EXPLAINER

EU AI Act

regulationfreshness: volatilekey claims checked 2026-10-09

The EU AI Act (Regulation (EU) 2024/1689) is a risk-based law regulating AI systems placed on or used in the EU market, with prohibited practices, obligations for high-risk systems, transparency duties and rules for general-purpose AI models.

Short answer: A risk-based EU regulation: some AI practices are prohibited; high-risk systems face requirements (risk management, data governance, documentation, human oversight); some systems have transparency duties; general-purpose AI models have their own obligations. Application dates are phased and were amended in 2026 by Regulation (EU) 2026/1744 — verify the current consolidated timetable. This is orientation, not legal advice.

What is it?

The EU AI Act sorts AI uses by risk. A few uses are banned outright, risky ones (like AI used in hiring or credit) must meet strict requirements, some need clear disclosure (like chatbots and deepfakes), and the big general-purpose models have their own duties.

Also known as: EU AI Act, AI Act, European AI regulation, Regulation 2024/1689, high-risk AI systems, prohibited AI practices, general purpose AI obligations, GPAI code of practice.

Technical definition

Regulation (EU) 2024/1689 entered into force in 2024 with phased application. As commonly summarised: prohibitions and AI-literacy duties applied first; obligations for general-purpose AI models followed; most remaining provisions, including high-risk system requirements in the Act's annexed use cases, apply later, with a longer transition for AI embedded in products covered by existing safety legislation. Roles include provider, deployer, importer and distributor, each with different duties; penalties scale with turnover. The timetable has already been amended: Regulation (EU) 2026/1744 (the Digital Omnibus on AI), published in the Official Journal on 24 July 2026 and in force from 27 July 2026, moved high-risk obligations for Annex III systems to 2 December 2027 and for AI in products covered by Annex I to 2 August 2028, and added new Article 5 prohibitions that apply from 2 December 2026 (point (ba): AI systems that generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without explicit consent; point (bb): AI systems that generate or manipulate child sexual abuse material within the meaning of Directive 2011/93/EU; new paragraphs 1a and 1b limit the prohibition to systems whose intended purpose or foreseeable, unsafeguarded outcome is that generation, and to deployers who use a system for that purpose); the original prohibitions have applied since 2 February 2025, and Chapter V (general-purpose AI models) has applied since 2 August 2025 (Article 113 as consolidated on 2026-07-27). Implementing acts, harmonised standards, guidance and corrigenda can still change the practical picture, so exact dates and scope must be checked against the consolidated Official Journal text and current Commission guidance.

Entity type: regulation · Freshness class: volatile.

When should I use it?

Relevant to anyone offering or deploying AI in or into the EU.

Implementation patterns

  • Inventory AI systems and classify risk category and your role.
  • Gap-assess against the relevant requirements.
  • Maintain technical documentation and logs.
  • Track guidance and standards updates.
  • Get qualified legal advice for decisions.

Technologies and frameworks

Commonly associated: conformity assessment processes, harmonised standards, documentation and logging systems. Names are examples of what exists, not recommendations, and projects change quickly.

Practical guide

  1. Identify role and system category.
  2. Read the relevant articles and annexes.
  3. Run a gap assessment.
  4. Plan documentation and oversight.
  5. Revisit as guidance evolves.

Common failure modes

  • Assuming the Act applies only to EU-based companies.
  • Misclassifying risk level.
  • Ignoring deployer duties.
  • Relying on outdated timeline information.

Troubleshooting

  • Unsure whether a use is high-risk — Check the Act's annex categories and official guidance; consult counsel.
  • Timeline questions — Consult the current official timetable; do not rely on secondary summaries.

Contrasted with

Questions this page answers

  • What is the EU AI Act?
  • Does the EU AI Act apply to me?
  • What are high-risk AI systems under the AI Act?
  • When does the EU AI Act take effect?
  • What does the AI Act require of general-purpose models?

Typical goals: understand if the AI Act applies to my product; prepare for compliance.

Sources and verification

Status: key claims checked on 2026-10-09 against the primary sources listed below; everything else is not independently verified. The claims under "Checked against primary sources" were compared with the linked pages on that date. Pages change, so re-check anything time-sensitive before relying on it.

Checked against primary sources (2026-10-09):

  • Regulation (EU) 2026/1744 of 8 July 2026 amends Regulation (EU) 2024/1689 (and (EU) 2018/1139 and (EU) 2023/1230); published as OJ L, 2026/1744 on 24.7.2026; enters into force on the third day after publication (EUR-Lex records first entry into force as 2026-07-27).
  • Amended Article 113: Chapters I and II apply from 2 February 2025, except Article 5(1) first subparagraph points (ba) and (bb) and Article 5(1a) and (1b), which apply from 2 December 2026.
  • High-risk systems under Article 6(2) and Annex III apply from 2 December 2027; systems under Article 6(1) and Annex I apply from 2 August 2028.
  • Consolidated Article 113 (document 02024R1689-20260727): general application 2 August 2026; Chapter III Section 4, Chapter V, Chapter VII, Chapter XII and Article 78 from 2 August 2025 (except Article 101); Articles 102 to 110 from 27 July 2026.
  • Article 5(1) points (ba) and (bb) and paragraphs 1a and 1b, as inserted by the amending regulation: non-consensual intimate-imagery generation and child-sexual-abuse-material generation, with the stated purpose/foreseeability limits (re-read on 2026-10-09).

Primary sources consulted:

Not independently verified:

  • Article 5 paragraph 1a/1b details beyond the summary given (re-read the Official Journal text before any legal use).
  • The Article 50(2) transitional period to 2 December 2026 (reported by secondary commentary only; the Article 50 text itself was not read).
  • The consolidated text of Regulation (EU) 2024/1689 as amended.
  • Implementing acts, guidance and national measures.
  • Anything about how the law applies to a particular product; this is orientation, not legal advice.

Freshness class: volatile — Products, versions, protocols, benchmarks, leaderboards, regulations and dates. Verify against the primary source before relying on specifics; re-review every 3 months.

Time-sensitive claims to verify before relying on them:

  • All application dates and transitional periods.
  • Any amendment, delay or simplification proposals and their status.
  • Details of GPAI obligations, codes of practice and thresholds.
  • Penalty levels and classification of specific use cases.

Further reading and canonical sources (not all checked):

  • Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), Official Journal of the EU — eur-lex.europa.eu (locate consolidated text)
  • European Commission AI Act pages and AI Office guidance — digital-strategy.ec.europa.eu (verify)
Learning path: Governing AI (step 4 of 7)
← ISO/IEC 42001 (AI Management System)Model Cards and Datasheets (AI Documentation) →