TL;DR
The EU Artificial Intelligence Act (AI Act, Regulation (EU) 2024/1689) is the world's first comprehensive legal framework on AI. It entered into force on August 1, 2024; most rules apply and enforcement starts on August 2, 2026. After the 2026 'AI Omnibus' simplification regulation, high-risk AI rules apply in phases: December 2, 2027 for standalone Annex III systems and August 2, 2028 for Annex I product-embedded systems.
Standard Overview
| Item | Details |
|---|---|
| Legal instrument | Regulation (EU) 2024/1689 (Artificial Intelligence Act) |
| Name | Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence |
| Issuer | European Parliament and Council of the European Union |
| Status | Entered into force August 1, 2024; most rules apply and enforcement starts August 2, 2026 |
| Amendment | 'AI Omnibus' simplification regulation entered into force July 27, 2026 |
Scope
The AI Act applies to any provider or deployer of AI systems whose output is used within the EU, regardless of where the provider is established. It follows a risk-based approach: unacceptable risk (banned), high risk, transparency risk and minimal risk. It does not apply to AI systems used exclusively for military, defence or national security purposes (Article 2).
Key Clause Points
| Date | Applicable content | Affected parties |
|---|---|---|
| 2024-08-01 | Regulation enters into force (Article 113) | All parties |
| 2025-02-02 | Prohibited practices (Article 5, items 1-8) and AI literacy obligations apply | Providers and deployers in the EU |
| 2025-08-02 | Obligations for general-purpose AI (GPAI) models on transparency, copyright and safety apply; governance in place | GPAI model providers |
| 2026-08-02 | Most rules apply and enforcement starts; Article 50 transparency rules (informing users of AI interaction, identifiable synthetic content) | AI system providers and deployers |
| 2026-12-02 | New prohibitions apply: AI systems generating non-consensual sexual deepfakes and child sexual abuse material (including 'nudifier' apps); Article 50(2) transition deadline for synthetic-content labelling | Deepfake and synthetic content systems |
| 2027-08-02 | Member States operate at least one national AI regulatory sandbox | Member States |
| 2027-12-02 | Annex III high-risk AI rules apply (biometrics, critical infrastructure, education, employment, migration, asylum, border control) | High-risk AI providers |
| 2028-08-02 | Annex I high-risk AI embedded in regulated products (e.g. lifts, toys) apply | Embedded high-risk AI providers |
Compliance Advice
- Identify your role: determine whether you act as provider, deployer or GPAI model provider; obligations differ by role (Articles 2-3).
- Build a management system: high-risk and GPAI providers should implement risk assessment, data governance, logging, documentation and human oversight; ISO/IEC 42001:2023 can support alignment.
- Fulfil transparency duties: from August 2, 2026, interactive AI systems (e.g. chatbots) must inform users they are interacting with AI; generative AI must make synthetic content identifiable (Article 50).
- Watch the deadlines: Annex III high-risk systems by December 2, 2027; Annex I product-embedded systems by August 2, 2028; plan 12-24 months of transition.
- Track amendments: the 'AI Omnibus' in force since July 27, 2026 adjusts deadlines and adds a 9th prohibition; base compliance planning on the latest text.