The European Union’s Artificial Intelligence Act is the first broad law anywhere that regulates AI systems by what they are used for. It entered into force on August 1, 2024 and is being phased in over several years. In July 2026 the EU amended it with a package called the Digital Omnibus on AI, which pushed back the biggest compliance deadlines and added a new ban. This article explains the structure of the law, the current timetable and the arguments over it.
In the United States there is still no federal AI law of this kind; the fight over who should write the rules is covered in who gets to regulate AI.
The basic idea: rules scale with risk
The AI Act does not regulate “AI” as a technology. It regulates uses of AI, sorted into four tiers:
| Tier | Examples | What the law does |
|---|---|---|
| Unacceptable risk | Social scoring, untargeted scraping of faces to build recognition databases | Banned outright |
| High risk | AI used in hiring, credit scoring, exams, border control, medical devices | Strict requirements before and after the system is sold or used |
| Limited risk | Chatbots, AI-generated images, audio and video | Transparency: people must be told they are dealing with AI or seeing AI-made content |
| Minimal risk | Spam filters, AI in video games, most business software | No new obligations |
Most AI in everyday use falls in the bottom tier. The law’s weight lands on a relatively small set of uses where a mistake can cost someone a job, a loan, their liberty or their safety.
A separate set of rules covers general-purpose AI models, the large models such as those behind chatbots, which can be built into many different products.
What is banned
Since February 2, 2025, the following AI practices have been prohibited in the EU:
- manipulative or deceptive techniques, including subliminal ones, that distort people’s behavior in ways likely to cause significant harm;
- exploiting people’s vulnerabilities because of their age, disability or social or economic situation;
- social scoring that leads to unjustified or disproportionate bad treatment;
- predicting whether a person will commit a crime based solely on profiling or personality traits;
- building facial recognition databases by untargeted scraping of images from the internet or CCTV;
- emotion recognition in workplaces and schools, except for medical or safety reasons;
- biometric categorization to infer sensitive traits such as race, political opinions, religion or sexual orientation;
- real-time remote biometric identification, such as live facial recognition, in public spaces for law enforcement, except in narrowly defined cases like searching for a missing child or preventing an imminent terrorist threat, usually with prior approval from a court or independent authority.
The 2026 amendments add one more: AI systems built to generate non-consensual intimate images of real people (so-called “nudify” apps) or child sexual abuse material. That ban applies from December 2, 2026.
What “high-risk” means and what it requires
There are two routes into the high-risk category:
- AI in regulated products. AI that is a safety component of products already covered by EU safety law, such as medical devices, toys, lifts and vehicles (Annex I of the Act).
- AI in sensitive areas. Stand-alone systems used in eight listed areas (Annex III): biometrics; critical infrastructure; education, such as grading exams or deciding admissions; employment, such as screening CVs or deciding promotions; access to essential services, such as credit scoring, public benefits and life or health insurance pricing; law enforcement; migration and border control; and the administration of justice and elections.
A system in one of those areas can escape the category if it only performs a narrow procedural task and does not materially influence the decision, but the company must document that judgment and still register the system.
Companies that develop high-risk systems (“providers”) must:
- run a risk management process across the system’s life;
- use training, validation and testing data that is relevant, representative and checked for bias;
- keep technical documentation and automatic logs;
- give clear instructions to the businesses that use the system;
- design for effective human oversight;
- meet standards of accuracy, robustness and cybersecurity;
- pass a conformity assessment, carry a CE mark and register in an EU database before going on sale.
Organizations that use high-risk systems (“deployers”) have their own duties: use the system as instructed, assign trained people to oversee it, keep logs and tell workers and affected people when it is used. Public bodies, and private firms using AI for credit scoring or life and health insurance pricing, must also assess the impact on people’s fundamental rights before first use.
Chatbots, deepfakes and general-purpose models
Transparency rules (Article 50) require that people be told when they are talking to an AI system rather than a person, and that deepfakes be labeled. Providers of generative AI must mark synthetic audio, images, video and text in a machine-readable way so it can be detected. These rules apply from August 2, 2026, with a grace period until December 2, 2026 for the machine-readable marking on generative systems already on the market before August.
General-purpose AI models have been covered since August 2, 2025. Their providers must keep technical documentation, give information to companies building on the model, have a policy for complying with EU copyright law, and publish a summary of the content used for training. Models trained with very large amounts of computing power (above 1025 floating-point operations) are presumed to pose “systemic risk” and must also be evaluated and stress-tested, report serious incidents and protect their security. A voluntary code of practice published in July 2025 sets out one way to comply, and most of the largest developers signed at least part of it.
The timeline, after the 2026 delay
The Commission proposed the Digital Omnibus on AI on November 19, 2025, arguing that technical standards and national regulators were not ready. EU institutions reached a deal in May 2026, and the amending regulation was published in the Official Journal on July 24, 2026. The main dates now are:
| Date | What applies |
|---|---|
| Feb 2, 2025 | Bans on prohibited practices; AI literacy measures |
| Aug 2, 2025 | Rules for general-purpose AI models; penalties regime; governance bodies |
| Aug 2, 2026 | Transparency rules for chatbots and deepfakes; most remaining provisions |
| Dec 2, 2026 | Ban on AI nudification and abuse-imagery systems; end of the grace period for machine-readable marking |
| Aug 2, 2027 | National AI regulatory sandboxes must be running |
| Dec 2, 2027 | High-risk rules for stand-alone systems in sensitive areas (originally Aug 2, 2026) |
| Aug 2, 2028 | High-risk rules for AI in regulated products (originally Aug 2, 2027) |
The Omnibus also softened the AI literacy duty, from requiring companies to ensure staff have sufficient AI literacy to requiring them to take measures to support it, extended some paperwork relief for small and medium-sized businesses to “small mid-caps,” and allowed the use of sensitive personal data to detect and correct bias, with safeguards.
Who it applies to, including U.S. companies
The Act follows the market, not the headquarters. It applies to any company that sells or puts an AI system into service in the EU, and to providers and deployers outside the EU when their system’s output is used in the EU. An American company selling hiring software to a French employer is covered. Non-EU providers of high-risk systems and general-purpose models must appoint a representative in the EU.
It does not apply to AI used only for military or national security purposes, to scientific research and development before a product is released, or to purely personal, non-professional use. Free and open-source models get lighter treatment unless they are high-risk, prohibited or carry systemic risk.
Enforcement and fines
National market surveillance authorities in each member state enforce most of the law. A new AI Office inside the European Commission supervises general-purpose models, and after the Omnibus also oversees AI systems built on a provider’s own general-purpose model. Maximum fines are tiered:
- up to €35 million or 7% of worldwide annual turnover, whichever is higher, for using a prohibited practice;
- up to €15 million or 3% for most other violations, including the duties for high-risk systems and general-purpose models;
- up to €7.5 million or 1% for giving regulators incorrect or misleading information.
For small businesses and startups, the lower of the two amounts applies.
The arguments over it
Supporters say the law protects people in exactly the situations where AI decisions are hardest to challenge, such as hiring, lending and policing, while leaving most AI untouched. They argue that clear rules build trust and that a single EU rulebook is simpler than 27 national ones.
Critics in industry say the requirements are complex and expensive, that guidance and standards arrived late, and that the law could push investment and new products away from Europe. The 2026 delay was largely a response to those concerns.
Civil society groups make the opposite complaint: that the delay and the softer literacy duty weaken protections, that police and migration authorities kept too many exceptions, and that companies get too much room to decide for themselves that their systems are not high-risk.
Whether the AI Act becomes a global template, as the EU’s data protection law did, or a cautionary tale will depend heavily on how it is enforced from 2027 onward.
What to watch
- December 2, 2026: the nudification ban and full machine-readable marking duties apply.
- Harmonized standards and Commission guidelines on high-risk systems, which companies need before the December 2027 deadline.
- The first enforcement actions on prohibited practices and general-purpose models.
- Any further changes. The Omnibus showed the timetable can move; check the latest official text before relying on any date.
For how AI is already being used in political campaigns, see AI deepfakes and elections.