EU Artificial Intelligence Act (AI Act)

The EU Artificial Intelligence Act (Regulation 2024/1689) was adopted on 13 June 2024 and published in the Official Journal on 12 July 2024. It entered into force on 1 August 2024, with a phased implementation timeline extending through August 2027. It is the world's first comprehensive legal framework governing artificial intelligence.

The AI Act takes a risk-based approach, categorising AI systems into four risk levels. Unacceptable risk AI systems are prohibited outright: these include social scoring by public authorities, real-time remote biometric identification in publicly accessible spaces (with narrow exceptions for law enforcement), emotion recognition in workplaces and educational institutions, and AI systems that exploit vulnerabilities of specific groups.

High-risk AI systems — used in critical infrastructure, education, employment, essential services, law enforcement, migration, and the administration of justice — must meet stringent requirements before being placed on the EU market. These include risk management systems, data governance, technical documentation, record-keeping, transparency and information to deployers, human oversight, accuracy, robustness, and cybersecurity.

General-purpose AI (GPAI) models face specific transparency obligations, including publishing training content summaries, complying with EU copyright law, and publishing a sufficiently detailed summary of training data. GPAI models with systemic risk (identified by computing power thresholds of 10^25 FLOPs or by Commission designation) face additional obligations: model evaluation, adversarial testing, incident tracking and reporting to the AI Office, and adequate cybersecurity.

Limited-risk AI systems (such as chatbots and deepfake generators) must meet transparency requirements, ensuring users know they are interacting with AI or viewing AI-generated content. Minimal-risk AI systems (like spam filters and AI-enabled video games) may be used freely without additional obligations.

Implementation follows a staggered timeline: prohibited practices provisions apply from February 2025; GPAI model and governance rules from August 2025; most high-risk system obligations from August 2026; and certain high-risk categories integrated into existing sectoral legislation from August 2027. The European AI Office coordinates enforcement, supported by national market surveillance authorities.