Deadlines are not a matter of opinion - planning starts from the original sources.
What it is about
Obligations for stand-alone high-risk AI apply from 2 December 2027, for high-risk AI in products from 2 August 2028. TISAX assessments commissioned from 1 January 2027 use the new VDA ISA2027 audit catalogue.
For AI in regulated environments these two frameworks matter most: the EU AI Act and, in the automotive industry, TISAX. The basis is primary sources, not studies: the regulation text via the European Commission’s AI Act Service Desk (consolidated version as at 27 July 2026) and the announcements of the ENX Association, which runs TISAX itself. Not legal advice.
What applies
- Fines: Violations of the AI prohibitions (Art. 5) can cost up to EUR 35 million or 7% of worldwide annual turnover, other breaches up to EUR 15 million or 3% (Art. 99). These are maximum amounts set by the member states; for SMEs the lower amount applies.
- Stand-alone high-risk systems (Annex III): After the Digital Omnibus, the obligations apply from 2 December 2027 instead of August 2026.
- High-risk AI in products (Annex I), for example under vehicle or machinery regulation: from 2 August 2028. The Council confirmed final adoption of the Digital Omnibus on 29 June 2026.
- TISAX: Assessments commissioned from 1 January 2027 use the new VDA ISA2027 catalogue. AI is not covered separately - GenAI risks are mapped onto existing controls. ENX announced this in July 2026. In December 2025, more than 20,000 locations worldwide held a valid TISAX label for the first time, over 10,000 of them in Europe - the count is of locations, not companies (ENX count).
What we make of it
More time for high-risk obligations is no reason to wait: inventory, roles and transparency can be settled today and are the basis for everything else. How we do this in projects is described in What the EU AI Act means for your engineering and TISAX meets GenAI.
The studies in detail
Selection: only studies with a disclosed method - experiments, official statistics, legal texts, independent institutes. Vendor surveys about their own product and consultancy forecasts are not included here.
- 35 Mio. EUR / 7%
European Commission (AI Act Service Desk) · 2024 · Legal textindependent
Breaches of the AI Act's prohibited practices (Art. 5) can be fined up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher; other obligations up to EUR 15 million or 3%.
Limits: These are maximum amounts. For SMEs the lower of the two figures applies (Art. 99(6)), and the fines are set by member states.
AI Act, Article 99: Penalties ↗We use it in: What the EU AI Act means for your engineering · AI governance without bureaucracy
- 2. Dezember 2027
European Commission (AI Act Service Desk) · 2026 · Legal textindependent
After the Digital Omnibus, obligations for stand-alone high-risk AI systems under Annex III apply from 2 December 2027 instead of August 2026.
Limits: Based on the EUR-Lex consolidated version as at 27 July 2026. The legally binding text is on EUR-Lex.
AI Act, Article 113: Entry into force and application (consolidated as at 27 July 2026) ↗We use it in: What the EU AI Act means for your engineering
- 2. August 2028
European Commission (AI Act Service Desk) · 2026 · Legal textindependent
For high-risk AI embedded in products under Annex I (e.g. product safety legislation), obligations apply only from 2 August 2028 after the Digital Omnibus.
Limits: The Council confirmed final adoption on 29 June 2026 (consilium.europa.eu omnibus timeline page). Check whether Annex I covers the specific product.
AI Act, Article 113: Entry into force and application (consolidated as at 27 July 2026) ↗We use it in: What the EU AI Act means for your engineering · TISAX meets GenAI
- 1. Januar 2027
ENX Association · 2026 · Legal textindependent
The new VDA ISA2027 catalogue applies to all TISAX assessments ordered from 1 January 2027 onwards (ENX, July 2026).
Limits: The announcement names new controls for prototype part traceability and disposal, and does not mention AI. GenAI risks therefore have to be mapped onto existing ISA controls.
10 Years of TISAX - VDA ISA2027 Released ↗We use it in: TISAX meets GenAI
- 20.000+
ENX Association · 2025 · Official statisticindependent
In December 2025, more than 20,000 locations worldwide held a valid TISAX label for the first time (ENX Association).
Limits: Counts locations, not companies. Over 10,000 of them are in Europe.
Milestone for Information Security: TISAX Surpasses 20,000 Locations ↗We use it in: TISAX meets GenAI
