Correction (25 October 2026): An earlier version said that the Digital Omnibus on AI turned AI literacy into a duty of the Commission and the Member States. That was wrong: under Article 4 as replaced by Regulation (EU) 2026/1744, the duty remains with providers and deployers, and the Commission and the Member States must support them in meeting it.

Correction (19 October 2026): The timeline now reflects the Digital Omnibus on AI (Regulation (EU) 2026/1744), which postponed the high-risk obligations to 2 December 2027 and 2 August 2028, so the Act did not become fully applicable on 2 August 2026; the description of the prohibited practices has also been made precise.

In force since August 1, 2024 and applying in phases, the EU AI Act sets a global benchmark for making AI systems safe, transparent, traceable, and non-discriminatory. It takes a "risk-based" approach, regulating not the technology as such but the risks posed by particular uses of it.

Risk-Based Classification Pyramid

🚫

Unacceptable Risk (Prohibited)

Practices such as harmful manipulative or deceptive techniques, exploitation of vulnerabilities, social scoring, and real-time remote biometric identification in publicly accessible spaces for law enforcement (subject to narrow exceptions) are prohibited.

⚠️

High Risk

Systems used in healthcare, education, employment, and critical infrastructure. These require strict data governance, risk mitigation, and mandatory conformity assessments.

👁️

Limited Risk

Technologies such as chatbots and deepfakes. These are subject to specific transparency obligations so users are aware they are interacting with an AI.

✅

Minimal Risk

Systems like spam filters or AI-supported video games. These are largely exempt from the Act and can be freely developed and used.

Compliance and Enforcement Timeline

The Act provides a phased transition period for companies to achieve compliance:

February 2, 2025
The bans on prohibited AI systems and the general AI literacy obligations took effect. (The 2026 Digital Omnibus later rewrote the AI literacy article: providers and deployers must still take measures to support the AI literacy of their staff and of others who operate or use AI systems on their behalf, without having to guarantee any specific level, and the Commission and the Member States must support them in doing so.)
August 2, 2025
Specific rules and governance standards for general-purpose AI (GPAI) models took effect.
August 2, 2026
Most remaining provisions began to apply, including the Article 50 transparency duties (with a grace period until December 2, 2026 for machine-readable marking by systems already on the market) and the AI Office's enforcement powers over general-purpose AI models.
December 2, 2026
Two new prohibitions added by the Digital Omnibus on AI (Regulation (EU) 2026/1744) take effect: AI systems that generate non-consensual intimate imagery and those that generate child sexual abuse material.
December 2, 2027 – August 2, 2028
Under the Digital Omnibus on AI, obligations for the high-risk systems listed in Annex III (e.g., employment, education, law enforcement) apply from December 2, 2027, and those for high-risk systems integrated into regulated products under Annex I (e.g., medical devices, elevators) from August 2, 2028.

Extraterritorial Impact and Penalties

The EU AI Act does not apply only to companies established in the EU. It also covers any global company that places an AI system on the EU market or whose AI system's outputs are used within the EU. Companies within its scope that breach the rules may face administrative fines of up to €35 million or 7% of their total worldwide annual turnover, depending on the severity of the infringement.

Download the Original EU AI Act (PDF)
📄

Original documents

Read the primary sources referenced in this article:

↓ Regulation (EU) 2024/1689 — the EU AI Act (EUR-Lex)