AI Act Compliance Deadlines 2025–2027: What Professional Services Firms Must Do Now

The EU AI Act is no longer a distant regulatory prospect. It is live, its deadlines are moving, and enforcement is accelerating. For professional services businesses — whether you are a law firm in London, an accounting practice in Dubai, an HR consultancy in Toronto, or a marketing agency in Amsterdam — the question is no longer whether this regulation affects you. It is whether you are prepared.

This briefing sets out what is already in force, what is coming, and what your organisation should be doing right now.

The Regulatory Timeline You Cannot Afford to Ignore

The EU AI Act entered into force on 1 August 2024, triggering a structured rollout of obligations that will reach full implementation by 2027. The phased timeline is deliberate, but it is not forgiving. Each deadline carries real compliance weight.

February 2025 — already in effect. Prohibitions on the most harmful AI practices have applied since 2 February 2025. These include bans on social scoring systems, emotion recognition in workplaces and educational institutions, and the untargeted scraping of facial images from the internet to build biometric databases. If your business uses any AI tools that touch these areas, you are already in scope. Ignorance of the ban is not a defence.

August 2025 — governance obligations for general-purpose AI. From 2 August 2025, providers of general-purpose AI (GPAI) models — the large-scale systems underpinning tools like ChatGPT and many enterprise AI platforms — must have robust governance frameworks in place. Member States are simultaneously required to designate national competent authorities and establish penalty frameworks. This is when the enforcement infrastructure becomes operational across the EU.

August 2026 — the major deadline for most businesses. The bulk of the AI Act's substantive rules come into force on 2 August 2026. This includes all requirements relating to high-risk AI systems, which are defined in Annex III of the Act and cover sectors including healthcare, education, employment, and critical infrastructure. If your firm uses AI in recruitment, HR decision-making, client risk assessment, or legal analytics, there is a meaningful probability that these provisions apply to you.

August 2027 — full implementation. Rules governing high-risk AI embedded in regulated products round out the Act's full application.

The financial exposure is significant. Prohibited AI practices can attract fines of up to €35 million or 7% of global annual turnover. Breaches of high-risk AI requirements carry penalties of up to €15 million or 3% of global turnover. These are not notional figures. European regulators have already demonstrated both the appetite and the machinery to impose substantial fines.

GDPR Enforcement Is Already Running at Full Speed

While the AI Act introduces a new compliance framework, the General Data Protection Regulation continues to be enforced with increasing focus on AI-specific violations. The two frameworks do not operate in isolation — they overlap, and gaps between them create compounded risk.

Clearview AI is the most instructive example. In September 2024, the Dutch Data Protection Authority fined the company €30.5 million for scraping billions of facial images without consent to build a biometric database. This is one sanction within a broader pattern; cumulative European fines against Clearview now exceed €100 million. The conduct at issue — mass data collection without lawful basis — is precisely what the AI Act's February 2025 prohibitions also target. Businesses operating in this space now face dual exposure.

OpenAI's ChatGPT has attracted similar scrutiny. Italy's data protection authority temporarily banned the service in March 2023, citing the absence of a lawful basis for data processing, inadequate age verification, and the failure to allow individuals to correct inaccurate information generated about them. These are not edge-case concerns. They represent systemic weaknesses in how many organisations are currently deploying AI tools.

The enforcement environment is not softening. GDPR fines across 2023–2024 totalled €5.88 billion. DPAs are scrutinising data scraping for AI training purposes, the legality of automated decision-making, and the adequacy of transparency disclosures. This is the compliance baseline every firm must meet, independent of the AI Act obligations still phasing in.

What the Courts Are Adding to the Picture

Regulatory fines tell part of the story. European courts are shaping the other part.

In July 2023, the European Court of Human Rights ruled in Glukhin v. Russia that deploying live facial recognition technology against individuals at a peaceful protest violated rights to privacy and freedom of expression. The ruling established that AI surveillance systems must satisfy clear standards of legality, proportionality, and necessity. This is not confined to law enforcement contexts. The proportionality principle applies wherever AI is used to monitor, profile, or assess individuals — including in employment and client-facing settings.

In December 2023, the Court of Justice of the European Union clarified that GDPR rules on AI-assisted decisions extend to credit scoring used by banks. The implications reach well beyond financial services. Wherever AI is used to make or inform consequential decisions about individuals — hiring, performance management, client eligibility — the same principles apply. Legal and HR professionals in particular should treat this ruling as directly relevant to their practice.

What This Means If You Are Outside the EU

The territorial reach of both the AI Act and GDPR extends beyond EU borders, and this is where many international firms underestimate their exposure.

If your firm processes data about EU residents, offers services to clients in the EU, or deploys AI systems that affect people in the EU, you are within scope — regardless of where your business is registered. UK firms operating under post-Brexit data adequacy arrangements, US firms with European clients, and Middle Eastern or Asia-Pacific businesses with any EU-facing activity all need to assess their position carefully.

The AI Act's international reach mirrors the GDPR's. Compliance is not optional for non-EU businesses that touch EU markets.

The Practical Steps Your Firm Should Take Now

Given the deadlines already passed and those approaching, the time for preliminary assessment is over. What is required now is structured action.

Audit your AI tools immediately. Catalogue every AI system your firm uses — including third-party platforms, embedded analytics, and AI-assisted workflows. Identify whether any fall within the prohibited categories already in force or the high-risk categories that become regulated in August 2026.

Establish AI literacy across your organisation. The AI Act explicitly requires AI literacy measures. Staff who use AI tools need to understand the basics of how those tools work, their limitations, and the firm's obligations. This is a compliance requirement, not a training preference.

Review your GDPR documentation. If your firm processes personal data using AI systems, revisit your lawful basis for processing, your privacy notices, and your data subject rights procedures. The CJEU rulings on AI-assisted decision-making mean your existing documentation may no longer be adequate.

Build a governance framework before August 2025. With GPAI governance obligations coming into force within months, firms that rely on general-purpose AI tools need documented policies for how those tools are selected, monitored, and reviewed.

Do not wait for penalties to clarify your obligations. The enforcement trajectory is clear. The regulators are resourced, the courts are active, and the financial exposure is material.

Ops Intel Can Help You Navigate This

AI compliance across multiple overlapping frameworks — the EU AI Act, GDPR, and emerging national regulations — requires specialist expertise. Ops Intel works with professional services businesses globally to assess their AI risk exposure, build compliant governance frameworks, and prepare for the obligations taking effect through 2025, 2026, and 2027.

If your firm is not certain where it stands, that uncertainty is itself a risk.

Contact Ops Intel today to arrange a compliance assessment and find out exactly what your obligations are — before the next deadline arrives.