The EU AI Act is the first general-purpose law in the world that defines what artificial intelligence is allowed to do in Europe and what it isn’t. It is not a sector-specific document for healthcare or banking – it is a horizontal regulation that covers anything where AI takes decisions, generates content, evaluates people, or affects their rights.
If your bank runs AI-driven credit scoring, your hospital uses AI to read scans, your HR department filters CVs through an AI tool, or you build AI products for the European market – this law applies to you. The Act entered into force on 1 August 2024, became applicable on 2 August 2026, and is phased in mostly by 2 August 2028, with the last deadlines in 2030. The most serious breaches are punishable by fines of up to €35 million or 7% of worldwide turnover.
Updated for the AI Omnibus. In July 2026 the Act was amended by Regulation (EU) 2026/1744, the “AI Omnibus”, which moved the two high-risk deadlines back – to 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for AI built into regulated products – and added a ninth prohibited practice. Deadlines quoted elsewhere as “2 August 2026 for high-risk” pre-date that amendment.
This page is the canonical klarproof guide – every key claim is sourced directly to EUR-Lex or the European Commission.
Quick facts
- Full name: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 (Artificial Intelligence Act)
- Adopted: 13 June 2024
- Published in OJ: 12 July 2024 (OJ L, 2024/1689)
- Entered into force: 1 August 2024 (twentieth day after publication)
- Became applicable: 2 August 2026 – the date from which the Commission’s AI Office and national authorities enforce the Act and the transparency rules bite (European Commission, 31 July 2026)
- Amended by: Regulation (EU) 2026/1744 (the “AI Omnibus”), in force 27 July 2026 – deferred the high-risk deadlines and added a ninth prohibition
- High-risk deadlines: 2 December 2027 (stand-alone systems, Annex III) and 2 August 2028 (AI embedded in regulated products, Annex I)
- Penalties: up to €35M / 7% worldwide turnover (Article 5 violations); €15M / 3% (other obligations); €7.5M / 1% (incorrect information)
- Central enforcer: the European AI Office within the Commission for foundation models like GPT and Claude; national authorities in each Member State for everything else
- Early mover: Italy adopted Law No. 132/2025 on 23 September 2025 (in force 10 October 2025) – a national framework complementing the AI Act
- Source of truth on EU side: eur-lex.europa.eu, European Commission AI Office page, AI Act Service Desk
What the AI Act actually is
The AI Act is a horizontal regulation. Sounds dry, but it matters: unlike GDPR (which regulates data protection) or MiCA (which regulates crypto), this Act regulates a way of using technology across all sectors at once. Healthcare, finance, hiring, education, law enforcement, transport, public services – wherever AI shows up, the same baseline rules apply.
The Act does not replace GDPR. The two laws operate in parallel and frequently overlap: GDPR governs the personal data flowing through an AI system, while the AI Act governs how the AI system itself is built, tested and supervised. Most of the first big AI-related fines in Europe are still GDPR fines: the Italian Garante hit OpenAI for €15 million (December 2024) and Replika for €5 million (April 2025). The OpenAI case concerned training ChatGPT on personal data without an adequate legal basis; the Replika case concerned processing without an identified legal basis, an inadequate privacy notice and missing age verification (see the dedicated klarproof registry of Garante AI cases).
The Act packages two distinct things into one regulation:
- AI systems – concrete software built for a concrete task: a bank’s chatbot, a credit-scoring engine, a face-recognition gate at an office, AI-driven medical imaging. Regulated by how much risk they pose to people (see below).
- General-purpose AI models (GPAI) – large foundation models like GPT (OpenAI), Gemini (Google), Claude (Anthropic), Llama (Meta), Mistral. They are not “AI systems” in themselves but the engines on top of which thousands of other companies build products. They get separate rules in Chapter V, and those rules began applying earlier than most other parts of the Act.
Provider and deployer – the two key roles
The Act keeps using two specific words – “provider” and “deployer”. They look like ordinary English, but here they’re regulatory statuses with different sets of obligations:
- Provider – whoever builds the AI system and puts it on the market under their own name or brand. OpenAI is the provider of GPT. Anthropic is the provider of Claude. A startup that makes an AI résumé-screening tool and sells it to HR departments is the provider of that tool.
- Deployer – the organisation that uses someone else’s AI system in its own operations. The bank running an external AI scoring engine for credit decisions. The hospital running AI on its MRI scans. The HR team filtering CVs through an AI shortlist. Not the same as the end user – the person whose loan application that AI evaluates is not a “deployer” under the Act; the Act calls that person an “affected person” and gives them a right to an explanation (Article 86).
This split matters because providers and deployers carry different obligations. The provider is responsible for how the product is built (documentation, testing, risk assessment). The deployer is responsible for how the product is used in the real world (human oversight, monitoring, informing users).
The Act is extraterritorial – like GDPR, it applies to companies outside the EU if their outputs are used in Europe. A US-based AI vendor whose system is used by an EU bank for credit scoring is in scope: the US developer is the provider, the bank is the deployer.
The risk-based architecture: four classes
The AI Act regulates outcomes for people, not the underlying technology (neural network vs decision tree vs regression). It looks at how much harm an AI system could cause and sets the obligation level accordingly.
A simple analogy: how medicines are sold. A vitamin tablet sits on any supermarket shelf; an over-the-counter painkiller is behind the pharmacy counter with warnings on the box; an antibiotic needs a doctor’s prescription; an addictive narcotic is banned outright. It’s all “a substance you swallow” – what changes the rules is not the chemistry but how badly it can harm a person. The AI Act sorts AI systems the same way: four buckets, from unregulated up to outright prohibited, by increasing strictness.
1. Prohibited practices (Article 5)
A short list of practices for which the EU has decided that no safeguard is enough – they are simply banned. There are now nine: the original eight in Article 5(1), which have applied since 2 February 2025, plus a ninth added by the AI Omnibus in July 2026, which takes effect in December 2026. A breach falls under the top fine tier: €35M / 7% turnover.
| Prohibition | What this looks like in practice | |
|---|---|---|
| (a) | Subliminal, manipulative or deceptive techniques | AI that nudges people in ways they aren’t aware of and to their detriment. For example, an AI assistant subtly steering vulnerable users towards financially harmful choices |
| (b) | Exploitation of vulnerabilities | AI that exploits age, disability or socio-economic situation. For example, ad-targeting AI promoting online gambling to people showing signs of addiction |
| (c) | Social scoring | Generalised classification of people based on behaviour or personality, leading to detrimental treatment in unrelated contexts. For example, denying someone a banking service because their “social score” – based on conduct in a completely unrelated setting – is low |
| (d) | Predictive criminal risk assessment | Predicting that someone will commit a crime purely from profiling, without specific evidence. The “police predicts crime by neighbourhood and demographics” script. Narrow exceptions exist |
| (e) | Untargeted facial-image scraping | Building face-recognition databases by scraping random photos from the internet or CCTV footage. Compare the Clearview AI case |
| (f) | Emotion inference at work or school | AI that decides an employee’s or student’s “mood” from face, voice, posture. Exceptions only for medical or safety reasons |
| (g) | Sensitive biometric categorisation | Inferring race, political opinions, religion or sexual orientation from biometric data (face, fingerprint, voice) |
| (h) | Real-time remote biometric ID for law enforcement | Live face recognition through public cameras for police purposes in publicly accessible spaces. Narrow exceptions for serious specific objectives |
| (ba), (bb) | AI-generated intimate imagery without consent, and child sexual abuse material | Added by the AI Omnibus and in effect from December 2026. Covers “nudification” apps – tools that generate nude images of real people, or edit clothing out of existing photographs to expose intimate parts – and AI-generated CSAM (Council of the EU; European Commission) |
The European Commission’s Guidelines on Article 5 (published 4 February 2025) walk through each prohibition with concrete examples. They cover prohibitions (a)–(h); the ninth was legislated a year later.
2. High-risk (Article 6 + Annex III)
The bulk of the Act’s obligations sits here. An AI system is classified high-risk if it falls into one of two routes:
Both routes were pushed back by the AI Omnibus in July 2026, so the dates below are later than most guidance written before that amendment.
-
Route 1: AI as a safety component of an already-regulated product. AI inside medical devices, lifts, toys and the other products listed in Section A of Annex I. These products already go through certification under their sector laws – now an AI layer is added. Applies from 2 August 2028 (was 2 August 2027). The Omnibus moved machinery to Section B: AI requirements for machines will come through delegated acts under the Machinery Regulation (EU) 2023/1230, applying by 2 August 2028; vehicles sat in Section B from the start.
-
Route 2: AI in one of the eight Annex III categories – a list of “sensitive applications” where AI directly affects people’s rights or access to services. Applies from 2 December 2027 (was 2 August 2026). Specifically:
- Biometrics (face recognition outside the prohibited list, identity verification)
- Critical infrastructure (electricity, water, digital infrastructure)
- Education (AI grading work, AI deciding admissions)
- Employment (AI CV-filtering, employee evaluation, promotion or dismissal decisions)
- Access to essential services (credit scoring, insurance, public benefits, emergency response)
- Law enforcement
- Migration, asylum, border control
- Administration of justice and democratic processes
If an AI system falls into one of these scenarios, providers and deployers must run through a full regulatory checklist:
- risk management (a formal process to identify and mitigate risks),
- data governance (controlling training-data quality, removing bias),
- technical documentation,
- transparency to deployers,
- human oversight of decisions,
- accuracy and robustness requirements,
- registration in an EU-wide database of AI systems,
- a formal conformity assessment (the procedure that verifies compliance – either internally or through a certified body),
- post-market monitoring.
Non-compliance: €15M / 3% turnover tier.
3. Limited risk (Article 50 transparency obligations)
AI systems that interact with humans or generate content but don’t fall into the high-risk list. For example:
- chatbots (banking, e-commerce, support),
- AI-generated images, video, audio, including deepfakes,
- AI synthesising voice or text.
The main obligation is transparency. Users must know they’re talking to AI, not a human. AI-generated content must be machine-readably marked – meaning the file must carry metadata that lets a program automatically detect “this was AI-made”. These rules have applied since 2 August 2026 and were not deferred by the AI Omnibus: unlike the high-risk regime, this layer is live now.
Two Commission documents make it workable. The Guidelines on transparency obligations (20 July 2026) set out the scope, the definitions and the exceptions. Alongside them runs a voluntary Code of Practice on the transparency of AI-generated content, which turns the duty into practice – including a set of icons for disclosing that an image, audio clip or text is artificial. More than 180 organisations had signed it by the time enforcement began (European Commission, 31 July 2026).
4. Minimal or no risk
Everything else – spam filters, AI in video games, content recommenders, inventory optimisation, autocomplete in your inbox. Not regulated by the Act, although the EU encourages voluntary codes of conduct.
Rules for foundation models (Chapter V)
General-purpose AI models (GPAI) are GPT, Claude, Gemini, Llama, Mistral and similar. They are not “AI systems” in themselves: they are the engines that thousands of other companies use as a foundation for their own products. So regulating them via the risk-class system doesn’t fit – the same GPT can power both an e-commerce chatbot (minimal risk) and a bank’s credit scoring (high risk).
The Act splits GPAI providers into two tiers:
- Standard GPAI providers must draw up technical documentation (how the model is built) and hand it to the AI Office on request, give information to providers of AI systems that integrate the model into their products, put in place a copyright policy (how they respect rights to training data) and publish a training-data summary (general description of what the model was trained on) – Article 53(1).
- GPAI with systemic risk – the largest models, capable of causing substantial systemic harm. Defined by training-compute threshold (currently 10²⁵ FLOPs, Article 51(2)) or by Commission designation. Additional obligations: formal model evaluation, adversarial testing (deliberate attempts to break the model and make it produce something harmful), serious-incident reporting, cybersecurity requirements.
GPAI obligations entered application on 2 August 2025.
The GPAI Code of Practice: what it is and why sign it
The Act sets requirements in general terms: “you need a risk assessment”, “you need technical documentation”, “you need incident reporting”. But what counts as an adequate risk assessment? Which document templates work? What counts as a “serious incident”?
To prevent compliance from collapsing into years of legal back-and-forth on every single point, on 10 July 2025 the Commission published the GPAI Code of Practice – a voluntary document that spells out how exactly providers of foundation models should meet the Act’s requirements. In effect, it’s a “playbook”: here are templates for the risk assessment, criteria for serious incidents, examples of acceptable technical documentation.
Signing the Code lets a provider rely on it to demonstrate compliance (Articles 53(4) and 55(2)). It is not a presumption of conformity – the AI Omnibus says so expressly (Recital 41 of Regulation (EU) 2026/1744); only harmonised standards give one. Providers that do not sign must show compliance through alternative adequate means, assessed by the Commission.
21 providers have signed the Code in full (Commission list, last updated 31 July 2026) – including the largest foundation-model players (OpenAI, Anthropic, Google, Microsoft, Mistral, IBM, Amazon, Cohere, Aleph Alpha) alongside smaller European and non-European providers – plus xAI (Elon Musk), which signed only the Safety & Security chapter. Meta is the most prominent non-signatory: it publicly declined to join the Code in July 2025, citing legal and operational concerns. For non-signatories or partial signatories, compliance has to be demonstrated through alternative means on every uncovered topic – which in practice translates into closer regulatory attention to every move.
The phased timeline (Article 113, as amended)
The Act doesn’t switch on all at once – it rolls out in waves. The waves below already account for the AI Omnibus, whose changes the Council set out when it gave the regulation its final approval on 29 June 2026:
| Date | What starts to apply |
|---|---|
| 1 August 2024 | The Act enters into force – most provisions still dormant |
| 2 February 2025 | Prohibited practices (Article 5) and the AI literacy requirement (Article 4 – since the Omnibus took effect on 27 July 2026, providers and deployers must take measures to support AI literacy among staff who work with AI, without having to guarantee any specific level) |
| 2 August 2025 | GPAI rules (Chapter V); governance bodies stand up (AI Office, Board, Scientific Panel, Advisory Forum); penalties (Chapter XII – except the Commission’s fines on GPAI providers, Article 101, which apply from 2 August 2026); confidentiality rules (Article 78); national notifying authority designations |
| 27 July 2026 | The AI Omnibus (Regulation (EU) 2026/1744) enters into force, six days before the original high-risk deadline, and moves that deadline |
| 2 August 2026 | The Act becomes applicable: Article 50 transparency obligations bite, and the AI Office and national authorities start enforcing |
| 2 December 2026 | Two things land: the ninth prohibition (AI-generated intimate imagery without consent, and CSAM), and the end of the transitional period for generative-AI systems placed on the market before 2 August 2026 to apply machine-readable marking (Article 111(4), as amended by the Omnibus) |
| 2 August 2027 | Deadline for Member States to set up regulatory sandboxes – controlled “safe zones” where companies can test new AI under a regulator’s supervision without full compliance (moved back a year by the Omnibus) |
| 2 December 2027 | High-risk Annex III categories – banks, HR, insurance, education, public services (moved from 2 August 2026) |
| 2 August 2028 | The final layer – high-risk AI as a component of products with mandatory certification (medical devices, lifts, toys – Annex I Section A; moved from 2 August 2027) |
The key date for most businesses moved: it is now 2 December 2027, not 2 August 2026. That is when the operational compliance work for high-risk AI under Annex III kicks in.
What did not move matters just as much. The obligations were deferred, not dropped, and the rest of the Act was left alone: the prohibitions, the GPAI rules, the AI literacy duty and the transparency obligations all apply today, and the Commission has been enforcing since 2 August 2026. A company reading “the AI Act was delayed” as “the AI Act does not apply yet” has misread it.
Governance: who supervises and who enforces
The AI Act uses the same hybrid model as GDPR: an EU-wide layer plus 27 national regulators. By analogy with GDPR, where coordination across countries is done by the EDPB and national DPAs handle enforcement at home – the AI Act takes a similar shape.
EU level
- European AI Office (Article 64) – a new Commission unit set up specifically for the AI Act. Sits within DG CONNECT (the Commission’s “digital future” directorate). 125+ staff across six units. The AI Office’s main role is supervision and enforcement of GPAI providers. That means OpenAI, Anthropic, Google, xAI and similar are answerable directly to Brussels, not to individual countries. The AI Omnibus drew that line more precisely: where a provider builds both the model and the system running on it, supervision of the system sits with the AI Office too – except for products under Annex I, critical infrastructure, law enforcement, border management, the judiciary and financial institutions, where the national authority stays competent (new Article 75(1)) (Council of the EU). Full profile: Who is the European AI Office.
- European Artificial Intelligence Board (Article 65) – a Board with one representative from each Member State, three-year terms (renewable once), chaired by one of the members. The AI Office and the EDPS (the EU institutions’ data-protection supervisor) attend as non-voting observers. The Board coordinates national regulators and advises the Commission.
- Scientific Panel of Independent Experts (Article 68) – a technical advisory group of independent experts attached to the AI Office, especially for evaluating systemic-risk GPAI.
- Advisory Forum (Article 67) – industry, SMEs, start-ups, civil society, and academia. Provides expert input to the Board and the Commission.
National level
By 2 August 2025, each Member State was required to designate at least one national competent authority, split across two roles:
- Notifying authority – accredits the independent labs that will then carry out conformity assessment for high-risk AI systems.
- Market surveillance authority – investigates breaches and applies fines.
Implementation differs sharply across countries:
- 🇪🇸 Spain – AESIA (Agencia Española de Supervisión de la Inteligencia Artificial) was legally established by Royal Decree 729/2023 on 22 August 2023 and officially presented on 19 June 2024 in A Coruña – presented as a “pioneer” in Europe. Spain didn’t bolt AI supervision onto its existing DPA; it built a separate body.
- 🇮🇹 Italy – Law No. 132/2025 entered into force on 10 October 2025 – a national AI law complementing the AI Act. Designates AgID (notifying), ACN (market surveillance + the EU single point of contact). The Garante’s GDPR remit is preserved – so two regulators now look at AI from two different angles.
- 🇩🇪 Germany – the Federal Network Agency (BNetzA) is designated as the primary market surveillance authority; the BfDI (federal data protection ombudsman) is not designated; data protection authorities are brought in through cooperation duties (§ 9 KI-MIG). The KI-MIG implementation act is now law: the Federal Cabinet adopted the Regierungsentwurf on 11 February 2026, the Bundestag passed it on 11 June 2026, and it entered into force on 29 July 2026 (Federal Ministry for Digital and State Modernisation). Germany missed the 2 August 2025 deadline and closed the gap days before the Act became applicable.
- 🇮🇪 Ireland – went the distributed model route: sectoral authorities each handle AI in their own area (DPC for data, Central Bank for finance, Coimisiún na Meán for media, Health and Safety Authority for workplace safety, ComReg for electronic communications, CCPC for consumer protection, HPRA for medical products, etc.). Oifig IS na hÉireann (the AI Office of Ireland), established on 31 July 2026 under the Regulation of Artificial Intelligence Act 2026 (establishment order), coordinates them and is Ireland’s single point of contact (section 42).
- The other 23 Member States – at varying stages of readiness; many are still finalising designations and domestic legislation.
Penalties (Article 99)
Three administrative-fine tiers. For each violation the higher of two amounts applies – a fixed cap or a percentage of worldwide annual turnover:
| Tier | What triggers it | Maximum |
|---|---|---|
| 1 | Article 5 prohibited practices (the eight from the table above, plus (ba) and (bb) from 2 December 2026) | €35,000,000 or 7% worldwide turnover |
| 2 | Other obligations on operators and notified bodies: high-risk requirements, transparency, registration, etc. (GPAI providers are fined separately by the Commission under Article 101 – up to €15,000,000 or 3%) | €15,000,000 or 3% |
| 3 | Providing incorrect, incomplete or misleading information to authorities | €7,500,000 or 1% |
For SMEs and start-ups the rule flips to the lower of the two amounts – a proportional safeguard. Small companies shouldn’t be wiped out by the same numerical fine that would land on OpenAI.
For context: GDPR’s top tier is €20M / 4%. The AI Act’s top tier is €35M / 7% – 1.75 times the maximum financial exposure. The drafting choice is deliberate: the EU is signalling that prohibited AI practices – social scoring, manipulative AI, biometric tracking – are, in their judgment, a more serious category of harm than even the worst data-protection violations.
How the AI Act overlaps with GDPR
Often confused. The two laws apply concurrently to any AI system processing personal data:
- AI Act governs the AI system itself: which risk class it sits in, what documentation is needed, how it’s certified, how oversight is set up.
- GDPR governs the personal data flowing through the system: lawful basis, transparency to data subjects, what the rights are, what training data is legal.
The Garante’s actions against OpenAI (€15M, December 2024 – annulled by the Tribunale di Roma on 18 March 2026) and Replika (€5M, April 2025) are GDPR cases (Articles 5, 6 GDPR plus related transparency and accountability provisions), even though the underlying issue is AI. The OpenAI annulment is itself a milestone: a court of first instance overturned it on competence grounds, without examining the merits. This pattern will continue: most AI-system enforcement in the next 2–3 years will run on GDPR rails, simply because GDPR is already operational while the AI Act process is still settling in.
What’s actually happening as of October 2026
Real AI-Act-specific enforcement (i.e. fines under Article 99) is still minimal, and the Omnibus has pushed the moment of truth further out. The Article 5 prohibitions entered application on 2 February 2025; the Commission and national authorities only took up enforcement duties on 2 August 2026; and conformity assessment for high-risk systems now doesn’t begin until 2 December 2027.
What is happening:
- GDPR-grounded AI cases – Garante OpenAI €15M (Dec 2024, annulled by Tribunale di Roma 18 Mar 2026), Garante Replika €5M (Apr 2025), CNIL guidance on training data published through 2024–2025 (see cnil.fr for the current list).
- Pressure on those who didn’t sign the GPAI Code of Practice. Foundation-model providers that haven’t joined the Code (xAI partial; some smaller ones not at all) face closer individual regulatory scrutiny: every step is examined separately, without the Code to rely on. This is not a fine – it’s a continuous oversight overhead.
- Transparency is the live front. Since 2 August 2026 the disclosure and content-marking duties apply, the Commission has published guidelines on them, and more than 180 organisations have signed the accompanying Code of Practice. Systems already on the market before 2 August 2026 have until 2 December 2026 to apply machine-readable marking (Article 111(4), as amended); new systems must comply from the start.
- National regulatory sandboxes – Member States now have until 2 August 2027 to establish them, a year later than first planned. These are “safe zones” where companies can test new AI systems under a regulator’s supervision without full compliance with the Act.
The dedicated klarproof registry of Garante’s AI cases now covers both fines in full – the exact articles, corrective measures and the court status of each. For the broader EU picture, enforcementtracker.com (filter by “AI”) lists GDPR fines across all Member States.
What this means for you
If you’re a provider (you build AI):
- Identify your products’ risk class. Most B2B AI is not high-risk; check Article 6 + Annex III carefully against your use cases. Misclassification is the most expensive mistake.
- If you build a foundation model (GPAI), sign the Code of Practice or be ready to prove compliance from scratch on every single point.
- By 2 December 2027 you should have technical documentation, a risk-management process, and post-market monitoring in place for Annex III systems – and by 2 August 2028 for AI inside certified products. The Omnibus bought roughly sixteen extra months; it did not remove the work.
- Decide your conformity-assessment route in advance: internal control vs. third-party body – this drives both cost and timeline.
If you’re a deployer (you use AI in your business):
- Run an inventory of your AI systems. Map which are high-risk (HR, credit scoring, etc. under Annex III), which are limited-risk (chatbots, content generation), which are minimal.
- For high-risk deployments: write down human-oversight protocols, monitoring procedures, and instructions for staff who interact with the AI.
- For limited-risk: visible disclosure to users that they’re talking to AI; machine-readable marking of AI-generated content (deepfakes, AI text, AI images). This one is not on the deferred timetable – it has applied since 2 August 2026, with a transition until 2 December 2026 only for systems placed on the market before 2 August 2026.
- AI literacy (Article 4) has applied since 2 February 2025; since 27 July 2026 the duty is to take measures supporting the AI literacy of staff who work with AI, without guaranteeing any specific level.
If you operate in finance, healthcare, hiring, public services, or law enforcement – assume you already have high-risk AI systems and budget for full conformity assessment. The EU is clearly signalling that these sectors are first in line for regulatory attention.
TL;DR
The EU AI Act is a comprehensive AI regulation, applied in waves: prohibited practices already in force (since 2 February 2025); rules for foundation models like GPT/Claude in force since 2 August 2025; the Act applicable and enforced since 2 August 2026, transparency duties included. The July 2026 AI Omnibus then deferred the heaviest layer: high-risk Annex III requirements now start 2 December 2027, and AI as a component in certified products (medical devices, lifts, toys) 2 August 2028. Risk architecture: 9 prohibited practices, the ninth (AI-generated intimate imagery without consent, and CSAM) effective December 2026; high-risk systems (banks, HR, education, healthcare) go through full certification; limited-risk (chatbots, deepfakes) need transparency; minimal-risk is unregulated. Penalties run up to €35M / 7% turnover for prohibited practices – 1.75 times the GDPR ceiling. The European AI Office in Brussels supervises foundation models; national authorities cover everything else. National implementation differs sharply: Spain (AESIA, a dedicated AI agency), Italy (national AI law 132/2025), Germany (BNetzA, under the KI-MIG act in force since 29 July 2026), Ireland (sectoral authorities coordinated by the AI Office of Ireland). Real AI-Act-specific enforcement in 2026 is still minimal; the first AI cases are running through GDPR (Garante: €15M against OpenAI – annulled in court in March 2026 – and €5M against Replika).
Sources
- Regulation (EU) 2024/1689 – full text on EUR-Lex – official source of the AI Act
- Regulation (EU) 2026/1744 – the AI Omnibus, OJ L, 2026/1744 – the July 2026 amendment that deferred the high-risk deadlines
- Council of the EU – final approval of the AI Omnibus, 29 June 2026 – the new application dates, the ninth prohibition, the sandbox and transparency changes
- European Commission – AI Act regulatory framework – the Commission’s own current timeline and risk classes
- Commission Guidelines on transparency obligations, 20 July 2026 – scope, definitions and exceptions for Article 50
- European AI Office – official Commission page – mandate, structure, contact
- AI Act Service Desk – Commission’s compliance support portal
- Commission Guidelines on prohibited AI practices, 4 February 2025
- GPAI Code of Practice – official text and signatories (EU Commission)
- Italy Law No. 132/2025 analysis (Covington Global Policy Watch) – adoption and content of the Italian AI law
- AESIA – Spanish AI supervisory agency – Spain’s dedicated AI supervision agency (profile: AESIA)
- Article-by-article reference (artificialintelligenceact.eu) – unofficial reference, useful for navigation; check the official text on EUR-Lex, especially after the AI Omnibus