The EU AI Act Amendments denote the series of changes made to the European Union's proposed Artificial Intelligence Act (AI Act) between its initial proposal and final adoption. Proposed by the European Commission on 21 April 2021, the draft regulation aimed to establish a common regulatory and legal framework for AI across the EU. However, the rapid rise of Generative AI systems, such as ChatGPT, whose general-purpose capabilities did not fit the original risk-based framework, prompted significant revisions during the legislative process. These amendments, added in 2023, introduced a dedicated category for general-purpose AI and adjusted transparency and evaluation obligations accordingly. The final text passed the European Parliament on 13 March 2024 and was unanimously approved by the EU Council on 21 May 2024, entering into force on 1 August 2024, with provisions rolling out gradually over the following 6 to 36 months.
The amendments reflected a broader shift in the regulatory debate, as lawmakers recognized that traditional product-safety models were insufficient for AI systems that could be adapted to myriad uses. The original proposal, drafted in 2021, had focused on fixed risk categories for specific applications, but the emergence of foundation models and large language models like those developed by OpenAI and Anthropic necessitated a more flexible approach. The revised Act introduced a horizontal layer of obligations for general-purpose AI models, complementing the vertical risk-based duties for specific applications. This dual structure was designed to address both the potential harms of individual AI uses and the systemic risks posed by highly capable, multi-purpose models.
Risk Categories
The AI Act classifies non-exempt AI applications into four risk levels - unacceptable, high, limited, and minimal - with an additional category for general-purpose AI. This risk-based scheme follows a product-safety model where regulatory duties on providers and deployers increase with the potential impact on health, safety, or fundamental rights.
Unacceptable risk: Applications in this category are banned, except for specific exemptions. This includes AI that manipulates human behaviour, real-time remote biometric identification (such as facial recognition) in public spaces, and social scoring systems that rank individuals based on personal characteristics or behaviour. These bans reflect concerns about fundamental rights and democratic values.
High risk: AI systems that pose significant threats to health, safety, or fundamental rights fall here, including those used in health, education, recruitment, critical infrastructure, law enforcement, or justice. They must comply with security, transparency, and quality obligations, undergo conformity assessments, and in some cases require a Fundamental Rights Impact Assessment (FRIA) before deployment. The list of high-risk applications can be expanded over time without amending the Act itself, allowing for adaptability.
Limited risk: These systems have transparency obligations, ensuring users know they are interacting with AI. This category covers applications that generate or manipulate images, sound, or video, such as deepfakes. Users must be informed to make conscious choices.
Minimal risk: Most AI applications, such as video games or spam filters, fall into this category. They are not regulated, and Member States cannot impose additional regulations due to maximum harmonisation rules. A voluntary code of conduct is suggested for these systems.
General-Purpose AI Category
The most significant amendment to the original proposal was the addition of a dedicated category for general-purpose AI in 2023. This category includes foundation models like ChatGPT that can perform a wide range of tasks. The amendments imposed transparency requirements on all general-purpose AI providers, with reduced obligations for open-source models. For closed-source models, broader transparency rules apply, including publishing a training data summary and a copyright policy. High-impact models that pose systemic risks - defined as requiring more than 10^25 floating-point operations to train - must undergo extra evaluation. The General-Purpose AI Code of Practice, published on 10 July 2025, outlines three main chapters on transparency, copyright, and safety and security to help providers demonstrate compliance, though participation is voluntary.
The amendments also set a common list of obligations for general-purpose AI providers. They must publish a summary of training data, adopt a policy to comply with copyright law, and provide technical documentation to downstream providers and supervisory authorities. For models designated as posing systemic risk, additional duties include model evaluations, adversarial testing, risk assessment and mitigation (such as bias and security failures), reporting serious incidents, and ensuring adequate cybersecurity. These provisions were influenced by the growing capabilities of models developed by companies like Google DeepMind and Xerox PARC-era research, though the Act itself focuses on deployment rather than research.
Exemptions
Articles 2.3 and 2.6 exempt AI systems used exclusively for military, defence, or national security purposes, as well as pure scientific research and development, from the AI Act. Non-professional use is also excluded. This means that research-focused AI systems, such as those developed in academic labs like MIT CSAIL or BAIR (Berkeley AI Research), are not regulated under the Act when used solely for research. However, if such systems are later deployed commercially, they fall within scope. The exemption for military applications reflects national security prerogatives, though the use of AI in civilian law enforcement remains subject to high-risk obligations.
The Act also allows for extraterritorial application, similar to the EU's General Data Protection Regulation. Providers from outside the EU are subject to the regulation if they have users within the EU, ensuring a level playing field and protecting EU citizens.
Institutional Framework
The amendments introduced the European Artificial Intelligence Board, a European Artificial Intelligence Board, to promote national cooperation and ensure consistent compliance across Member States. The Board facilitates coordination between national supervisory authorities and provides guidance on the Act's application. This institutional mechanism was added during the legislative process to address the need for harmonised enforcement in a digital single market.
Legislative Process
The amendment process was iterative. After the Commission's 2021 proposal, the European Parliament and Council negotiated changes. The rise of generative AI, particularly the launch of ChatGPT in late 2022, accelerated the need for revision. Negotiations culminated in a political agreement in late 2023, with the Parliament adopting the final text on 13 March 2024 and the Council on 21 May 2024. The amendments were crucial in making the Act future-proof, as they allow for the classification of general-purpose models without reopening the primary legislation.
Implementation Timeline
The Act entered into force on 1 August 2024, with provisions phased in over 6 to 36 months. This gradual implementation gives providers and authorities time to adapt. The risk-based obligations will apply at different dates, with bans on unacceptable risk taking effect first, followed by high-risk obligations and general-purpose AI requirements. This timeline was a key amendment to balance innovation and protection.
Impact
The EU AI Act Amendments represent a landmark in AI regulation. By integrating generative AI, the Act sets a precedent for other jurisdictions. Its risk-based approach, combined with general-purpose AI oversight, aims to foster trust while allowing innovation. As of 2025, the Act is being implemented across the EU, with the European Artificial Intelligence Board coordinating efforts. The amendments reflect a dynamic regulatory environment that seeks to keep pace with rapid technological advances in Deep learning, Large language models, and Transformer (architecture) architectures.