The EU AI Act 2026 refers to the date when the European Union's Artificial Intelligence Act (AI Act) becomes fully applicable, following its entry into force on 1 August 2024 and a gradual implementation period. The regulation establishes a common regulatory and legal framework for artificial intelligence across the EU, covering most AI systems in a wide range of sectors, with exemptions for military, national security, research, and non-professional uses. As a form of product regulation, it does not create individual rights but places duties on AI providers and organisations using AI professionally.
The AI Act was proposed by the European Commission on 21 April 2021, passed the European Parliament on 13 March 2024, and was unanimously approved by the EU Council on 21 May 2024. The draft was revised to address the rise of generative AI systems, such as large language models, whose general-purpose capabilities did not fit the original framework. The regulation entered into force on 1 August 2024, with provisions coming into operation gradually over 6 to 36 months, meaning most obligations apply from 2026.
Risk Categories
The Act classifies non-exempt AI applications by their risk of causing harm, with four levels – unacceptable, high, limited, minimal – plus an additional category for general-purpose AI. This risk-based scheme follows a product-safety model, assigning regulatory duties to providers and deployers, with duties becoming more demanding as potential impact on health, safety, or fundamental rights increases.
Unacceptable Risk
Applications with unacceptable risks are banned, except for specific exemptions. This includes AI that manipulates human behaviour, real-time remote biometric identification (such as facial recognition) in public spaces, and social scoring – ranking individuals based on personal characteristics, socio-economic status, or behaviour.
High Risk
High-risk applications must comply with security, transparency, and quality obligations, and undergo conformity assessments. These include AI systems used in health, education, recruitment, critical infrastructure management, law enforcement, or justice. They require a Fundamental Rights Impact Assessment (FRIA) before deployment – an ex ante review to identify and mitigate potential impacts on fundamental rights. High-risk systems must be evaluated before market placement and throughout their life cycle. The list of high-risk applications can be expanded over time without modifying the Act. Citizens have the right to submit complaints about AI systems and receive explanations of decisions made by high-risk AI affecting their rights.
Limited and Minimal Risk
Limited-risk systems have transparency obligations, ensuring users are informed they are interacting with AI, including deepfakes – AI that generates or manipulates images, sound, or videos. Minimal-risk systems, such as video games or spam filters, are not regulated, and member states cannot impose additional regulations due to maximum harmonisation rules. Existing national laws are overridden, though a voluntary code of conduct is suggested.
General-Purpose AI
Added in 2023, the general-purpose AI category includes foundation models like ChatGPT that can perform a wide range of tasks. Open-source models must publish a training data summary and copyright policy; closed-source models face broader transparency requirements. High-impact models posing systemic risks – requiring more than 10^25 floating-point operations to train – must undergo extra evaluation. A General-Purpose AI Code of Practice, published on 10 July 2025, outlines chapters on transparency, copyright, and safety and security, with voluntary participation.
Providers of general-purpose AI models must publish a training data summary, adopt a copyright compliance policy, and provide technical documentation to downstream providers and authorities. Models designated as posing systemic risk must carry out model evaluations and adversarial testing, assess and mitigate risks like bias and security failures, report serious incidents, and ensure adequate cybersecurity.
Exemptions
Articles 2.3 and 2.6 exempt AI systems used exclusively for military, defence, or national security purposes, or for pure scientific research and development. The regulation does not apply to these systems, nor to those developed and put into service solely for such purposes.
Governance and Extraterritoriality
The Act creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance. Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers outside the EU if they have users within the EU.
Implementation Timeline
The gradual implementation means that by 2026, most provisions are fully applicable. The initial prohibitions on unacceptable-risk systems took effect earlier, while high-risk and general-purpose obligations phased in over the following months. The 2026 date represents the full application of the regulation, with all member states required to enforce its provisions uniformly.
Impact and Reception
The AI Act is considered a landmark regulation, influencing global discussions on AI governance. Its risk-based approach has been praised for balancing innovation with safety, though some critics argue it may impose burdens on smaller companies. The inclusion of general-purpose AI, added during the legislative process, reflects the rapid evolution of machine learning technologies. The Act's extraterritorial scope means non-EU companies, including major tech firms, must comply when serving EU users, potentially shaping global AI development practices.