What is the EU AI Act?
The EU AI Act is a regulation, so it applies directly in every member state without national transposition. Its full title is Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. It regulates AI by use and by risk rather than by technology: the same model can be unregulated in a spam filter, subject to disclosure rules in a chatbot, and subject to full conformity assessment when used to sort job applicants.
The law has two tracks. The first covers AI systems, the products and services that put AI to a specific use, and sorts them into prohibited, high-risk, transparency-risk and minimal-risk categories. The second covers general-purpose AI models, the large models other systems are built on, with documentation and copyright duties for all providers and extra safety duties for models with systemic risk. The European Commission describes it as the first legal framework of its kind on AI worldwide.
The Act was amended in 2026 by the Digital Omnibus on AI, Regulation (EU) 2026/1744, which delayed the high-risk rules, softened the AI literacy duty, strengthened the AI Office and added a new ban. Any summary written before July 2026 is out of date on the timeline.
EU AI Act at a glance
The table lists each main part of the Act, what it covers, and when it applies as of November 9, 2026, including the Omnibus changes.
| Topic | What it covers | Applies from | Article |
|---|---|---|---|
| AI literacy | Providers and deployers support staff AI literacy (softened by the Omnibus from a duty to ensure to a duty to support) | February 2, 2025 | Article 4 |
| Prohibited practices | Eight banned uses, including social scoring and untargeted facial image scraping | February 2, 2025 | Article 5 |
| New ban: nudifiers and CSAM | AI systems that generate non-consensual intimate imagery or child sexual abuse material | December 2, 2026 | Article 5 (added by Regulation (EU) 2026/1744) |
| General-purpose AI models | Documentation, copyright policy, training content summary; extra duties for systemic-risk models | August 2, 2025 | Articles 51 to 55 |
| Transparency | Chatbot disclosure, machine-readable marking of generated content, deepfake labels | August 2, 2026 (marking grace to December 2, 2026 for existing systems) | Article 50; see our Article 50 guide |
| High-risk, Annex III | Biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice | December 2, 2027 | Articles 6 to 49, Annex III |
| High-risk, Annex I | AI safety components of products under EU product law, such as medical devices and toys | August 2, 2028 | Article 6(1), Annex I |
| Penalties | Fines set by member states and, for general-purpose models, the Commission | August 2, 2025 (Article 99); August 2, 2026 (Article 101) | Articles 99 to 101 |
Who does the EU AI Act apply to?
Article 2 of the Act reaches beyond EU companies. It applies to providers that place AI systems or general-purpose models on the EU market or put them into service in the EU, wherever the provider is established. It applies to deployers, meaning organisations using an AI system under their authority, that are located in the EU. And it applies to providers and deployers outside the EU where the output of the system is used in the EU. Importers, distributors and product manufacturers that integrate AI also carry duties.
The regulation carves out several areas. It does not apply to AI used exclusively for military, defence or national security purposes, to AI developed and used solely for scientific research, or to individuals using AI in a purely personal, non-professional activity. Most open-source releases are exempt from parts of the regime, but not when the system is prohibited, high-risk or subject to Article 50, and not for general-purpose models with systemic risk.
In practice, a US company offering a chatbot or an image generator to EU users is a provider under the Act, and an EU employer using third-party hiring software is a deployer of a high-risk system once the Annex III rules apply in December 2027.
EU AI Act risk categories in brief
The Commission's own summary groups AI systems into four levels of risk. Each level carries a different legal consequence.
Unacceptable risk: prohibited practices
Article 5 has banned eight practices since February 2, 2025. The Commission lists them as harmful AI-based manipulation and deception; harmful exploitation of vulnerabilities; social scoring; individual criminal offence risk assessment or prediction; untargeted scraping of the internet or CCTV to build facial recognition databases; emotion recognition in workplaces and education; biometric categorisation to deduce protected characteristics; and real-time remote biometric identification for law enforcement in publicly accessible spaces, subject to narrow exceptions. The Commission published guidelines on prohibited practices with examples. The Omnibus adds a ninth ban, on AI systems that generate non-consensual sexually explicit content or child sexual abuse material, from December 2, 2026.
High risk
High-risk systems are those used as safety components of regulated products (Annex I) and those used in the sensitive areas listed in Annex III, such as hiring, credit scoring, exam scoring and border control. Providers must run risk management, use quality data, keep logs, prepare technical documentation, enable human oversight and meet the accuracy, resilience and cybersecurity standards of Article 15, then pass a conformity assessment before placing the system on the market.
Transparency risk
Article 50 covers systems that interact with people or generate content. Chatbots must disclose that the user is dealing with a machine, providers of generative AI must mark outputs in a machine-readable way, and deployers must label deepfakes and AI-generated text published to inform the public on matters of public interest. Our Article 50 deep dive covers these duties in detail.
Minimal risk
Everything else, which the Commission says is the large majority of AI in use in the EU, carries no new obligations under the Act beyond the general AI literacy duty. Spam filters and AI in video games are the Commission's own examples.
Is the EU AI Act in force? What applies now and what comes later
Yes. The Act has been in force since August 1, 2024, but its obligations apply in stages. As of November 9, 2026, four sets of rules are live.
Bans and AI literacy (since February 2, 2025)
The eight Article 5 prohibitions and the Article 4 AI literacy measure have applied since February 2025. The Omnibus softened Article 4: according to White & Case's July 2026 alert, providers and deployers must now take measures to support AI literacy among staff rather than ensure a sufficient level of it.
General-purpose AI models (since August 2, 2025)
All providers of general-purpose AI models must keep technical documentation, give information to downstream providers, adopt a policy to comply with EU copyright law, and publish a summary of the content used for training. Providers of models with systemic risk must also evaluate and mitigate those risks, report serious incidents and secure their models. In July 2025 the Commission published scope guidelines, a training content summary template and the voluntary General-Purpose AI Code of Practice to support compliance. The Commission's AI Office has held enforcement powers over these models, including fines, since August 2, 2026.
Transparency and general application (since August 2, 2026)
Article 50 and the governance and enforcement framework apply from August 2, 2026. Gibson Dunn's May 2026 alert stresses that the Omnibus left Article 50 largely on its original schedule. The one change is a grace period: generative systems placed on the market before August 2, 2026 have until December 2, 2026 to meet the Article 50(2) marking duty. The Commission has issued guidelines on the transparency obligations and a voluntary Code of Practice on marking and labelling AI-generated content.
The Digital Omnibus changes to high-risk dates
The Commission proposed the Digital Omnibus on AI on November 19, 2025. After a provisional agreement in May 2026, it was published as Regulation (EU) 2026/1744 on July 24, 2026 and entered into force on July 27, 2026, days before the original August 2026 high-risk deadline. It replaced the Commission's proposed conditional trigger with fixed dates: December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems. It also narrowed the definition of safety component, extended SME relief to small mid-caps, expanded the AI Office's supervision of systems built on general-purpose models, and moved the deadline for national regulatory sandboxes to August 2, 2027.
What comes later
December 2, 2026 brings the new nudifier and CSAM ban and the end of the marking grace period. December 2, 2027 brings the Annex III high-risk rules. August 2, 2028 brings the Annex I rules for AI in regulated products. General-purpose models already on the market before August 2, 2025 have until August 2, 2027 to comply under Article 111.
EU AI Act fines and enforcement
Article 99 of the AI Act sets three fine ceilings, each the higher of a fixed sum or a share of total worldwide annual turnover for the preceding financial year:
- Up to EUR 35 million or 7 percent for breaching the Article 5 prohibitions.
- Up to EUR 15 million or 3 percent for breaching most other obligations, including high-risk and Article 50 duties.
- Up to EUR 7.5 million or 1 percent for supplying incorrect, incomplete or misleading information to authorities.
For SMEs and start-ups the ceiling is whichever of the two amounts is lower. Fines for providers of general-purpose AI models are set separately in Article 101, at up to EUR 15 million or 3 percent, and are imposed by the Commission rather than national authorities.
Enforcement is split. National market surveillance authorities supervise most AI systems, and the Commission's AI Office supervises general-purpose models and, after the Omnibus, AI systems built on a provider's own general-purpose model and AI integrated into very large online platforms and search engines. The AI Board, a scientific panel and an advisory forum support the system.
EU AI Act full text and PDF
The authoritative text is published on EUR-Lex, the EU's official law portal. The original regulation is available as Regulation (EU) 2024/1689 in the Official Journal, with HTML and PDF versions in all 24 official languages, and the amending act is Regulation (EU) 2026/1744. EUR-Lex also publishes consolidated versions that fold amendments into the base text; check the consolidation date before relying on one, because a consolidation can lag behind a recent amendment.
For article-by-article reading, the Commission runs the AI Act Service Desk and Single Information Platform, which links each article and annex with Commission guidance. The Act has 113 articles and 13 annexes; the recitals at the front are not binding but explain how the drafters meant the articles to be read.
Providers of AI systems and general-purpose models in the EU already have live obligations: the bans, the AI literacy duty, the general-purpose model rules and the Article 50 transparency rules all apply now. The Digital Omnibus pushed most high-risk duties to December 2, 2027 and August 2, 2028, and a new nudifier and CSAM ban starts December 2, 2026. Fines reach EUR 35 million or 7% of worldwide annual turnover.
What changed
- 2026-08-02: Article 50 transparency rules, governance and the Commission's enforcement powers over general-purpose models began to apply.
- 2026-07-27: Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force: Annex III high-risk to December 2, 2027, Annex I to August 2, 2028, new nudifier and CSAM ban from December 2, 2026.
- 2026-05-07: Provisional political agreement reached on the Digital Omnibus on AI.
- 2025-11-19: Commission proposed the Digital Omnibus on AI.
- 2025-08-02: General-purpose AI model obligations began to apply.
- 2025-02-02: Article 5 prohibitions and the Article 4 AI literacy duty began to apply.
- 2024-08-01: AI Act entered into force.
Frequently asked questions
What is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689, the European Union's risk-based law on artificial intelligence. It bans some uses, sets strict duties for high-risk systems, requires disclosure for chatbots and AI-generated content, and regulates general-purpose AI models. It applies directly in all 27 member states.
Who does the EU AI Act apply to?
It applies to providers that place AI systems or general-purpose models on the EU market, wherever they are based, to deployers using AI in the EU, and to non-EU providers and deployers whose AI output is used in the EU. Military, national security, pure research and personal non-professional use are excluded.
Is the EU AI Act in force?
Yes. It entered into force on August 1, 2024. As of November 9, 2026, the bans, AI literacy, general-purpose model rules and Article 50 transparency rules apply. Most high-risk obligations apply from December 2, 2027 or August 2, 2028 after the Digital Omnibus.
Where can I read the EU AI Act full text?
The official text is on EUR-Lex as Regulation (EU) 2024/1689, in HTML and PDF in every official EU language. The 2026 amendments are in Regulation (EU) 2026/1744. The Commission's AI Act Service Desk links each article to its guidance.
Sources
- EUR-Lex: Regulation (EU) 2024/1689, Official Journal
- EUR-Lex: Regulation (EU) 2024/1689, CELEX record
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
- European Commission: AI Act policy page and timeline
- European Commission: General-Purpose AI Code of Practice
- European Commission: guidelines on prohibited AI practices
- European Commission: Code of Practice on AI-generated content
- European Commission: AI Act Service Desk
- White & Case: EU AI Omnibus enters into force
- Gibson Dunn: EU AI Act Omnibus agreement
This page is journalism and commentary, not legal advice. AI law changes quickly; check the primary sources above and consult qualified counsel for your situation.