Regulatory Timeline

Audience: security and compliance leads, Data Protection Officers, and engineering leaders adopting AI on sensitive data in the EU and DACH region

---

The ground under AI adoption has moved quickly, and enforcement is now active and coordinated across EU supervisory authorities. This page is the single dated owner for the EU AI Act timeline across these docs; the other security pages summarize and link here so a date lives in one place. It tracks the developments most relevant to a team putting sensitive data through AI, with dates and sources, and what each one means in practice. It is background, not legal advice. For the section 203, CLOUD Act, and transfer detail, see Data Sovereignty.

Compiled from the sources listed on this page. The forward dates depend on the final published instruments; check the current EUR-Lex Official Journal record before relying on them. Background, not legal advice.

Timeline

23 May 2024: EDPB ChatGPT Taskforce report

The European Data Protection Board published the first coordinated EU position on the GDPR and generative AI, covering lawfulness, fairness, accuracy, transparency, and data-subject rights, and noting investigations across several member states. It signaled that the supervisory authorities were treating generative AI as a live GDPR matter, not a future one.

1 August 2024: EU AI Act enters into force

The EU AI Act became law, with obligations phasing in over the following years. Prohibited practices (Article 5) and AI-literacy duties (Article 4) applied from 2 February 2025, obligations for general-purpose AI from 2 August 2025, and, on the original timeline, most high-risk-system obligations from 2 August 2026, with later transition dates for some categories. The high-risk dates are revised by the Digital Omnibus (see the entry below); check the current EUR-Lex Official Journal record for the exact dates. The February 2025 prohibited-practice and AI-literacy duties are not affected.

December 2024: EDPB opinion on personal data in AI models

The EDPB adopted Opinion 28/2024 (17 December 2024) on how the GDPR applies to personal data used to build and run AI models, addressing when a model can be considered anonymous, the use of legitimate interest as a legal basis, and the consequences of unlawful processing in the training data. It set expectations that reach the data you send to a model, not just the model itself.

20 December 2024: Garante fines OpenAI EUR 15 million

The Italian supervisory authority (Garante) issued one of the first major GDPR fines against a generative AI provider, citing the lack of an adequate legal basis for training-data processing, a failure to notify a 2023 breach, and weak age verification, and it ordered a public awareness campaign. OpenAI is appealing and the final outcome is still being litigated. The durable point stands regardless of the amount: a DPA enforced the GDPR directly against a generative AI provider.

30 January 2025: Garante limits DeepSeek, and DACH follows

The Garante ordered an immediate limitation on the processing of Italian users' data by the operators of DeepSeek, and the app was removed from the Italian Apple and Google stores. A German data-protection authority asked Apple and Google to remove it from German stores over transfers of personal data to China, and the Netherlands restricted it on government devices. Several other member states opened their own probes.

3 September 2025: the Data Privacy Framework is upheld, for now

The EU General Court dismissed the Latombe challenge to the EU-US Data Privacy Framework, so the transfer basis remains valid. An appeal to the Court of Justice is pending, and a separate challenge continues, so the durability of the framework is not settled (see Data Sovereignty).

The Digital Omnibus revision of the high-risk deadlines

The Digital Omnibus revises the EU AI Act high-risk applicability dates. Under it, the stand-alone Annex III high-risk obligations and the high-risk AI embedded in Annex I regulated products move to later dates. The Article 4 AI-literacy and Article 5 prohibited-practice duties, in force since 2 February 2025, are not affected.

Check the current EUR-Lex Official Journal record for the exact dates and the final scope before relying on them.

2 August 2026: original EU AI Act high-risk date (revised by the Digital Omnibus)

On the original timeline, most obligations for high-risk AI systems, including the Article 10 data-governance requirements, applied from this date. The Digital Omnibus (above) revises the stand-alone Annex III high-risk obligations to a later date; treat the change as runway, not a cancellation. The Article 50 transparency obligations were not among the revised high-risk items. Check the current Official Journal record on EUR-Lex for the final scope and the exact dates before relying on them.

Further Digital Omnibus milestones

The Digital Omnibus package sets further milestones, including additional prohibited-practice provisions and the end of the Article 50(2) transition for synthetic-content systems already on the market. Check the current EUR-Lex Official Journal record for the exact scope and dates before relying on them.

What this means in practice

• Enforcement is active and coordinated. The first GenAI GDPR fine and the DeepSeek actions show supervisory authorities acting quickly and together, and app-store and device-level restrictions show the measures are not only monetary.
• The transfer basis is not settled. Relying on the Data Privacy Framework alone carries the risk that a future ruling moves the ground, as it did twice before.
• Data minimization is the durable response. The less identifiable data you send to a model, the less exposed you are to any single rule changing, which is why the supervisory authorities point to technical measures alongside contracts.

Where OGuardAI fits, honestly: it does not make you compliant and it does not replace a data processing agreement, a transfer assessment, or legal counsel. It narrows what leaves your runtime by tokenizing detected identifiers before the request reaches a model, which is one technical data-minimization measure inside the assessment you still own. See Approaches for how that compares to the alternatives and Trust for the honest posture.

Sources

• EDPB, Report of the work undertaken by the ChatGPT Taskforce (23 May 2024).
• EDPB Opinion 28/2024 on personal data in AI models (17 December 2024).
• Garante, decision fining OpenAI EUR 15 million (20 December 2024).
• Garante, limitation order on DeepSeek operators (30 January 2025) and subsequent DACH actions.
• EU General Court, dismissal of the Latombe challenge to the EU-US Data Privacy Framework (3 September 2025).
• Council of the EU, public statements on the Digital Omnibus proposal to simplify and streamline the AI Act rules (check the current EUR-Lex Official Journal record).
• Regulation (EU) 2024/1689 (EU AI Act), application dates, as revised by the Digital Omnibus (check the current EUR-Lex Official Journal record for the exact dates).