The EU AI Act is Regulation (EU) 2024/1689, the European Union law that sets harmonized, risk-based rules for placing artificial intelligence systems on the market, putting them into service and using them in the EU. In AI regulation it is the first comprehensive horizontal statute: instead of governing one sector, it classifies AI uses by the risk they pose to health, safety and fundamental rights and attaches obligations proportionate to that risk.
The regulation entered into force on 1 August 2024 and applies in stages through 2027. It reaches providers, deployers, importers and distributors, including organizations outside the EU whose AI systems or outputs are used in the Union. This page describes the law for orientation only; it is not legal advice, and several implementation details remain subject to change.
How the EU AI Act classifies risk
The EU AI Act sorts AI systems into four risk tiers, and the tier, not the underlying technology, decides which duties apply. A simple chatbot and a credit-scoring model may use similar techniques, yet they fall under very different obligations because their consequences for people differ.
The table summarizes the tiers, their typical content and the legal consequence attached to each.
| Risk tier | Typical examples | Legal consequence |
|---|---|---|
| Unacceptable risk | Social scoring, manipulative techniques, untargeted facial image scraping | Prohibited outright |
| High risk | Hiring tools, credit scoring, safety components of regulated products | Strict requirements and conformity assessment |
| Limited risk | Chatbots, emotion recognition, synthetic content | Transparency obligations |
| Minimal risk | Spam filters, recommendation of video game levels | No specific obligations, voluntary codes |
General-purpose AI models sit beside this pyramid as a separate category. Their providers carry duties regardless of the downstream use, and models trained with more than 10^25 floating-point operations are presumed to pose systemic risk, which adds evaluation, incident reporting and cybersecurity duties.
Key obligations for providers and deployers
Most of the regulatory weight falls on the provider of a high-risk AI system, the party that develops it and places it on the market under its own name. The deployer, the organization using the system under its authority, carries a lighter but real set of duties.
| Role | Core obligations | Typical evidence |
|---|---|---|
| Provider | Risk management, data governance, technical documentation, logging, accuracy and robustness | Technical file, EU declaration of conformity, CE marking |
| Provider | Quality management system and post-market monitoring | QMS procedures, monitoring plan, incident records |
| Deployer | Use according to instructions, human oversight, input data relevance, log retention | Oversight assignments, retained logs |
| Public-sector deployer | Fundamental rights impact assessment before first use | Documented assessment notified to the authority |
| Importer and distributor | Verify conformity marking and documentation before supply | Checks recorded in supply records |
High-risk systems must allow effective human oversight, keep automatic event logs, and achieve an appropriate level of accuracy, robustness and cybersecurity over their lifecycle. Serious incidents must be reported to market surveillance authorities within strict deadlines. A deployer that substantially modifies a system or rebrands it can become a provider in law, a shift many organizations overlook.
Independent of risk tier, every provider and deployer must take measures to ensure sufficient AI literacy among staff who operate AI systems, and limited-risk systems must disclose that people are interacting with AI or viewing AI-generated or manipulated content.
Application timeline and open details
The EU AI Act applies in staggered phases so that organizations and standardization bodies have time to prepare. The dates below are those set in the adopted text; later amendments may move some of them.
| Date | What starts to apply | Status note |
|---|---|---|
| 1 August 2024 | Entry into force | Fixed |
| 2 February 2025 | Prohibited practices and AI literacy duty | In application |
| 2 August 2025 | GPAI model obligations, governance, penalties | In application; older models have until August 2027 |
| 2 August 2026 | Most remaining rules, including Annex III high-risk systems | Subject to proposed postponement |
| 2 August 2027 | High-risk systems embedded in Annex I regulated products | Subject to proposed postponement |
In late 2025 the European Commission proposed, as part of a Digital Omnibus package, to link the high-risk deadlines to the availability of harmonized standards and support tools, which could push them back by up to roughly a year or more. Because such amendments go through the legislative process, readers should verify the currently applicable dates before planning compliance work. Guidelines, codes of practice and harmonized standards from CEN and CENELEC are also still being finalized.
How the EU AI Act relates to other frameworks
The EU AI Act is binding product-safety-style legislation, which separates it from voluntary frameworks and from laws with narrower scope. It works alongside the GDPR rather than replacing it: processing of personal data by an AI system must satisfy both regimes at once.
| Instrument | Nature | Main difference from the EU AI Act |
|---|---|---|
| GDPR | Binding EU regulation on personal data | Protects data subjects; does not classify AI by risk |
| NIST AI RMF | Voluntary US risk management framework | No legal force or conformity assessment |
| ISO/IEC 42001 | Certifiable management system standard | Organizational process, not market access rules |
| Colorado AI Act | US state law on consequential decisions | Narrower scope focused on algorithmic discrimination |
Oversight is split between national market surveillance authorities and the EU AI Office within the Commission, which supervises general-purpose AI models. Fines reach EUR 35 million or 7 percent of worldwide annual turnover for prohibited practices, and EUR 15 million or 3 percent for most other breaches, with lower caps for small and medium-sized enterprises.
Common misunderstandings and compliance pitfalls
- The act does not ban AI in general. Only a short list of practices is prohibited; most systems face no specific duties.
- Location of the company is not decisive. A non-EU provider is covered when its system or output is used in the Union.
- Classification is use-based. The same model can be minimal risk in one product and high risk in a hiring tool.
- Open-source release is not a full exemption. It does not cover prohibited, high-risk or systemic-risk models.
- Compliance is continuous. Post-market monitoring and incident reporting last for the whole lifecycle.
In everyday language
The EU AI Act is a rulebook for artificial intelligence in Europe. It works a bit like safety rules for cars or toys: the more harm a product could cause, the more checks it must pass before anyone can sell it.
A handful of uses, such as scoring citizens for their social behavior, are simply banned. Tools that decide on jobs, loans or schooling must be tested, documented and supervised by people. Chatbots must say they are machines. The key idea is that the risk of the use sets the strictness of the rules.
Seen in the real world
A mid-sized software company outside the EU sells a CV-screening tool to employers in Germany and Spain. Because recruitment is listed in Annex III, the tool is a high-risk AI system, and the company is its provider even though it has no EU office. It appoints an authorized representative in the Union, builds a risk management process, documents the training data and tests the model for bias across applicant groups.
Its customers, as deployers, assign trained HR staff to review every rejection the tool suggests and keep the logs for the required period. When one customer starts using the tool to rank internal promotions, the provider updates its intended-purpose statement and documentation. The result is a product that can stay on the EU market, with evidence ready if a national authority asks for it.