The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the first comprehensive law regulating AI across a major economy. It entered into force on 1 August 2024 and applies in stages. Because it covers any company placing AI systems on the EU market or whose AI outputs are used in the EU, its effects reach far beyond Europe.

A risk-based approach

The Act sorts AI uses by the risk they pose, with obligations rising with risk.

1. Unacceptable risk — banned

Certain practices are prohibited outright, including:

  • manipulative techniques that materially distort behavior and cause significant harm;
  • exploiting vulnerabilities related to age, disability or social or economic situation;
  • social scoring that leads to unjustified detrimental treatment;
  • predicting criminal offences based solely on profiling or personality traits;
  • untargeted scraping of facial images to build facial recognition databases;
  • emotion recognition in workplaces and schools, with limited exceptions;
  • certain uses of biometric categorization and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.

2. High risk — strict obligations

AI used in sensitive areas — such as critical infrastructure, education, employment, access to essential services like credit, law enforcement, migration and justice, and AI in regulated products such as medical devices — is classed as high risk. Providers must implement risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness measures, and undergo conformity assessment. Deployers have duties too, including human oversight and, in some cases, fundamental-rights impact assessments.

3. Transparency obligations

People must be told when they interact with an AI system such as a chatbot, unless it is obvious. AI-generated or manipulated content — including deepfakes — must be disclosed, and providers of generative systems must mark outputs in a machine-readable way where technically feasible.

4. Minimal risk

Most AI applications, such as spam filters or video game AI, face no new obligations.

General-purpose AI models

The Act adds specific rules for general-purpose AI (GPAI) models — the large models underlying many applications. Providers must prepare technical documentation, provide information to downstream developers, have a policy to comply with EU copyright law, and publish a summary of training content. Models deemed to pose systemic risk — presumed above a training compute threshold of 10^25 floating-point operations, or designated by the Commission — face additional duties: model evaluations, adversarial testing, serious-incident reporting and cybersecurity. A Code of Practice published in 2025 helps providers demonstrate compliance.

Key dates

  • 1 August 2024: entry into force.
  • 2 February 2025: prohibitions and AI literacy obligations apply.
  • 2 August 2025: rules for general-purpose AI models and governance apply.
  • 2 August 2026: most remaining provisions, including many high-risk requirements, apply.
  • 2 August 2027: obligations for high-risk AI embedded in certain regulated products.

The Commission has proposed adjustments to some timelines as standards and guidance are finalized, so check the current status for your obligations.

Penalties

Fines can reach €35 million or 7% of global annual turnover for prohibited practices, with lower ceilings for other violations.

Enforcement

National market surveillance authorities enforce most rules, while the European AI Office, within the Commission, supervises general-purpose AI models.

What to watch next

  • Harmonized technical standards that will define how to comply with high-risk requirements in practice.
  • Guidelines from the Commission and the AI Office on definitions, prohibited practices and GPAI obligations.
  • Possible timeline adjustments through simplification proposals.
  • The first enforcement actions by national authorities.

Key takeaways

  • The EU AI Act entered into force on 1 August 2024 and applies in stages until 2027.
  • It bans certain practices, strictly regulates high-risk uses and imposes transparency duties.
  • General-purpose AI models have their own obligations, stricter for models with systemic risk.
  • Fines can reach €35 million or 7% of global turnover for prohibited practices.
  • It applies to non-EU companies whose AI systems or outputs are used in the EU.

Frequently asked questions

Does the AI Act apply to companies outside the EU?

Yes, if they place AI systems on the EU market or if outputs of their AI systems are used in the EU.

Is ChatGPT high risk under the AI Act?

General-purpose chatbots are covered mainly by the general-purpose AI model rules and transparency duties. Specific uses of them in high-risk areas, such as hiring, can trigger high-risk obligations for those deploying them.

What is AI literacy under the Act?

Providers and deployers must take measures to ensure that staff dealing with AI systems have a sufficient level of understanding of them, proportionate to their role and context.