The European Union is the first to regulate artificial intelligence with a comprehensive law, the AI Act. What it bans, what it requires and from whom, the timeline as amended in 2026, investment, and what usage figures show.
The Act sorts AI uses by risk. A short list of practices is banned outright (Art. 5). 'High-risk' systems (Art. 6 with Annexes I and III) must meet requirements on risk management, data quality, documentation, human oversight, accuracy and cybersecurity before being placed on the market. Some systems carry only transparency duties (Art. 50). Everything else is unregulated by the Act beyond a general duty on AI literacy (Art. 4). General-purpose AI models have a separate regime (Chapter V).
1
Banned
Article 5 · since 2 February 2025
5(1)(a)Subliminal, manipulative or deceptive techniques that materially distort behaviour and are likely to cause significant harm.
5(1)(b)Exploiting vulnerabilities linked to age, disability or social or economic situation to distort behaviour harmfully.
5(1)(c)Social scoring that leads to unjustified or out-of-context detrimental treatment.
5(1)(d)Predicting the risk that a person commits a crime based solely on profiling or personality traits.
5(1)(e)Building facial recognition databases by untargeted scraping of images from the internet or CCTV.
5(1)(f)Emotion recognition at work and in education, except for medical or safety reasons.
5(1)(g)Biometric categorisation to infer race, political opinions, trade union membership, religion, sex life or sexual orientation.
5(1)(h)Real-time remote biometric identification in public spaces for law enforcement, save narrow exceptions (victims and missing persons, imminent threats or terrorism, suspects of serious crimes) subject to prior judicial or independent authorisation (Art. 5(2) to 5(7)).
5(1)(ba) (added in 2026)AI systems that generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without explicit consent ('nudification'). Applies from 2026-12-02.
5(1)(bb) (added in 2026)AI systems that generate child sexual abuse material. Applies from 2026-12-02. Art. 5(1a) limits the ban for providers to systems whose purpose is this, or whose design makes it a foreseeable outcome without adequate safeguards.
2
High risk
Article 6 and Annexes I and III · requirements before placing on the market
Two routes (Art. 6). (1) Annex I: the AI system is a product, or a safety component of a product, covered by listed EU product-safety laws and needing third-party conformity assessment. (2) Annex III: the AI system is used in one of eight listed areas. An Annex III system can escape the high-risk label if it poses no significant risk (Art. 6(3)), but the provider must document and register that assessment (Art. 49(2)); the Omnibus kept this registration in simplified form.
The 8 Annex III areas
Biometrics (remote identification, categorisation, emotion recognition) where lawful
Critical infrastructure (safety components for digital infrastructure, road traffic, water, gas, heating, electricity)
Education and vocational training (admission, assessment, monitoring of exams)
Employment and workers' management (recruitment, promotion, termination, task allocation, monitoring)
Access to essential private and public services (public benefits, creditworthiness, life and health insurance pricing, emergency dispatch)
Law enforcement where lawful
Migration, asylum and border control where lawful
Administration of justice and democratic processes (including influencing elections)
3
Transparency
Article 50 · from 2 August 2026
Four duties. (1) Chatbots and other systems talking to people must tell them they are dealing with an AI, unless obvious. (2) Providers of systems generating synthetic audio, image, video or text must mark outputs in a machine-readable, detectable way. (3) Deployers of emotion recognition or biometric categorisation must inform the people exposed. (4) Deployers who publish deepfakes, or AI-generated text informing the public on matters of public interest, must disclose it (lighter rules for artistic or satirical work; exception where text was human-reviewed under editorial responsibility). Applies from 2026-08-02; for generative systems already on the market before that date, marking under 50(2) is due by 2026-12-02 (Reg. 2026/1744). A voluntary Code of Practice on Transparency of AI-generated Content was finalised on 2026-06-10.
4
Minimal risk
Everything else
Most uses (spam filters, video games, simple recommendations…) carry no specific obligation under the Act, beyond the general AI literacy duty (Article 4), softened in 2026.
Separately: general-purpose AI models (Chapter V)
All providers
All providers of general-purpose AI (GPAI) models (Art. 53): keep technical documentation (Annex XI); give integrators the information they need (Annex XII); adopt a policy to comply with EU copyright law, including respecting opt-outs from text and data mining; publish a sufficiently detailed summary of training content using the AI Office template. Open-source models are partly exempted unless they carry systemic risk (Art. 53(2)).
Models with systemic risk
A model is presumed to have 'high-impact capabilities', and thus systemic risk, when its cumulative training compute exceeds 10^25 floating-point operations (Art. 51(2)). The Commission can also designate a model on other criteria (Annex XIII) and can update the threshold by delegated act (Art. 51(3)). Providers must notify the Commission within two weeks (Art. 52(1)). Additional duties for systemic-risk models (Art. 55): state-of-the-art evaluations including adversarial testing; assessing and mitigating EU-level systemic risks; tracking and reporting serious incidents to the AI Office; adequate cybersecurity for the model and its infrastructure. Codes of practice can be used to show compliance until harmonised standards exist (Art. 55(2)).
Maximum fines (Article 99)
Prohibited practices (Art. 5)
€35 million or 7% of worldwide annual turnover, whichever is higher
Most other operator obligations (providers, importers, distributors, deployers, notified bodies, Art. 50 transparency)
€15 million or 3%, whichever is higher
Incorrect, incomplete or misleading information to authorities
The Act applies in stages. In July 2026, the “Digital Omnibus on AI” (Regulation 2026/1744) postponed high-risk obligations and added two prohibitions.
In force
AI Act (Regulation 2024/1689) published in the Official Journal.
AI Act enters into force (no obligations applicable yet).
Applies
Chapters I and II apply: Art. 5 prohibitions and the AI literacy duty (Art. 4). Commission guidelines on prohibited practices published on 4 February 2025.
Applies
General-Purpose AI Code of Practice published (voluntary).
Rules on general-purpose AI models (Chapter V), governance (Chapter VII), penalties (Chapter XII, except Art. 101 fines), notified bodies and confidentiality apply. Deadline for Member States to designate and publicise their authorities (Art. 70(2)).
Proposal
Commission proposes the 'Digital Omnibus on AI' (COM(2025) 836): tie high-risk rules to the availability of standards, with a maximum delay of 16 months.
Proposal
Council general approach on the AI Omnibus; Parliament adopts its position at the late-March 2026 plenary.
Omnibus enters into force (3rd day after publication). Articles 102 to 110 (amendments to other acts) apply from this date.
Applies
General date of application: notably transparency duties (Art. 50), enforcement powers, and Commission fines on GPAI providers (Art. 101). High-risk rules (Chapter III, Sections 1 to 3) are deferred.
Upcoming
New prohibitions (non-consensual intimate content, child sexual abuse material) apply. Marking deadline (Art. 50(2)) for generative systems placed on the market before 2 August 2026.
Upcoming
GPAI models placed on the market before 2 August 2025 must comply. Deadline (pushed back one year) for at least one national AI regulatory sandbox per Member State.
Upcoming
High-risk rules apply to Annex III systems (biometrics, education, employment, credit, policing, migration, justice...). Originally 2 August 2026.
Upcoming
High-risk rules apply to AI embedded in Annex I products (toys, lifts, medical devices...). Originally 2 August 2027.
Upcoming
Compliance deadline for AI in large-scale EU IT systems (Annex X, e.g. Schengen, Eurodac).
Who does what
AI Office
Created by Commission Decision of 24 January 2024 (C/2024/1459, OJ C 14.2.2024), in force 21 February 2024, before the Act itself was adopted. It sits inside DG CONNECT (Communications Networks, Content and Technology). The Commission page lists six units (excellence in AI and robotics; regulation and compliance; AI safety; innovation and policy coordination; AI for societal good; AI in health and life sciences) plus a lead scientific adviser and an international affairs adviser, and more than 125 staff. It enforces the GPAI rules and, since Reg. 2026/1744, has extra supervisory powers.
European Artificial Intelligence Board: one representative per Member State, chaired by a Member State, AI Office as secretariat; EDPS and EEA-EFTA countries as observers. First meeting 10 September 2024. Coordinates national authorities and advises on implementation; subgroups include one on the AI Act and medical devices rules, and one on standards.
Scientific panel
Scientific panel of independent experts (Art. 68), set up by Commission Implementing Regulation (EU) 2025/454 of 7 March 2025 (max 60 experts, 2-year terms). The Commission announced 60 appointed experts on its news page dated 1 June 2026. The panel can issue 'qualified alerts' on GPAI models with systemic risk. A special meeting on frontier AI safety was announced on 5 October 2026.
Advisory forum (Art. 67): stakeholders from industry, start-ups, SMEs, academia and civil society; the EU Fundamental Rights Agency, ENISA and the European standardisation bodies are permanent members. Appointed alongside the scientific panel (same Commission announcement). Number of members not stated on the page.
National authorities
Each Member State must designate at least one market surveillance authority and one notifying authority, and publish contact details by 2 August 2025 (Art. 70). As of the Commission list last updated 7 September 2026: 9 Member States have a designated single point of contact (Denmark, Finland, Greece, Ireland, Italy, Latvia, Lithuania, Malta, Poland), 12 have a designation pending final national adoption (Czechia, Cyprus, Estonia, France [DGCCRF], Germany [Bundesnetzagentur], Luxembourg, Netherlands, Portugal, Romania, Slovenia, Spain [AESIA], Sweden), and 6 show no entry (Austria, Belgium, Bulgaria, Croatia, Hungary, Slovakia).
Regulatory sandboxes
Each Member State must have at least one AI regulatory sandbox (a supervised testing environment). Original deadline 2 August 2026 (Art. 57(1)); moved to 2 August 2027 by Reg. 2026/1744, which also lets the AI Office run an EU-level sandbox for systems under its supervision and the EDPS run one for EU institutions.
The General-Purpose AI Code of Practice
Published on 10 July 2025, voluntary. Voluntary. Signing gives a presumption-like route to show compliance with Art. 53 and 55; non-signatories must show compliance by other adequate means.
Signatories (22)
AI Studio Delta
Aleph Alpha
Almawave
Amazon
Anthropic
Black Forest Labs
Bria AI
Cohere
Domyn
Dweve
Fastweb
Google
IBM
LINAGORA
Microsoft
Mistral AI
Open Hippo
OpenAI
Pleias
Reflection AI, Inc.
ServiceNow
WRITER
Partial signature: xAI (Safety and Security chapter only)
Declined to sign: Meta (18 July 2025) : Said the code creates legal uncertainty for model developers and goes beyond the scope of the AI Act; called the approach overreach.
Call for tenders opened on 30 July 2026: up to 7 sites, up to €10bn of EU and national public funding, at least €20bn private expected; closes 12 November 2026, award expected early 2027. No site selected yet.
30 July 2026
Apply AI StrategyCommitted
About €1bn mobilised for AI uptake in industry and public services.
In 2025, Eurostat added a technology to the list (AI generating images, video or sound): part of the rise since 2024 reflects this broader definition. Vertical tick: EU average. Eurostat isoc_eb_ai
People who used a generative AI tool in the last 3 months, 2025
The main public positions on the Act and its simplification, summarised and attributed. They are not established facts.
Industry
EU AI Champions Initiative (45 to 50 European CEOs, incl. Mistral, Airbus, ASML, Siemens Energy, Publicis)
Open letter asking EU leaders for a two-year 'stop the clock' on the AI Act, citing competitiveness and legal uncertainty, and calling for simpler rules on GPAI and high-risk systems. Exact number of signatories varies by source.
Mario Draghi (author of the 2024 report on EU competitiveness)
One year after his report, said the first AI Act rules had landed without major problems but that the high-risk stage should be paused until its effects are better understood, and called the Act a source of uncertainty.
Called the Commission's Digital Omnibus 'a major rollback' of EU digital protections (19 Nov 2025). After the May 2026 deal, argued it delays key protections, weakens transparency and sets a precedent for the wider digital rulebook, and urged Parliament and Council to reject it (11 June 2026). Co-organised an open letter of 41 organisations and experts (15 April 2026).
19 November 2025, 15 April 2026, 11 June 2026 · edri.org
Consumers
BEUC (European Consumer Organisation)
Trilogue paper: keep the AI Act horizontal; oppose the general delay and longer grace periods; ask that delays be unconditional and non-renewable, with transparency duties applying by November 2026; restore public registration of self-exempted high-risk systems; oppose extending SME privileges to mid-caps; keep AI literacy obligations; support a nudification ban but assess side effects on open-source models.
Denmark
Finland
Sweden
Belgium
Luxembourg
Netherlands
Austria
Estonia
Slovenia
Malta
Lithuania
Ireland
Slovakia
Czechia
Croatia
Latvia
Portugal
Hungary
Cyprus
Greece
Bulgaria
Romania