The EU AI Act — Regulation (EU) 2024/1689 — is the European Union's law on artificial intelligence. It sorts AI uses by risk and sets obligations for the providers who build AI systems and the deployers who use them, from outright bans to human oversight, logging and transparency duties.
Also called: AI Act, Artificial Intelligence Act, EU AI regulation, European AI regulation, Regulation (EU) 2024/1689
The Act regulates uses of AI rather than the technology itself, and the obligations scale with risk. A short list of practices is prohibited outright — for example social scoring, manipulative techniques that cause significant harm, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces and schools, with narrow exceptions. High-risk systems are those used in sensitive areas listed in the Act, such as evaluating the creditworthiness of individuals, recruitment and employment decisions, access to education and essential services, and certain uses by public authorities; they also include AI that is a safety component of regulated products.
High-risk systems carry the heaviest duties. Providers need risk management, data governance, technical documentation, automatic record-keeping, transparency towards deployers, human oversight by design, and appropriate accuracy, robustness and cybersecurity, followed by a conformity assessment. Deployers must use the system according to its instructions, assign human oversight to people with the competence and authority to intervene, monitor its operation, keep the logs it generates for at least six months where they control them, and inform affected people in certain cases. Some deployers — public bodies, and firms using AI for credit scoring or life and health insurance pricing — must also carry out a fundamental rights impact assessment.
General-purpose AI models, such as the large language models behind most AI agents, have their own obligations for their providers: technical documentation, information for downstream developers, a copyright policy and a training-data summary, with additional duties for models that pose systemic risk. Lower-risk uses mainly carry transparency duties: people must be told when they are interacting with an AI system, and synthetic content must be labelled as such.
The timeline is staged, and it changed in 2026. The Act entered into force on 1 August 2024. The prohibitions and the AI literacy duty applied from 2 February 2025, general-purpose AI obligations from 2 August 2025, and the transparency duties of Article 50 from 2 August 2026. The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since 27 July 2026 — moved the high-risk obligations for the use cases listed in Annex III, such as credit scoring and recruitment, from August 2026 to 2 December 2027, and those for AI built into products regulated under Annex I to 2 August 2028. It also gave providers of generative AI systems already on the market until 2 December 2026 to mark synthetic content, added two prohibited practices from the same date — AI that generates non-consensual intimate imagery of identifiable people and AI that generates child sexual abuse material — softened the wording of the AI literacy duty and extended SME relief to small mid-cap companies. The delay is a grace period, not a repeal: the high-risk requirements themselves stay largely as they were.
A worked example from banking: a credit-scoring model for consumer loans is high-risk, so by 2 December 2027 the bank as deployer needs documented human oversight, monitoring, retained logs and a fundamental rights impact assessment. An internal AI agent that drafts answers to staff questions from procedure manuals is generally not high-risk, but the same governance — ownership, approval, logging, testing — is still how the bank shows it is in control. A customer-facing assistant must tell customers they are talking to AI.
Two misreadings are common. One is that the Act only concerns companies that build AI; deployers have obligations of their own. The other is that compliance is a document exercise; most duties ask for evidence produced in operation — logs, oversight records, test results — which is far easier when the platform generates it on every run. Penalties reach up to €35 million or 7% of worldwide annual turnover for prohibited practices. This entry is a summary, not legal advice.
Frequently asked questions
When does the EU AI Act apply?
It entered into force on 1 August 2024 and applies in stages: prohibitions and AI literacy from 2 February 2025, general-purpose AI obligations from 2 August 2025, transparency duties from 2 August 2026, high-risk obligations for Annex III use cases from 2 December 2027 and for AI in regulated products from 2 August 2028. The last two dates were set by the Digital Omnibus, Regulation (EU) 2026/1744.
Was the EU AI Act delayed?
Partly. The Digital Omnibus on AI, adopted in July 2026 as Regulation (EU) 2026/1744, postponed the high-risk obligations — to 2 December 2027 for the Annex III use cases and 2 August 2028 for AI in regulated products. The prohibitions, the general-purpose AI duties and most transparency duties were not delayed.
What does EU AI Act compliance involve for a company that uses AI?
An inventory of AI systems, a risk classification of each use, a check against the prohibited practices, AI literacy for staff, transparency notices and — for high-risk uses — human oversight, monitoring, log retention and in some cases a fundamental rights impact assessment. Our EU AI Act compliance checklist walks through each step.
Does the EU AI Act apply to companies outside the EU?
Yes, when they place AI systems on the EU market or when the output of their AI systems is used in the EU. It applies to providers and deployers regardless of where they are established in those cases.
Is an internal AI agent high-risk under the EU AI Act?
Usually not, unless it is used for one of the listed high-risk purposes, such as credit decisions about individuals or employment decisions. Transparency duties can still apply when it interacts with people.
What do deployers of high-risk AI have to do?
Use the system as instructed, assign competent human oversight, monitor its operation, keep the logs it generates for at least six months where they control them, inform affected people where required, and in some cases carry out a fundamental rights impact assessment.
This site needs JavaScript for the full experience. Every page above is reachable without it.