EU AI Act, Simplified.

The EU AI Act is Regulation (EU) 2024/1689, the European Union's binding law on artificial intelligence. It entered into force on 1 August 2024 and regulates AI by risk: some practices are banned, high-risk uses carry a full compliance regime, some systems owe only transparency duties, and the rest are largely unregulated.

It entered into force on 1 August 2024, but obligations apply in stages. Prohibited practices and the AI literacy duty applied from 2 February 2025, general-purpose AI model obligations from 2 August 2025, and the general application date was 2 August 2026. High-risk obligations now apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products.

Yes. Under Article 2 the Regulation applies to providers that place an AI system on the EU market regardless of where they are established, and to providers and deployers outside the Union where the output of the system is used in the EU. A company with no EU entity can still be in scope.

There are two independent routes. A system is high-risk if it is a safety component of a product covered by the Union harmonisation legislation in Annex I, or if it is used in one of the eight areas listed in Annex III, including biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and the administration of justice. The two routes carry different deadlines.

Article 5 now prohibits ten practices. Eight have been unlawful since 2 February 2025: subliminal manipulation, exploitation of vulnerability, social scoring, predictive policing based on profiling alone, untargeted facial scraping, emotion inference at work and in education, biometric categorisation for sensitive traits, and real-time remote biometric identification in public for law enforcement subject to narrow carve-outs. Two further bans, covering non-consensual intimate imagery and child sexual abuse material, apply from 2 December 2026.

Three tiers. Breaching the Article 5 prohibitions carries up to €35 million or 7% of worldwide annual turnover. Breaching most other operator obligations carries up to €15 million or 3%. Supplying incorrect or misleading information to authorities carries up to €7.5 million or 1%. For SMEs and start-ups the lower of the two figures applies. The AI Office can additionally impose periodic penalty payments of up to 5% of average daily turnover per day a breach continues.

Yes. General-purpose AI models are regulated in their own right under Chapter V, with obligations that applied from 2 August 2025: technical documentation, information for downstream providers, a copyright policy and a public summary of training content. Models presenting systemic risk carry further duties including evaluation, adversarial testing and incident reporting. Separately, an application built on such a model may itself be high-risk or carry Article 50 transparency duties.

Article 4 requires providers and deployers to take measures to support a sufficient level of AI literacy among staff and others operating AI on their behalf, accounting for their technical knowledge, experience and the context of use. The Digital Omnibus softened this from a duty to ensure literacy to a duty to support it, but it still applies to every operator regardless of risk tier and has done since 2 February 2025.