A risk-based framework
The Act regulates uses and outcomes, not AI technology in the abstract. A small number of practices are prohibited. Defined high-risk uses carry a full compliance regime. Other systems may have transparency duties, while most minimal-risk AI has no system-specific requirements beyond generally applicable rules.
- Legal instrument
- Regulation (EU) 2024/1689
- In force since
- 1 August 2024
- Territorial reach
- EU market placement or EU use of output
- Primary enforcers
- National authorities and the European AI Office
How AI systems are classified
Classification determines the obligations that follow. An organisation can operate systems across several levels at once.
| Level | What it covers | Effect |
|---|---|---|
| Prohibited | Ten practices banned outright: eight since February 2025, two more from December 2026 | €35m or 7% of turnover |
| High risk | Annex I product safety and eight Annex III use-case areas | Full Chapter III regime and conformity assessment |
| Transparency risk | Article 50: interaction notice, synthetic marking, deep fakes | Disclosure and marking duties |
| Minimal risk | Everything else: the large majority of AI systems | AI literacy duty only |
Who does the Act apply to?
Duties attach to a party's role. The same organisation can be a deployer for one system and a provider for another. The Act can also reach organisations outside the EU when they place a system on the EU market or its output is used in the Union.
Providers
Develop or place an AI system on the market under their name. High-risk providers carry the most extensive design, documentation and monitoring duties.
Deployers
Use an AI system professionally. Duties can include following instructions, human oversight, monitoring, record keeping and impact assessments.
GPAI model providers
Place general-purpose AI models on the EU market. They face documentation, copyright and training-content transparency requirements.
Importers and distributors
Bring systems into, or make them available in, the EU and must check that the provider completed the required compliance steps.
When does it apply?
The Act entered into force in 2024, but its requirements apply in phases. Prohibitions and AI literacy came first, followed by GPAI rules, transparency requirements and the high-risk regime.
View every application date →Enforcement and penalties
The highest ceiling is €35 million or 7% of worldwide annual turnover for breaches of prohibited-practice rules. Other violations carry lower tiers, with special treatment for SMEs. Actual penalties depend on the operator and circumstances.