European Union

The EU AI Act, Regulation (EU) 2024/1689, is the world's first comprehensive horizontal AI law. It sorts AI systems into four tiers by risk: unacceptable uses are banned, high-risk uses carry heavy obligations, limited-risk uses face transparency duties, and minimal-risk uses are left alone. It entered into force on August 1, 2024 and applies in phases through 2028. It reaches any provider or deployer whose systems are used in the EU, wherever they are based.

Key points

• Prohibited practices and AI-literacy duties have applied since February 2, 2025.
• General-purpose AI model obligations have applied since August 2, 2025.
• Article 50 transparency duties, including chatbot disclosure and content marking, have applied since August 2, 2026.
• The 2026 Digital Omnibus, now Regulation (EU) 2026/1744 and in force since July 27, 2026, deferred stand-alone high-risk (Annex III) obligations to December 2, 2027 and product-embedded (Annex I) obligations to August 2, 2028.
• Penalties reach up to EUR 35 million or 7% of worldwide annual turnover for prohibited-practice violations.
• The Commission found the Code of Practice on Transparency adequate on July 8, 2026, the AI Board adopted its own adequacy assessment the next day, and the Commission adopted the final Article 50 guidelines on July 20. Image, audio, and video content generated before August 2 needs no retroactive marking, generative systems placed on the market before that date have until December 2, 2026 for machine-readable marking, and transparency violations fall in the AI Act's tier of up to 15 million euros or 3 percent of worldwide turnover.
• The Commission published draft guidelines on classifying high-risk AI systems on May 19, 2026, covering Article 6, Annex I product safety components, and Annex III use cases, for targeted consultation. Final guidelines are pending before the December 2, 2027 application date.
• On October 12, 2026, after a special Scientific Panel meeting on October 9, the Commission said the AI Office had requested and received serious incident reports from the developers of frontier models involved in recent loss-of-control incidents, had sent them requests for information on their security practices, and will send further requests combining the panel's questions with its own. It named no company.
• On October 14, 2026 the Commission published in the Official Journal the reference of the first harmonized standard under the AI Act, EN 18286:2026 on quality management systems. Providers of high-risk systems that apply it are presumed to meet the Article 17 quality management requirements it covers.
• On October 21, 2026 EU governments agreed their negotiating mandate on the wider Digital Omnibus, which would let personal data be processed for developing and operating AI systems on the basis of legitimate interest, subject to a balancing test, and would address special-category data found incidentally in training data. The European Parliament has not yet adopted its position.

Laws and instruments

Timeline

• August 1, 2024
  AI Act enters into force.
• February 2, 2025
  Prohibited practices and AI-literacy obligations apply.
• August 2, 2025
  Governance rules and general-purpose AI model obligations apply.
• March 5, 2026
  Second draft of the Code of Practice on Transparency of AI-Generated Content published.
• May 7, 2026
  Digital Omnibus political agreement reached, deferring high-risk deadlines.
• May 8, 2026
  Commission publishes draft Article 50 transparency guidelines; consultation closes June 3.
• May 19, 2026
  Draft guidelines on high-risk classification published for targeted consultation.
• June 29, 2026
  The Council gives the Digital Omnibus final approval, after Parliament's vote on June 16.
• July 8, 2026
  The Commission finds the Code of Practice on Transparency adequate; the AI Board adopts its adequacy assessment on July 9.
• July 20, 2026
  Final Article 50 transparency guidelines adopted.
• July 24, 2026
  Digital Omnibus on AI published in the Official Journal as Regulation (EU) 2026/1744; in force from July 27, making the high-risk deferrals binding law.
• August 2, 2026
  Article 50 transparency obligations apply; Commission enforcement powers over GPAI begin.
• October 9, 2026
  Special meeting of the Scientific Panel on frontier AI loss-of-control incidents; in a statement published October 12, the Commission says the AI Office has received serious incident reports and will send further requests for information.
• October 12, 2026
  The Commission publishes for four weeks of feedback a draft implementing regulation on access to the file and limitation periods in AI Office enforcement proceedings under Articles 75c and 75d.
• October 14, 2026
  The reference of EN 18286:2026, the first harmonized standard under the AI Act, is published in the Official Journal.
• October 21, 2026
  The Council agrees its mandate on the wider Digital Omnibus, including GDPR rules on processing personal data to develop and operate AI on the basis of legitimate interest.
• December 2, 2026
  New nudifier / CSAM prohibition takes effect; watermarking grace period ends.
• December 2, 2027
  Stand-alone high-risk (Annex III) obligations apply.
• August 2, 2028
  Product-embedded high-risk (Annex I) obligations apply.

Who it applies to

Providers, deployers, importers, distributors, and product manufacturers of AI systems, plus providers of general-purpose AI models. Extraterritorial: it applies wherever the provider or deployer is established if the system's output is used in the EU. Military, national-security, and pure research uses are largely out of scope.

Penalties

Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices; up to EUR 15 million or 3% for most other breaches; up to EUR 7.5 million or 1% for supplying incorrect information. The higher figure applies, except that SMEs, including start-ups, face whichever is lower, as do small mid-cap companies for the EUR 15 million and EUR 7.5 million tiers.

Recent developments

Common questions