The Artificial Intelligence Act (AI Act) is a European Union regulation that establishes a common regulatory and legal framework for artificial intelligence (AI) within the EU. It entered into force on 1 August 2024, with provisions coming into operation gradually over the following 6 to 36 months. As a product regulation, it does not create individual rights but imposes duties on AI providers and professional users.
The Act covers most AI systems across a wide range of sectors, with exemptions for military, national security, research, and non-professional use. It classifies non-exempt applications by risk of harm into four levels - unacceptable, high, limited, minimal - plus a separate category for general-purpose AI. The framework follows a product-safety model, assigning regulatory duties to providers and deployers that increase with potential impact on health, safety, or fundamental rights.
Origins and Legislative History
The European Commission proposed the AI Act on 21 April 2021. The draft was revised to address the rapid rise of Generative AI systems such as ChatGPT, whose general-purpose capabilities did not fit the original risk-based framework. The European Parliament passed the Act on 13 March 2024, and the EU Council unanimously approved it on 21 May 2024. The regulation entered into force on 1 August 2024.
During the legislative process, policymakers consulted stakeholders and drew on existing research, as noted in an appraisal by the European Parliamentary Research Service. The introduction of a dedicated general-purpose AI category in 2023 reflected the growing influence of Large language model systems and their widespread deployment.
Risk Categories
The Act defines four primary risk categories plus a distinct category for general-purpose AI:
Unacceptable risk - Applications in this category are banned, with specific exemptions. Bans cover AI that manipulates human behavior, real-time remote biometric identification (such as facial recognition) in public spaces, and social scoring that ranks individuals based on personal characteristics, socio-economic status, or behavior.
High-risk - Applications posing significant threats to health, safety, or fundamental rights, including AI in health, education, recruitment, critical infrastructure, law enforcement, or justice. These systems must comply with quality, transparency, human oversight, and safety obligations. Some require a Fundamental Rights Impact Assessment before deployment. High-risk systems undergo conformity assessments both before market placement and throughout their lifecycle. The list of high-risk applications can be expanded without amending the Act itself. Citizens have the right to submit complaints and receive explanations of decisions made by high-risk AI affecting their rights.
Limited risk - Systems with transparency obligations only, ensuring users know they are interacting with AI. This covers tools that generate or manipulate images, sound, or video, such as deepfakes.
Minimal risk - Systems like video games or spam filters. These are not regulated, and member states cannot impose additional requirements due to maximum harmonisation rules. A voluntary code of conduct is suggested.
General-Purpose AI Obligations
The general-purpose AI category, added in 2023, covers foundation models that perform a wide range of tasks. Open-source model developers must publish a training data summary and copyright policy; closed-source models face broader transparency requirements. High-impact models requiring more than 10^25 floating-point operations to train must undergo additional evaluation and adversarial testing, assess risks like bias and security failures, report serious incidents, and ensure cybersecurity.
A General-Purpose AI Code of Practice, published on 10 July 2025, outlines three main chapters on transparency, copyright, and safety and security. Participation is voluntary. All providers of general-purpose AI models must publish training data summaries, adopt copyright compliance policies, and provide technical documentation to downstream providers and supervisory authorities.
Exemptions and Extraterritoriality
Articles 2.3 and 2.6 exempt AI systems used exclusively for military, defence, or national security purposes, as well as pure scientific research and development. Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers outside the EU if they have users within the EU.
Enforcement and Governance
The Act creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance. Member states designate supervisory authorities to oversee implementation. The risk-based scheme ensures oversight focuses on systems likely to create significant risks while allowing lighter approaches for less sensitive uses.
Broader Context
Legal scholars argue the Act frames "trustworthy AI" as systems that demonstrate compliance with safety and risk thresholds. The extraterritorial reach and comprehensive risk categories make it a benchmark for AI regulation globally, influencing debates in other jurisdictions about balancing innovation and fundamental rights protection.