2026In force
EN 18286:2026 harmonised
The first harmonised standard under the AI Act. Conformity gives a presumption of compliance with the obligations it covers, starting with quality management.
- 9 December 2026Upcoming
Product Liability Act 2026
Software and AI are products under strict liability. Courts can order disclosure of technical documentation and presume a defect when it is withheld.
- 20 January 2027Upcoming
Machinery Regulation (EU) 2023/1230
New safety rules for machinery, including machinery with self-evolving behaviour.
- 2 December 2027Upcoming
AI Act: high-risk systems in Annex III
Obligations for high-risk uses such as creditworthiness, insurance pricing, recruitment and education.
- 11 December 2027Upcoming
Cyber Resilience Act: main obligations
Security requirements for products with digital elements across their life cycle.
- 2 August 2028Upcoming
AI Act: high-risk systems in Annex I
Obligations for AI that is part of products already regulated by EU product-safety law.
The evidence behind each rule.
Most obligations come down to the same few questions: what AI do you run, who controls it, what did it do, and can you prove it.
- AI Act, deployers
- AI literacy, human oversight, logs for high-risk systems and transparency towards people. Govern keeps the inventory, the policies and the logs.
- AI Act, providers
- Quality management, technical documentation and post-market monitoring, with EN 18286 as the harmonised route. Govern maps the evidence.
- Product Liability Act 2026
- Documentation you can disclose when a court asks. Assure turns the same evidence into a certificate and cover.
- DORA
- A register and oversight of ICT third-party providers, including AI services. Financial services
- GDPR
- Lawful basis, data minimisation and control over personal data in prompts. The AssurAI model detects it in flight.
By industry
See where you stand.
We map your AI estate against the timeline and list the gaps, starting with what applies first.
Request a demo