The EU AI Act 2032 is a prospective revision of the European Union's Artificial Intelligence Act (AI Act), a regulation that establishes a common regulatory and legal framework for artificial intelligence within the EU. The original regulation entered into force on 1 August 2024, with provisions scheduled to become applicable gradually over the following 6 to 36 months. The 2032 revision is anticipated to address emerging challenges and technological developments that were not fully covered by the initial framework, particularly in areas such as general-purpose AI and systemic risk management.
The AI Act covers most AI systems across a wide range of sectors, with exemptions for AI used exclusively for military, national security, research purposes, or non-professional use. As a form of product regulation, it does not create individual rights but places duties on AI providers and organisations that use AI in a professional context. The Act classifies non-exempt AI applications into four risk levels - unacceptable, high, limited, and minimal - plus an additional category for general-purpose AI. The 2032 revision is expected to refine these categories based on implementation experience and technological evolution.
Legislative Background
The European Commission proposed the original AI Act on 21 April 2021. The European Parliament passed it on 13 March 2024, and the EU Council unanimously approved it on 21 May 2024. The draft was revised to address the rise of generative AI systems, such as large language models, whose general-purpose capabilities did not fit the main framework. The Act also creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance. Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers outside the EU if they have users within the EU.
The 2032 revision process is part of the Act's built-in review mechanism, which requires periodic evaluations of the regulation's effectiveness. The European Commission is expected to conduct a comprehensive assessment of the Act's implementation, considering feedback from member states, industry stakeholders, and civil society. This review will likely examine whether the risk-based approach adequately addresses new AI applications and whether adjustments are needed to the list of high-risk categories.
Risk Categories Under Review
The original Act establishes four risk levels. Unacceptable risk applications are banned, except for specific exemptions, including AI that manipulates human behaviour, real-time remote biometric identification in public spaces, and social scoring. High-risk applications - those posing significant threats to health, safety, or fundamental rights - must comply with security, transparency, and quality obligations, and undergo conformity assessments. Limited-risk applications have transparency obligations, such as informing users they are interacting with AI. Minimal-risk applications, like video games or spam filters, are not regulated.
The 2032 revision may consider whether new AI applications fall into these categories. For example, advances in generative AI and neural networks could prompt reclassification of certain uses. The Act allows the list of high-risk applications to be expanded over time without modifying the Act itself, so the revision may propose additions based on emerging evidence of harm.
General-Purpose AI Provisions
Added in 2023, the general-purpose AI category includes foundation models that can perform a wide range of tasks, such as transformer-based models. If a model's weights and design are made open source, developers must publish a training data summary and a copyright policy. Closed-source models must meet broader transparency requirements. High-impact models posing systemic risks - requiring more than 10^25 floating-point operations to train - must undergo extra evaluation.
The 2032 revision may update these thresholds and requirements. The General-Purpose AI Code of Practice, published on 10 July 2025, outlines three main chapters on transparency, copyright, and safety and security. Participation is voluntary, but the revision could make compliance mandatory or strengthen the code's provisions. Providers must publish training data summaries, adopt copyright policies, and provide technical documentation to downstream providers and supervisory authorities.
Systemic Risk Management
Models designated as posing systemic risk must carry out model evaluations and adversarial testing, assess and mitigate risks such as bias and security failures, report serious incidents, and ensure adequate cybersecurity. The 2032 revision may expand these obligations to cover additional model types or lower the computational threshold for systemic risk designation.
Emerging research on machine learning safety and deep learning interpretability could inform these changes. The revision might also address challenges posed by OpenAI and other major developers, ensuring that their frontier models meet evolving standards. The European Artificial Intelligence Board will likely play a central role in recommending updates based on technical assessments.
Exemptions and Scope Adjustments
Articles 2.3 and 2.6 of the Act exempt AI systems used for military, national security, or pure scientific research and development. The 2032 revision may clarify these exemptions, particularly for dual-use technologies that serve both civilian and military purposes. It may also consider whether research exemptions should be narrowed to prevent misuse.
The extraterritorial scope of the Act may be refined to address compliance challenges for non-EU providers. The revision could introduce new mechanisms for cooperation with international regulators, building on the Act's existing provisions for providers with users within the EU.
Implementation and Enforcement
The 2032 revision will likely address enforcement gaps identified during the initial implementation period. The Act requires member states to designate national supervisory authorities, and the European Artificial Intelligence Board coordinates their activities. The revision may strengthen these bodies' powers, introduce new penalties, or streamline conformity assessment procedures.
Citizens have the right to submit complaints about AI systems and receive explanations of decisions made by high-risk AI affecting their rights. The revision may expand these rights or clarify their application in specific sectors, such as healthcare, education, or law enforcement. The Fundamental Rights Impact Assessment, required for some high-risk systems, may also be updated based on practical experience.
Anticipated Timeline and Process
The 2032 revision is expected to follow the EU's ordinary legislative procedure. The European Commission will likely publish a proposal in late 2031 or early 2032, following a public consultation and impact assessment. The European Parliament and Council will then negotiate amendments, with adoption possible by mid-2032. The revised Act would enter into force after publication in the Official Journal, with transitional periods for compliance.
As of the current date, no official proposal has been published, and the exact scope of the revision remains uncertain. Stakeholders anticipate that the revision will focus on adapting the Act to technological developments, improving coherence with other EU digital regulations, and addressing implementation challenges. The outcome will shape the regulatory landscape for AI in Europe for the following decade.