EU AI Act

What is the EU AI Act?

The EU AI Act is the European Union's risk-based law on artificial intelligence, Regulation (EU) 2024/1689. The European Parliament and the Council adopted it, and the Commission's AI Office and Member State authorities enforce it. It binds providers, deployers, importers and distributors of AI systems in scope, including some outside the EU.

The full title is Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. The current text is the consolidated version of 27 July 2026, which includes the AI Omnibus changes. The Commission's AI Act page tracks the timeline.

The AI Omnibus Regulation amends the Act. The Commission proposed it on 19 November 2025, a political agreement followed on 7 May 2026, and it came into force on 27 July 2026. It moves the high-risk Annex III rules to 2 December 2027 and the Annex I product rules to 2 August 2028. It also bans AI systems that create non-consensual intimate images or child sexual abuse material, such as nudification apps, from 2 December 2026.

Why it matters

An EU customer's procurement team asks which risk level your AI feature falls into. Nobody has classified it, and the deal waits on the answer.

The Act applies to non-EU providers and deployers whose AI output is used in the Union, so a firm with no EU office can still be in scope. Breaching the Article 5 bans carries fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher.

EU AI Act compliance begins with an inventory of the AI you build, buy and run, with each system given a risk level.

You cannot comply with a risk tier you have not assigned.

Who it applies to

The Act is mandatory EU regulation, binding in its entirety and directly applicable in all Member States. Under Article 2 it covers:

• providers placing AI systems or general-purpose AI models on the EU market, wherever they are established;
• deployers of AI systems established or located in the EU;
• providers and deployers in a third country, where the AI system's output is used in the Union;
• importers, distributors and product manufacturers that place AI systems on the market under their own name.

It does not apply to AI used only for military, defence or national security, to AI built solely for scientific research, to testing before an AI system reaches the market, or to people using AI for purely personal purposes. Free and open-source AI is also outside it, unless it is high-risk, banned or subject to the transparency rules. Minimal-risk systems have no specific rules, but their providers and deployers still owe the AI literacy duty in Article 4.

The Act sits alongside the GDPR, which still governs any personal data an AI system processes.

ISO 27001 certifies an information security management system; the EU AI Act regulates AI systems by risk level. They meet where a high-risk system must show robustness, accuracy and cybersecurity: an ISO 27001 programme supplies security controls, but the Act reaches conformity through its own requirements and harmonised standards. ISO/IEC 42001, the AI management system standard, is the closer companion.

The UK position

The UK is not an EU Member State, but the Act does not stop at the EU border. A UK firm meets it in three situations:

• Selling into the EU. A UK provider that places an AI system on the EU market is in scope, irrespective of where it is established.
• Output used in the EU. UK providers and deployers whose AI system's output is used in the Union fall under Article 2.
• High-risk systems. Providers established in third countries must appoint, by written mandate, an authorised representative established in the Union before making high-risk AI systems available on the EU market.

A UK firm with no EU customers and no AI output used in the Union has no obvious exposure. The Regulation text on EUR-Lex sets out Article 2 and Article 22.

Key requirements

The Act sets four risk levels, and the duties follow the level:

1. Unacceptable risk. Banned practices under Article 5, such as social scoring and emotion recognition at work, mostly applying since 2 February 2025.
2. High-risk. The heaviest requirements, set out below.
3. Transparency risk. People must be told when they are dealing with a chatbot, and AI-generated content such as deep fakes must be identifiable, from 2 August 2026.
4. Minimal or no risk. No specific rules. Most AI in use in the EU, such as spam filters, sits here.

High-risk systems

High-risk AI systems must meet requirements on:

• risk management;
• the quality and relevance of data sets (data governance);
• technical documentation and record-keeping;
• transparency and the provision of information to deployers;
• human oversight;
• robustness, accuracy and cybersecurity.

A high-risk system that meets harmonised standards published in the Official Journal is presumed to meet these requirements. The European standards bodies CEN, CENELEC and ETSI are permanent members of the Act's advisory forum.

Application dates

• 2 February 2025: most prohibited practices and AI literacy obligations.
• 2 August 2025: general-purpose AI model obligations and governance provisions.
• 2 August 2026: the general date of application, including the transparency rules.
• 2 December 2026: the bans added by the AI Omnibus.
• 2 December 2027: high-risk Annex III rules, as moved by the AI Omnibus.
• 2 August 2028: Annex I product rules, as moved by the AI Omnibus.

Frequently asked questions