The EU AI Act: how Europe's artificial intelligence law works

A law meant to steer AI, not stop it

The AI Act is the name everyone uses for Regulation (EU) 2024/1689, approved by the European Parliament and the Council on 13 June 2024 and published in the Official Journal of the European Union on 12 July 2024. It entered into force on 1 August 2024, but, as often happens with EU rules of this scale, it didn’t switch on all at once: the underlying logic is that risk, not the technology itself, decides how many obligations apply to an AI system.

The idea is to tell apart a chatbot that suggests recipes from a system that decides who gets hired or who qualifies for a mortgage: the first carries no obligations, the second must meet safety requirements and human oversight before it can reach the market.

Four risk tiers

The regulation sorts AI systems into four categories, with obligations that grow heavier as the risk to people’s safety, rights or livelihood increases.

Risk tier	Examples	What it means
Unacceptable	Government social scoring, subliminal manipulation	Banned
High	Systems in critical infrastructure, law enforcement	Strict requirements (risk management, documentation, human oversight)
Limited	Chatbots, AI-generated or altered content	Transparency duties toward the user
Minimal	Video games, spam filters	No specific obligations

The unacceptable-risk practices are listed one by one in Article 5: manipulative techniques that distort behavior and undermine informed choices, exploitation of vulnerabilities tied to age or disability, unauthorized biometric categorization based on sensitive traits, criminal risk assessment based solely on profiling a person, indiscriminate scraping of photos from the web or CCTV footage to build facial recognition databases, emotion inference in schools and workplaces (except for medical or safety reasons), and “real-time” biometric identification in public spaces for law enforcement purposes, narrowly limited to missing persons or serious threats. As of 2 December 2026, a ban on generating non-consensual intimate images and child sexual abuse material was added to this list.

High-risk systems aren’t banned, but they are closely watched: they need a risk management system running through their whole life cycle, training data checked for quality and representativeness, technical documentation, logging capabilities, a human oversight mechanism, and a conformity marking before reaching the market. It’s the same principle that has long governed medical devices or toys: before you sell it, you prove the product is safe.

Practical example: software that screens job applications is high-risk: it must show that the data it was trained on doesn’t systematically discriminate against a group of candidates, and a human must be able to review its decisions. A filter that just sorts emails by date, on the other hand, is minimal-risk: no obligations, no oversight.

General-purpose AI (GPAI) models

A separate part of the regulation deals with general-purpose AI models (GPAI): the large models capable of writing text, generating images or answering questions on almost any topic, the same family of systems behind generative AI. From 2 August 2025, whoever provides them must prepare technical documentation, share information with downstream providers, comply with copyright obligations and publish a sufficiently detailed summary of the content used for training. Open-source or free models are exempt from most of these duties, unless they cross a precise line: above 10^25 FLOPs of training compute, a model is classified as carrying “systemic risk”, and its providers are also asked to run adversarial testing, assess systemic risks and report serious incidents to the AI Office.

Behind any of these models, generative or not, sits the same underlying method: learning from enormous amounts of data instead of following hand-written rules, as covered in the article on machine learning, often built with many-layered neural networks.

The fines: up to 7% of worldwide turnover

Article 99 sets three tiers of fines, scaled to the severity of the violation. For banned unacceptable-risk practices, fines reach 35 million euros or 7% of the company’s annual worldwide turnover, whichever is higher. For other obligations in the regulation, such as the requirements for high-risk systems, the cap drops to 15 million euros or 3% of turnover. For incomplete, incorrect or misleading information supplied to authorities, it goes up to 7.5 million euros or 1% of turnover. There’s a clause built to avoid crushing smaller businesses, though: for SMEs, including start-ups, the lower amount between percentage and fixed figure always applies, while large companies face the reverse rule and always pay the higher amount.

A staggered timeline, already amended once

The regulation doesn’t switch on all at once: Article 113 sets out a phased application, with obligations that grow tougher as each reference date passes.

Date	What applies
2 February 2025	General provisions and bans on prohibited practices
2 August 2025	Governance, GPAI model obligations, penalty framework
27 July 2026	Amendments to other EU harmonization rules
2 August 2026	General application of the regulation
2 December 2026	Ban on non-consensual intimate deepfakes; end of the grace period for transparency on AI-generated content
2 December 2027	Obligations for “stand-alone” high-risk systems
2 August 2028	Obligations for high-risk systems embedded in already-regulated products

The last two dates weren’t the original ones: in July 2026 the Digital Omnibus on AI arrived (Regulation (EU) 2026/1744, approved on 8 July 2026 and in force since 27 July 2026), pushing the obligations for “stand-alone” high-risk systems from 2 August 2026 to 2 December 2027, and those for high-risk systems embedded in products already covered by safety rules (such as machinery or aircraft equipment) from 2 August 2027 to 2 August 2028. The text explicitly states it isn’t introducing a new legal regime, but simplifying the implementation of the existing one and cutting administrative burden.

Who oversees it, and who the obligations fall on

From 2 August 2025, the European Commission’s AI Office oversees providers of GPAI models, with powers to request documentation, assess systems and order corrections; the power to fine GPAI providers (Article 101) only applies from 2 August 2026, alongside the regulation’s general application. An AI Board, a Scientific Panel of independent experts and a technical Advisory Forum provide guidance and advice. Day-to-day market surveillance, that is, checking that a product sold in a single member state meets the requirements, stays with national authorities.

The regulation distinguishes two roles: providers, who develop or commission the development of a system to place it on the market, and deployers, meaning whoever uses it professionally (companies, public administrations, other organizations). Its scope doesn’t stop at the Union’s borders: it also applies to providers from third countries, whenever they place a high-risk system on the EU market or its output is used within the Union anyway: an extraterritorial principle that follows the same logic as other EU digital rules, and one that intersects with the broader rules governing any algorithm tasked with making decisions on sensitive data.