Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU
Current legislation
The Artificial Intelligence Act (AI Act)[1] is a European Union regulation concerning artificial intelligence (AI). It establishes a common regulatory and legal framework for AI within the European Union (EU).[2] The regulation entered into force on 1 August 2024,[3] with provisions that shall come into operation gradually over the following 6 to 36 months.[4]
It covers most AI systems across a wide range of sectors, with exemptions for AI used only for military, national security, research purposes, or for non-professional use.[5] As a form of product regulation, it does not create individual rights; instead, it places duties on AI providers and on organisations that use AI in a professional context.[6][7]
The Act classifies non-exempt AI applications by their risk of causing harm. There are four levels – unacceptable, high, limited, minimal – plus an additional category for general-purpose AI.[8]
Limited-risk applications only have transparency obligations.
Minimal-risk applications are not regulated.
For general-purpose AI, transparency requirements are imposed, with reduced requirements for open source models, and additional evaluations for high-capability models.[9][10]
The Act also creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance with the regulation.[11] Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers from outside the EU if they have users within the EU.[7]
There are different risk categories depending on the type of application, with a specific category dedicated to general-purpose generative AI:
Unacceptable risk – AI applications in this category are banned, except for specific exemptions.[16] When no exemption applies, this includes AI applications that manipulate human behaviour, those that use real-time remote biometric identification (such as facial recognition) in public spaces, and those used for social scoring (ranking individuals based on their personal characteristics, socio-economic status, or behaviour).[10][17]
High-risk – AI applications that are expected to pose significant threats to health, safety, or the fundamental rights of persons. Notably, AI systems used in health, education, recruitment, critical infrastructure management, law enforcement or justice. They are subject to quality, transparency, human oversight and safety obligations, and in some cases require a Fundamental Rights Impact Assessment before deployment.[18][19] A Fundamental Rights Impact Assessment (FRIA) is an ex ante review to identify and mitigate potential impacts on fundamental rights before an AI system is deployed.[18] Earlier work on algorithmic impact assessments has suggested that such tools should identify which individuals and communities are affected by an automated system, describe possible harms, and provide a basis for public and institutional scrutiny of its use.[20] They must be evaluated both before they are placed on the market and throughout their life cycle. The list of high-risk applications can be expanded over time, without the need to modify the AI Act itself.[7] Citizens also have a right to submit complaints about AI systems and to receive explanations of decisions made by high-risk AI that affect their rights.[21]
Limited risk – AI systems in this category have transparency obligations, ensuring users are informed that they are interacting with an AI system and allowing them to make informed choices. This category includes, for example, AI applications that make it possible to generate or manipulate images, sound, or videos (like deepfakes).[10]
Minimal risk – This category includes, for example, AI systems used for video games or spam filters. Most AI applications are expected to fall into this category.[22] These systems are not regulated, and Member States cannot impose additional regulations due to maximum harmonisation rules. Existing national laws regarding the design or use of such systems are overridden. However, a voluntary code of conduct is suggested.[23]
The risk-based scheme follows a product-safety model in which regulatory duties are assigned to the providers and deployers of AI systems, and these duties become more demanding as the potential impact on health, safety, or fundamental rights increases. This structure is meant to ensure that oversight focuses on systems likely to create significant risks while allowing lighter approaches for uses considered less sensitive.[24] Some legal scholars also argue that, in practice, the Act frames "trustworthy AI" as systems that can show compliance with these safety and risk thresholds.[25] According to an initial appraisal by the European Parliamentary Research Service, the Commission's impact assessment drew on stakeholder consultations and a wide range of existing research when comparing policy options for this risk-based framework.[26]
Added in 2023, the general-purpose AI category includes foundation models (for example, ChatGPT) that can perform a wide range of tasks. If a model's weights and design are made open source, developers must publish a training data summary and a copyright policy; closed-source models must meet broader transparency requirements. High-impact models that pose systemic risks (require more than 1025floating-point operations to train)[27] must undergo extra evaluation.[6][10] A General-Purpose AI Code of Practice, published on 10 July 2025, outlines three main chapters on transparency, copyright, and safety and security to help providers demonstrate compliance with the AI Act. Participation in the code is voluntary.[28]
Beyond these basic transparency duties, the Act sets a common list of obligations for providers of general-purpose AI models. They must publish a summary of the training data, adopt a policy to comply with copyright law, and provide technical documentation to downstream providers and supervisory authorities. Models that are designated as posing systemic risk must also carry out model evaluations and adversarial testing, assess and mitigate risks such as bias and security failures, report serious incidents, and ensure an adequate level of cybersecurity.[29]
Exemptions
Articles 2.3 and 2.6 exempt AI systems used for military or national security purposes or pure scientific research and development from the AI Act.[16] In particular, the Regulation does not apply where AI systems are used exclusively for military, defence or national security purposes, or to systems developed and put into service solely for scientific research and development; if such systems are later used for other purposes (for example, civilian or law-enforcement uses), the Act applies.[1] These activities remain governed by separate EU and national rules on defence, security, and intelligence rather than by the AI Act itself.[30]
Article 5.2 bans algorithmic video surveillance of people ("The use of 'real-time' remote biometric identification systems in publicly accessible spaces"[31]) only if it is conducted in real time. Exceptions allowing real-time algorithmic video surveillance include policing aims including "a real and present or real and foreseeable threat of terrorist attack".[16]
Recital 31 of the Act states that it aims to prohibit "AI systems providing social scoring of natural persons by public or private actors", but allows for "lawful evaluation practices of natural persons that are carried out for a specific purpose in accordance with Union and national law."[32]La Quadrature du Net interprets this exemption as permitting sector-specific social scoring systems,[16] such as the suspicion score used by the French family payments agency Caisse d'allocations familiales.[33][16]
Governance
The AI Act establishes various new bodies in Article 64 and the following articles. These bodies are tasked with implementing and enforcing the Act. The approach combines EU-level coordination with national implementation, involving both public authorities and private sector participation.
The following new bodies will be established:[34][35]
AI Office: attached to the European Commission, this authority will coordinate the implementation of the AI Act in all Member States and oversee the compliance of general-purpose AI providers. It can also request information or open investigations when serious issues are suspected.[6]
European Artificial Intelligence Board: composed of one representative from each Member State, the Board will advise and assist the Commission and Member States to facilitate the consistent and effective application of the AI Act. Its tasks include gathering and sharing technical and regulatory expertise, providing recommendations, written opinions, and other advice.
Advisory Forum: established to advise and provide technical expertise to the Board and the Commission, this forum will represent a balanced selection of stakeholders, including industry, start-ups, small and medium-sized enterprises, civil society, and academia, ensuring that a broad spectrum of opinions is represented during the implementation and application process.
Scientific Panel of Independent Experts: this panel will provide technical advice and input to the AI Office and national authorities, enforce rules for general-purpose AI models (notably by launching qualified alerts of possible risks to the AI Office), and ensure that the rules and implementations of the AI Act correspond to the latest scientific findings.
While the establishment of new bodies is planned at the EU level, Member States will have to designate "national competent authorities."[note 1] These authorities will be responsible for ensuring the application and implementation of the AI Act, and for conducting "market surveillance."[36] They will verify that AI systems comply with the regulations, notably by checking the proper performance of conformity assessments and by appointing third-parties to carry out external conformity assessments.
Once harmonised standards for the AI Act are published in the Official Journal, compliant products are presumed to conform with the regulation; these standards are being drafted by CEN/CENELEC Joint Technical Committee 21 (JTC 21).[37]
Enforcement
The Act regulates entry to the EU internal market using the New Legislative Framework. It contains essential requirements that all AI systems must meet to access the EU market. These essential requirements are passed on to European Standardisation Organisations, which develop technical standards that further detail these requirements.[38] These standards are developed by CEN/CENELEC JTC 21.[39]
The Act mandates that member states establish their own notifying bodies. Conformity assessments are conducted to verify whether AI systems comply with the standards set out in the AI Act.[40] This assessment can be done in two ways: either through self-assessment, where the AI system provider checks conformity, or through third-party conformity assessment, where the notifying body conducts the assessment.[23] Notifying bodies also have the authority to carry out audits to ensure proper conformity assessments.[41]
Each EU Member State must also designate a national supervisory authority to monitor compliance, handle complaints, and share information with the European AI Office, which coordinates enforcement across the Union.[6]
Together, these actors form a multi-level supervision system. National market surveillance and supervisory authorities carry out checks and enforce the rules on high-risk AI systems and other regulated uses, while EU-level bodies such as the AI Office and the European Artificial Intelligence Board support implementation of the Act and help ensure consistent application, in particular for general-purpose AI models.[24]
Criticism has arisen regarding the fact that many high-risk AI systems do not require third-party conformity assessments.[42][43][44] Some commentators argue that independent third-party assessments are necessary for high-risk AI systems to ensure safety before deployment. Legal scholars have suggested that AI systems capable of generating deepfakes for political misinformation or creating non-consensual intimate imagery should be classified as high-risk and subjected to stricter regulation.[45] However, the Act does not explicitly mandate specific deepfake detection mechanisms, nor does it comprehensively address the broader human rights implications stemming from the proliferation of such synthetic media.[46]
Penalties
Non-compliance with the prohibitions in Article 5 is subject to administrative fines of up to EUR 35,000,000 or, if the offender is an undertaking, up to 7% of its total worldwide annual turnover, whichever is higher. Other operator obligations may be sanctioned with fines of up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher; providing incorrect, incomplete or misleading information may be fined up to EUR 7,500,000 or 1% of worldwide annual turnover. For SMEs, including start-ups, the applicable cap is the lower of the relevant percentage or the fixed amount. For providers of general-purpose AI models, the Commission may impose separate fines up to EUR 15,000,000 or 3% of worldwide annual turnover in the specific cases listed in Article 101.[1]
Regulatory sandboxes
The Act provides for "regulatory sandboxes", i.e., controlled testing environments run by national competent authorities, where developers can trial AI systems under supervision before placing them on the market, to support innovation while maintaining safeguards. Member States are encouraged to set up such sandboxes under coordinated EU rules, and small and medium-sized enterprises (SMEs) and start-ups may receive priority access to test systems in a compliant setting.[47]
In February 2020, the European Commission published "White Paper on Artificial Intelligence – A European approach to excellence and trust".[48] In October 2020, debates between EU leaders took place in the European Council. On 21 April 2021, the AI Act was officially proposed by the Commission.[12] On 6 December 2022, the European Council adopted the general orientation, allowing negotiations to begin with the European Parliament. On 9 December 2023, after three days of "marathon" talks, the EU Council and Parliament concluded an agreement.[49][50]
The law was passed in the European Parliament on 13 March 2024, when MEPs adopted the final text in plenary session by a vote of 523 for, 46 against, and 49 abstaining.[21] It was approved by the EU Council on 21 May 2024.[14] It entered into force on 1 August 2024,[3] 20 days after being published in the Official Journal on 12 July 2024.[13][51] After coming into force, there will be a delay before it becomes applicable, which depends on the type of application. This delay is 6 months for bans on "unacceptable risk" AI systems, 9 months for codes of practice, 12 months for general-purpose AI systems, 36 months for some obligations related to "high-risk" AI systems, and 24 months for everything else.[51][21]
Legal commentators have described the AI Act as a first-of-its-kind, comprehensive framework for regulating AI across multiple sectors, and as a likely reference point for companies and regulators outside the EU when they design their own approaches to AI governance.[52]
Reactions
Experts have argued that though the jurisdiction of the law is European, it could have far-ranging implications for international companies that plan to expand to Europe.[53]Anu Bradford at Columbia has argued that the law provides significant momentum to the world-wide movement to regulate AI technologies.[53]
Amnesty International stated that, while EU policymakers present the AI Act as a global model for AI regulation, the legislation fails to take basic human rights principles into account and offers only limited protections to impacted and marginalised people. It argued that the Act does not ban the reckless use and export of what it calls "draconian AI technologies", fails to ensure equal protection for migrants, refugees and asylum seekers, and lacks adequate accountability and transparency provisions, which in its view risks exacerbating human rights abuses.[54]
Some tech watchdogs have argued that there were major loopholes in the law that would allow large tech monopolies to entrench their advantage in AI, or to lobby to weaken rules.[55][56] Some startups welcomed the clarification the Act provides, while others argued the additional regulation would make European startups uncompetitive compared to American and Chinese startups.[56] Legal analysis has also suggested that, while the Act may serve as an early reference point for AI governance frameworks, its detailed requirements could add significant compliance complexity for providers operating across multiple jurisdictions.[52]La Quadrature du Net (LQDN) described the AI Act as "tailor-made for the tech industry, European police forces as well as other large bureaucracies eager to automate social control." LQDN described the role of self-regulation and exemptions in the Act to render it "largely incapable of standing in the way of the social, political and environmental damage linked to the proliferation of AI."[16] Commentary on national security has also noted that the Act's sectoral exclusion for security and defence sits alongside separate security frameworks, raising questions about how these exemptions will interact with future security and defence policy.[30] Academic commentary has described the Act as a "medley" of product-safety and fundamental-rights frameworks and has also cautioned that its product-safety approach relies heavily on provider self-assessment, raising concerns about effective enforcement.[23][44] An initial appraisal of the Commission's impact assessment by the European Parliamentary Research Service likewise noted that much of the analysis is qualitative and that some estimates, including for compliance costs under the different options, depend on modelling assumptions and available evidence.[26] Some scholars also note that linking "trustworthy AI" to compliance with these risk thresholds can make the underlying policy choices about what levels of risk are acceptable less visible.[25] Separate proposals for algorithmic impact assessments, such as a framework developed by the AI Now Institute for public agencies, argue that impact assessments should map affected communities, examine fairness, bias and due process, and allow ongoing public and researcher scrutiny of automated decision systems.[20]
A broad civil society coalition coordinated by European Digital Rights (EDRi) published a joint analysis comparing the final AI Act with its earlier demands and concluded that the law falls short of what is needed to protect rights to privacy, equality, non-discrimination and the presumption of innocence. The coalition also called for stronger safeguards for people on the move and for people with disabilities, arguing that the final rules leave significant gaps in these areas.[57]
Organisations representing authors, performers, publishers and producers have also criticised the implementation of the Act, particularly its rules for general-purpose AI. A joint statement from 38 global creators' organisations, reported by Le Monde, argued that the Code of Practice, the guidelines for general-purpose AI and the template for training-data summaries under Article 53 do not adequately protect intellectual property rights or ensure sufficient transparency about the data used to train generative AI models, describing the outcome as a missed opportunity to deliver on the Act's stated goals. This criticism has been discussed as part of wider debates about how the AI Act and its general-purpose AI provisions may affect the position of cultural and creative industries in the EU.[58]
Building on these critiques, scholars have raised concerns in particular about the Act's approach to regulating the secondary uses of trained AI models, which may have significant societal impacts.[59][60] They argue that the Act's narrow focus on deployment contexts and reliance on providers to self-declare intended purposes creates opportunities for misinterpretation and insufficient oversight.[60] Additionally, the Act often exempts open-source models and neglects critical lifecycle phases, such as the reuse of trained models.[59] Trained models store decision-mappings as parameters that approximate patterns from the training data. This "model data" is distinct from the original training data and is typically classified as non-personal, as it often cannot be traced back to individual data subjects. Consequently, it falls outside the scope of other regulations like the GDPR.[59] Some scholars also criticize the AI Act for not sufficiently regulating the reuse of model data, warning of potentially harmful consequences for individual privacy, social equity, and democratic processes.[59] Other commentators have also questioned the democratic legitimacy, transparency, and practical enforceability of the new rules for general-purpose AI, noting that their impact will depend on how oversight bodies apply them over time.[29]
↑Defined in the regulation[1] in Article 3, §48: "'national competent authority' means a notifying authority or a market surveillance authority; as regards AI systems put into service or used by Union institutions, agencies, offices and bodies, references to national competent authorities or market surveillance authorities in this Regulation shall be construed as references to the European Data Protection Supervisor"
↑Mantelero, Alessandro (2022), Beyond Data. Human Rights, Ethical and Social Impact Assessment in AI, Information Technology and Law Series, vol.36, The Hague: Springer-T.M.C. Asser Press, doi:10.1007/978-94-6265-531-7, ISBN978-94-6265-533-1
123Veale, Michael; Borgesius, Frederik Zuiderveen (1 August 2021). "Demystifying the Draft EU Artificial Intelligence Act — Analysing the good, the bad, and the unclear elements of the proposed approach". Computer Law Review International. 22 (4): 97–112. arXiv:2107.03721. doi:10.9785/cri-2021-220402. ISSN2194-4164. S2CID235765823.
↑Casarosa, Federica (1 June 2022). "Cybersecurity certification of Artificial Intelligence: a missed opportunity to coordinate between the Artificial Intelligence Act and the Cybersecurity Act". International Cybersecurity Law Review. 3 (1): 115–130. doi:10.1365/s43439-021-00043-6. hdl:1814/77775. ISSN2662-9739. S2CID258697805.
↑Smuha, Nathalie A.; Ahmed-Rengers, Emma; Harkens, Adam; Li, Wenlong; MacLaren, James; Piselli, Riccardo; Yeung, Karen (5 August 2021). "How the EU Can Achieve Legally Trustworthy AI: A Response to the European Commission's Proposal for an Artificial Intelligence Act". SSRN3899991.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
