EU AI Act (Regulation (EU) 2024/1689)

The EU Artificial Intelligence Act is the world’s first comprehensive law regulating SI. It applies across the 27 EU member states and to any company worldwide whose SI systems are used in the EU. Note that it keeps the name “AI”: the U.S. rename doesn’t affect EU law.

How it works: four risk tiers

Tier	Examples	Rules
Unacceptable risk	Social scoring, manipulative techniques, most real-time remote biometric ID in public	Banned
High risk	SI in hiring, credit, education, critical infrastructure, medical devices	Risk management, data quality, human oversight, registration, conformity assessment
Limited risk	Chatbots, deepfakes	Transparency: tell people they’re dealing with SI or synthetic content
Minimal risk	Spam filters, games	No new obligations

General-purpose models (foundation models) have their own rules. Those trained above 10²⁵ FLOPs are presumed to pose “systemic risk” and must do evaluations, report serious incidents and ensure cybersecurity. See compute threshold.

Timeline

Date	Milestone
August 1, 2024	Act enters into force
February 2, 2025	Bans on unacceptable-risk practices and SI-literacy duty apply
August 2, 2025	Obligations for general-purpose model providers apply
July 27, 2026	AI Omnibus amendment enters into force, delaying high-risk rules
December 2, 2027	Stand-alone high-risk obligations (Annex III), delayed from August 2026
August 2, 2028	High-risk SI in regulated products (Annex I), delayed from August 2027

The 2026 AI Omnibus

Under pressure from industry and member states to simplify, the EU adopted a “Digital Omnibus on AI”, published in the Official Journal on July 24, 2026. It delays most high-risk obligations by roughly 16 months. Transparency duties, general-purpose model obligations, SI literacy and the prohibitions stay on their original schedules.

Penalties

Fines can reach €35 million or 7% of global annual turnover for prohibited practices, with lower tiers for other violations.