---
id: GOV-EU-001
title: "The EU AI Act"
alternative_names:
  - "Regulation (EU) 2024/1689"
  - "Artificial Intelligence Act"
  - "AI Act"
category: "Safety & Governance → Regulation"
volume: VIII
chapter: 48
entry_type: "Standard Article"
level: 3
status: "Draft"
last_reviewed: 2026-10-18
version: "0.2.0"
prerequisites:
  - "GOV-LAW-001"
related_entries:
  - "GOV-US-001"
  - "GOV-CN-001"
  - "GOV-INTL-001"
  - "GOV-EXPORT-001"
  - "TECH-LLM-001"
  - "ORG-STANDARDS-001"
---

# The EU AI Act

*Legal status stated as of 2026-10-18. This article summarises the law; it is not legal advice. Dates changed in 2026 and should be re-checked on EUR-Lex.*

## 1. Concise Definition
The EU AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council, a directly applicable European Union regulation that lays down harmonised rules for placing on the market, putting into service and using artificial intelligence systems and for placing general-purpose AI models on the market. It combines product-safety-style obligations that scale with risk, a short list of prohibited practices, transparency duties, and a separate regime for general-purpose AI (GPAI) models.

## 2. Overview & Significance
The Act is the first comprehensive horizontal statute on AI adopted by a major jurisdiction. Under Article 2(1) it applies to providers placing AI systems on the market or putting them into service, or placing general-purpose AI models on the market, in the Union irrespective of where they are established; to deployers established or located in the Union; and to providers and deployers in third countries where the output produced by the AI system is used in the Union. It sets a reference point for other jurisdictions, whose approaches differ (see [[GOV-US-001]](../vol08_safety_governance/GOV-US-001_united_states_ai_policy.md) and [[GOV-CN-001]](../vol08_safety_governance/GOV-CN-001_chinas_ai_regulation.md)). It is in force and, as of 2026-10-18, applies in most respects other than the high-risk obligations, which have been postponed by an amending regulation adopted in 2026 (section 3).

## 3. Historical Development
The European Commission proposed the Act on 21 April 2021 (COM(2021) 206 final; European Commission, 2021). The regulation is dated 13 June 2024 and was published in the Official Journal on 12 July 2024 as Regulation (EU) 2024/1689 (European Parliament & Council, 2024). Under Article 113 it entered into force on the twentieth day after publication (1 August 2024) and applies in stages.

**Original staging (Article 113 as adopted):** prohibitions and general provisions from 2 February 2025; GPAI obligations (Chapter V), governance (Chapter VII) and most penalty provisions (Chapter XII, with the exception of Article 101) from 2 August 2025; the Regulation as a whole from 2 August 2026; Article 6(1) and the corresponding obligations (Annex I product-embedded high-risk rules) from 2 August 2027 (Article 113, Official Journal text read 2026-10-18). The Commission's AI policy page confirms the February 2025, August 2025 and August 2026 dates as having taken effect (European Commission, 2026).

**2026 amendment ("Digital Omnibus on AI").** The Commission adopted its simplification proposal on 19 November 2025; according to the Commission's AI policy page, a political agreement was reached on 7 May 2026 and the amending act entered into force on 27 July 2026 (European Commission, 2026). The amending act is Regulation (EU) 2026/1744, OJ L of 24 July 2026, amending Regulations (EU) 2024/1689, 2018/1139 and 2023/1230; it was signed at Strasbourg on 8 July 2026 and, under its Article 4, entered into force on the third day after publication (27 July 2026). The provisions below marked as checked were read in the Official Journal text on EUR-Lex (2026-10-15 and 2026-10-18):
- Annex III stand-alone high-risk obligations delayed from 2 August 2026 to **2 December 2027** (Art. 113(c)(i) as amended; checked).
- Annex I product-embedded high-risk obligations delayed from 2 August 2027 to **2 August 2028** (Art. 113(c)(ii) as amended; checked).
- A new prohibition on AI systems generating non-consensual intimate imagery and child sexual abuse material, applying from **2 December 2026** (Art. 5(1), points (ba) and (bb), and Art. 5(1a) and (1b), per the amended Art. 113(a); checked).
- Article 50 transparency duties remain applicable from 2 August 2026, with a grace period to **2 December 2026** for providers whose generative systems were placed on the market before 2 August 2026 to comply with Article 50(2) marking (checked).
- Article 4 (AI literacy) is replaced. The original text required providers and deployers to "take measures to ensure, to their best extent, a sufficient level of AI literacy" of their staff; the amended text requires them to "take measures to support the development of AI literacy" and adds that the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual" (checked in both texts).
- Amended Article 75(1) makes the AI Office exclusively competent for supervision and enforcement in relation to AI systems based on GPAI models where the model and the system are developed by the same provider or by providers in the same undertaking, and to AI systems that constitute or are integrated into a designated very large online platform or search engine, with listed exceptions (including Annex I product-related systems, Annex III point 2 and certain law-enforcement, border and financial-institution systems; checked in the amending text).
- Stated rationale: recital (2) of the amending act cites "the delayed preparation of standards" and "the delayed establishment of the governance and the conformity assessment frameworks at national level" as having produced a compliance burden "heavier than expected" (checked).

## 4. Technical / Conceptual Explanation
**Scope definitions.** The Act regulates "AI systems" (machine-based systems that infer from inputs how to generate outputs such as predictions, content, recommendations or decisions) and, separately, "general-purpose AI models".

**Risk tiers.**
1. *Prohibited practices (Article 5)*, applicable since 2 February 2025 (the original eight points, Art. 5(1)(a) to (h)): for example manipulative or deceptive techniques and exploitation of vulnerabilities causing significant harm, social scoring, risk assessment of offending based solely on profiling, untargeted scraping of facial images from the internet or CCTV to build facial recognition databases, emotion inference in workplaces and education (with medical or safety exceptions), certain biometric categorisation, and, unless strictly necessary for one of three listed objectives, real-time remote biometric identification in publicly accessible spaces for law enforcement. The Commission counts nine prohibited practices after the omnibus addition (section 3).
2. *High-risk systems (Article 6, Annexes I and III).* Annex III lists use areas such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and administration of justice. Obligations (Articles 9 to 15, 17, 43 and 72) include a risk-management system, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, a quality management system, conformity assessment and post-market monitoring.
3. *Transparency duties (Article 50)*: informing people that they are interacting with an AI system (Art. 50(1)), marking synthetic audio, image, video or text outputs in a machine-readable format (Art. 50(2)), informing people exposed to emotion recognition or biometric categorisation (Art. 50(3)), and disclosing deepfakes (Art. 50(4)).
4. *Minimal risk*: no specific obligations.

**General-purpose AI models (Chapter V).** Under Article 53(1), GPAI providers must maintain technical documentation (Annex XI), provide information to downstream providers (Annex XII), put in place a copyright-compliance policy, and publish a sufficiently detailed training-content summary using the AI Office template; the documentation duties in points (a) and (b) do not apply to models under a free and open-source licence with publicly available parameters, except where the model has systemic risk (Art. 53(2)). A GPAI model is classified as having systemic risk if it has high-impact capabilities or is so designated by a Commission decision (Art. 51(1)); it is presumed to have high-impact capabilities when the cumulative computation used for its training, measured in floating-point operations, is greater than $10^{25}$ (Art. 51(2)). The Commission may amend the thresholds by delegated act (Art. 51(3)). Systemic-risk providers face extra duties (Article 55(1)) on model evaluation including adversarial testing, assessing and mitigating systemic risks, reporting serious incidents to the AI Office, and cybersecurity protection. The threshold is a presumption, not a measure of danger; see [[ECON-COMP-001]](../vol09_economy/ECON-COMP-001_compute_economics.md) for the compute accounting underlying it.

**Penalties.** Article 99 sets administrative-fine maxima of EUR 35 million or, for an undertaking, 7% of total worldwide annual turnover of the preceding financial year (whichever is higher) for breaches of the Article 5 prohibitions (Art. 99(3)); EUR 15 million or 3% (whichever is higher) for listed operator obligations including those of providers (Art. 16), deployers (Art. 26) and the Article 50 transparency duties (Art. 99(4)); and EUR 7.5 million or 1% (whichever is higher) for incorrect, incomplete or misleading information to notified bodies or national competent authorities (Art. 99(5)). For SMEs, including start-ups, each fine is up to the percentage or amount, whichever is lower (Art. 99(6)). Article 101 allows the Commission to fine GPAI providers up to 3% of annual worldwide turnover or EUR 15 million, whichever is higher, where it finds intentional or negligent infringement. Article 113(b) excepts Article 101 from the 2 August 2025 date, so it applies from the general date of 2 August 2026, consistent with the Commission's statement that the AI Office can issue fines from 2 August 2026.

## 5. Types, Components & Classifications
- **Actors:** providers, deployers, importers, distributors, authorised representatives.
- **Governance:** the AI Office within the Commission (Art. 64), which supervises GPAI models and, under Article 75(1) as amended, certain AI systems built on them; a European AI Board with one representative per Member State (Art. 65); a scientific panel of independent experts (Art. 68); and national notifying and market-surveillance authorities (Art. 70).
- **Soft instruments:** the GPAI Code of Practice, published 10 July 2025, with three chapters (transparency, copyright, safety and security); the Commission describes it as a voluntary tool, and states that the Commission and the AI Board have confirmed it as an adequate voluntary tool for demonstrating compliance; the Transparency and Copyright chapters relate to Article 53 and the Safety and Security chapter to Article 55 (European Commission, 2025, page last updated 7 October 2026). Articles 53(4) and 55(2) let providers rely on codes of practice until a harmonised standard is published. Under Article 40, conformity with harmonised standards whose references are published in the Official Journal gives a presumption of conformity with the high-risk requirements and with the GPAI obligations they cover; see [[ORG-STANDARDS-001]](../vol10_people_organizations/ORG-STANDARDS-001_standards_bodies_iso_iec_nist.md).
- **Legacy GPAI models:** providers of models placed on the market before 2 August 2025 must comply by 2 August 2027 (Article 111(3)).

## 6. Applications & Concrete Examples
As a law, the Act has no "applications" in the engineering sense; its practical effect is on deployment decisions. Examples of affected activity: CV-screening software (Annex III employment category), credit-scoring tools, exam-proctoring systems, and chatbots (Article 50 disclosure). Frontier LLM providers are the principal addressees of Chapter V (see [[TECH-LLM-001]](../vol03_technical/TECH-LLM-001_large_language_models.md)). The Commission's Code of Practice page (last updated 7 October 2026, read 2026-10-18) lists signatories including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI, and states that xAI signed only the Safety and Security chapter; Meta does not appear on that list. The list is updated continuously and should be re-checked.

## 7. Advantages, Limitations & Unresolved Questions
**Claimed strengths:** legal certainty across 27 Member States, a single market for compliant products, and proportionality through risk tiers.

**Limitations and criticisms:**
- Compliance depends on harmonised standards and governance frameworks that were not ready when obligations were originally scheduled; recital (2) of Regulation (EU) 2026/1744 states this as a reason for the 2026 amendments (section 3).
- A fixed compute threshold is a proxy that algorithmic efficiency gains may make over- or under-inclusive.
- Enforcement is distributed across national authorities, creating risk of uneven application.
- Whether and how the Act interacts with existing law (GDPR, copyright, product safety) remains partly unresolved.
- Effects on innovation and on EU competitiveness are disputed and have not been measured in a source reviewed here.

## 8. Current State of Knowledge
As of 2026-10-18: prohibitions and AI-literacy duties (Article 4, since amended) have applied since 2 February 2025; GPAI obligations since 2 August 2025; the general application date of 2 August 2026 has passed, with governance, penalties and Article 50 transparency in effect, subject to the grace periods above. The Commission states that from 2 August 2026 the AI Office holds enforcement powers over GPAI models, including requesting documentation, evaluating models, requiring corrective measures and issuing fines. High-risk obligations are **not yet applicable**: 2 December 2027 (Annex III) and 2 August 2028 (Annex I) as amended. The new prohibition on intimate-imagery/CSAM generation applies from 2 December 2026 and the Article 50(2) grace period for earlier systems also ends on that date. Evidence on enforcement outcomes is not yet available; no fine under the Act is recorded in the sources reviewed.

## 9. Future Trajectory & Strategic Outlook
Observed trend: dates have moved later while the substantive structure has been retained. No forecast is registered here; further delegated acts (including threshold updates), harmonised standards and Commission guidelines are the items to monitor. Readers should consult the Living Reference collections (`TIME-001`, `FCST-REG-001`) for dated updates.

## 10. Related Entries & Knowledge Graph
- **Foundational Concepts**:
  - [[GOV-LAW-001] Global AI Governance & Regulation](../vol08_safety_governance/GOV-LAW-001_ai_governance.md): general overview of regulatory approaches.
- **Related Methods & Technologies**:
  - [[TECH-LLM-001] Large Language Models](../vol03_technical/TECH-LLM-001_large_language_models.md): principal GPAI models addressed by Chapter V.
  - [[ECON-COMP-001] The Economics of Compute and Scaling](../vol09_economy/ECON-COMP-001_compute_economics.md): compute accounting behind the $10^{25}$ FLOP presumption.
  - [[ORG-STANDARDS-001] Standards Bodies (ISO/IEC, NIST)](../vol10_people_organizations/ORG-STANDARDS-001_standards_bodies_iso_iec_nist.md): harmonised standards.
- **Comparative regimes**:
  - [[GOV-US-001] United States AI Policy](../vol08_safety_governance/GOV-US-001_united_states_ai_policy.md)
  - [[GOV-CN-001] China's AI Regulation](../vol08_safety_governance/GOV-CN-001_chinas_ai_regulation.md)
  - [[GOV-INTL-001] International AI Governance and Compute Governance](../vol08_safety_governance/GOV-INTL-001_international_ai_governance_and_compute_governance.md)

## 11. References & Foundational Literature
1. European Parliament & Council of the EU. (2024). *Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)*. Official Journal of the European Union, L, 12.7.2024. https://eur-lex.europa.eu/eli/reg/2024/1689/oj. [Primary text for Articles 2, 3, 4, 5, 40, 50, 51, 53, 55, 56, 64, 65, 68, 70, 99, 101, 111 and 113 and Annex III; read in the Official Journal HTML on EUR-Lex on 2026-10-18].
2. European Parliament & Council of the EU. (2026). *Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI)*. Official Journal of the European Union, L, 24.7.2026. http://data.europa.eu/eli/reg/2026/1744/oj. [Instrument that postponed high-risk application dates and amended Articles 4 and 75; text read in the Official Journal on EUR-Lex].
3. European Commission. (2026). *AI Act: regulatory framework for AI* (Shaping Europe's Digital Future). https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. [Official page stating application dates achieved, the nine prohibited practices, AI Office enforcement powers from 2 August 2026 and the omnibus timeline; accessed 2026-10-18].
4. European Commission. (2025). *The General-Purpose AI Code of Practice*. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai. [Publication date 10 July 2025, three-chapter structure, adequacy confirmation and signatory list; page last updated 7 October 2026, accessed 2026-10-18].
5. European Commission. (2021). *Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts*, COM(2021) 206 final, 21.4.2021. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52021PC0206. [Date of the original Commission proposal].

## 12. Evidential Classification Matrix
| Section / Claim | Evidence Category | Supporting Source | Confidence / Status |
| :--- | :--- | :--- | :--- |
| Regulation 2024/1689 content, tiers, penalties | Established | Ref 1 | High |
| Original staging and dates already reached | Established | Refs 1, 3 | High |
| High-risk postponement to Dec 2027 / Aug 2028 | Established (in force) | Refs 2, 3 | High |
| Amended Art. 4 wording and Art. 75(1) AI Office competence | Established (in force) | Ref 2 | High (final text read) |
| GPAI Code of Practice status, contents and signatories | Established (signatory list changes) | Ref 4 | High; signatory list dated 2026-10-07 |
| Effects on innovation | Contested | none retrieved | Unresolved |
| Proposal date (21 April 2021) | Established | Ref 5 | High |

## 13. Revision History
- **v0.1.0** (2026-10-15): Initial draft. Citations checked against official pages where marked; not independently fact-checked.
- **v0.2.0** (2026-10-18): Fact-check audit (docs/audits/GOV-EU-001_audit.md). Article-level wording now taken from the Official Journal text rather than a mirror site; corrected GPAI duties (open-source carve-out), Article 5 scope, Article 99/101 detail, Article 2 scope, CEN/CENELEC attribution; resolved three verification markers (AI Office competence, rationale for delay, signatories); added proposal date reference; removed law-firm commentary reference. Status remains Draft.