The current EU AI Act timeline: what Turkish manufacturers need to be ready for, and when
The dates changed by the Omnibus regulation, how the Act reaches companies outside the EU, which industrial systems count as high-risk, and what that means on the engineering side.
Author:Caner OnatCo-Founder & CTO7 min read
Short answer: The EU AI Act (Regulation 2024/1689) entered into force on 1 August 2024 and applies in stages. The Omnibus regulation published in July 2026 (Regulation 2026/1744) postponed the dates for high-risk systems: 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for high-risk systems embedded in products. Turkish companies that sell products on the EU market, or that develop a system whose output is used in the EU, are also in scope.
Many Turkish-language sources still repeat the pre-Omnibus timeline. This post compiles the current timeline from the official texts and summarises what an industrial company should look at, and when. It is not legal advice; assess your own situation with your legal counsel.
Current timeline
| Date | What applies |
|---|---|
| 2 February 2025 | Prohibited practices and AI literacy (Art. 4) |
| 2 August 2025 | Obligations for providers of general-purpose AI models |
| 2 August 2026 | General application of the Act, transparency obligations (Art. 50) |
| 2 December 2026 | Marking of generated content for systems placed on the market before 2 August 2026 (Art. 50(2)); new prohibitions on generating non-consensual intimate content and child sexual abuse material |
| 2 December 2027 | Stand-alone high-risk systems in Annex III (areas such as recruitment, education, creditworthiness) |
| 2 August 2028 | High-risk systems embedded in products covered by the product legislation in Annex I |
The Omnibus regulation was published in the Official Journal of the EU on 24 July 2026 and entered into force on 27 July 2026. The original date was 2 August 2026 for Annex III and 2 August 2027 for Annex I.
How does it reach a Turkish company?
The Act does not look at where the provider is established. Three routes stand out:
- Placing on the market (Art. 2(1)(a)): A provider that places an AI system on the EU market or puts it into service there is in scope even if established outside the EU.
- Output used in the EU (Art. 2(1)(c)): Even if the system runs in Türkiye, providers and deployers are in scope when the output it produces is used in the EU.
- Authorised representative (Art. 22): A provider established outside the EU that makes a high-risk system available on the EU market must appoint an authorised representative established in the EU.
In practice the most common effect is indirect: the EU customer passes its own compliance obligations on to its Turkish supplier through the supply contract. Requests for technical documentation, record-keeping and change notification arrive this way.
Which industrial systems are high-risk?
High risk comes from two sources.
Annex III (stand-alone systems): Specific areas of use are listed: recruitment and employee evaluation, education, creditworthiness, critical infrastructure and others. In an industrial company the system that most often falls into this category is an HR system used for screening candidates or evaluating performance.
Annex I (systems embedded in products): AI systems that are the safety component of a product covered by EU product legislation, such as machinery, lifts, medical devices or toys, or that are the product itself. The date for these is 2 August 2028.
Machinery deserves a separate note. The Omnibus moved machinery legislation from Section A to Section B of Annex I of the Act. This means the requirements for AI in machinery will come not directly from the AI Act but from provisions to be added to the Machinery Regulation (Regulation 2023/1230). The Machinery Regulation applies from 20 January 2027, and its Annex I lists, as a specific category, safety components with fully or partially self-evolving behaviour using machine learning approaches that ensure safety functions.
A visual quality inspection system on a production line generally does not fall into these categories on its own if it does not perform a safety function. If the system takes on a safety function (for example, detection that protects an operator), the assessment changes.
The literacy obligation has changed
Article 4 was rewritten by the Omnibus. The old text required providers and deployers to ensure a "sufficient level" of AI literacy among their staff. The new text requires them to take measures to support the development of AI literacy and does not expect them to guarantee any specific level. The Commission and the Member States were given the task of supporting, in particular, SMEs and publishing practical examples.
In practice this does not mean the obligation has gone. A short, role-specific training for teams that use AI systems, an internal document explaining which system decides what, and a record of both, are a reasonable start.
Transparency: chat assistants and generated content
Article 50 has applied since 2 August 2026. A system that interacts directly with users (for example a chat assistant on a website) must be designed so that users know they are talking to an AI. Systems that generate text, images, audio or video must mark their output in a machine-readable way as artificially generated. For systems placed on the market before that date, the marking deadline is 2 December 2026.
Penalties
The upper limit for prohibited practices is EUR 35 million or 7 percent of worldwide annual turnover; for most other obligations it is EUR 15 million or 3 percent (Art. 99). For SMEs the lower of the two amounts applies; the Omnibus extended this rule to small mid-cap companies for certain tiers.
What it means on the engineering side
What the Act requires for high-risk systems largely overlaps with what a well-built AI project should produce anyway:
- Risk management (Art. 9): A written analysis of how the system can fail and in which conditions.
- Data governance (Art. 10): Documenting the source, representativeness and quality of training, validation and test data.
- Technical documentation (Art. 11) and record-keeping (Art. 12): Being able to trace how the system was built and which decisions it makes while running.
- Human oversight (Art. 14): The point at which a decision can be seen and stopped by a person.
- Accuracy and robustness (Art. 15): Measuring performance and maintaining it over time.
That is why preparation for the Act should be treated not as paperwork added later but as the way the project is built from the start. Evaluation sets, version control and monitoring are the technical backbone; we describe our work in this area on the MLOps and AI Security pages.
The situation in Türkiye
As of November 2026 there is no AI-specific law in force in Türkiye; bills have been submitted to parliament. The AI Action Plan (2026-2030), published in the Official Gazette on 18 August 2026, is a policy document. AI systems that process personal data are already covered by the Turkish data protection law (KVKK) today.
Frequently asked questions
We do not export to the EU, but we develop software for an EU customer. Are we in scope? If the system's output is used in the EU, most likely yes. Which obligations fall on you depends on your role (provider or deployer) and the risk class of the system.
Is a visual quality inspection system on a production line high-risk? Generally not, if it does not perform a safety function. If the system works as a safety component of a machine, the Machinery Regulation and the Annex I route apply.
Has the literacy obligation been removed? No. The obligation to "ensure a sufficient level" became an obligation to "take measures to support its development".
When should preparation for high-risk systems begin? Technical documentation and record-keeping are hard to add afterwards. For a new project, from today; for an existing system, at least a year before the relevant date.
