The Artificial Intelligence Act (AI Act) is a European Union regulation that establishes a common regulatory and legal framework for artificial intelligence across the EU. It entered into force on 1 August 2024, with provisions coming into operation gradually over the following 6 to 36 months. The Act covers most AI systems across a wide range of sectors, with exemptions for AI used only for military, national security, research purposes, or non-professional use. As a form of product regulation, it does not create individual rights; instead, it places duties on AI providers and on organisations that use AI in a professional context.
The Act classifies non-exempt AI applications by their risk of causing harm, with four levels - unacceptable, high, limited, and minimal - plus an additional category for general-purpose AI. Applications with unacceptable risks are banned. High-risk applications must comply with security, transparency and quality obligations, and undergo conformity assessments. Limited-risk applications only have transparency obligations. Minimal-risk applications are not regulated. For general-purpose AI, transparency requirements are imposed, with reduced requirements for open source models, and additional evaluations for high-capability models. The Act also creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance with the regulation. Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers from outside the EU if they have users within the EU.
Proposal and Legislative Journey
The European Commission proposed the AI Act on 21 April 2021. The draft was designed to harmonise rules for AI systems across the single market, following a risk-based approach similar to existing product safety legislation. The initial proposal focused on traditional machine learning and deep learning systems, categorising them by their potential to cause harm.
During the legislative process, the rise of generative AI systems such as ChatGPT prompted significant revisions. The original framework did not adequately address general-purpose models that could perform a wide range of tasks across different sectors. In 2023, the draft was revised to include a dedicated category for general-purpose AI, covering foundation models and large language models. This revision acknowledged that systems like ChatGPT and other large language models required different regulatory treatment than narrower applications.
Parliamentary Approval and Council Adoption
The European Parliament passed the AI Act on 13 March 2024, following extensive negotiations and amendments. The Parliament's version strengthened provisions on fundamental rights, added requirements for fundamental rights impact assessments for high-risk systems, and expanded transparency obligations for generative AI. The EU Council unanimously approved the final text on 21 May 2024, completing the legislative process.
The final regulation was published in the Official Journal of the European Union in July 2024, with entry into force on 1 August 2024. The phased implementation timeline means different obligations apply at different dates, with bans on unacceptable risk applications taking effect earlier than requirements for high-risk systems.
Risk Categories in Detail
The Act establishes four primary risk categories plus a separate category for general-purpose AI. Unacceptable risk applications are banned outright, with specific exemptions. This includes AI that manipulates human behaviour, real-time remote biometric identification in public spaces, and social scoring systems that rank individuals based on personal characteristics or behaviour.
High-risk applications are those expected to pose significant threats to health, safety, or fundamental rights. This includes AI systems used in health, education, recruitment, critical infrastructure management, law enforcement, and justice. These systems must meet quality, transparency, human oversight, and safety obligations. Some require a Fundamental Rights Impact Assessment before deployment, which is an ex ante review to identify and mitigate potential impacts on fundamental rights. High-risk systems must be evaluated both before market placement and throughout their life cycle. The list of high-risk applications can be expanded over time without modifying the AI Act itself. Citizens have the right to submit complaints about AI systems and to receive explanations of decisions made by high-risk AI that affect their rights.
Limited risk systems have transparency obligations, ensuring users know they are interacting with AI and can make informed choices. This category includes applications that generate or manipulate images, sound, or videos, such as deepfakes. Minimal risk systems, including video game AI and spam filters, are not regulated, and member states cannot impose additional regulations due to maximum harmonisation rules.
General-Purpose AI Provisions
Added in 2023, the general-purpose AI category covers foundation models that can perform a wide range of tasks, including generative AI systems. If a model's weights and design are made open source, developers must publish a training data summary and a copyright policy. Closed-source models must meet broader transparency requirements. High-impact models posing systemic risks, defined as requiring more than 1025 floating-point operations to train, must undergo extra evaluation.
A General-Purpose AI Code of Practice, published on 10 July 2025, outlines three main chapters on transparency, copyright, and safety and security to help providers demonstrate compliance. Participation in the code is voluntary. Beyond basic transparency duties, the Act sets a common list of obligations for general-purpose AI model providers. They must publish a summary of training data, adopt a copyright compliance policy, and provide technical documentation to downstream providers and supervisory authorities. Models designated as posing systemic risk must also carry out model evaluations and adversarial testing, assess and mitigate risks such as bias and security failures, report serious incidents, and ensure adequate cybersecurity.
Exemptions and Scope
Articles 2.3 and 2.6 exempt AI systems used for military or national security purposes or pure scientific research and development from the AI Act. The regulation does not apply where AI systems are used exclusively for military, defence, or national security purposes, or to systems developed and put into service solely for scientific research. This exemption recognises the need to balance innovation with regulation while maintaining member states' control over security matters.
Implementation and Enforcement
The Act creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance. The European AI Board coordinates supervisory authorities across member states, similar to the governance structure established by the General Data Protection Regulation. The phased implementation timeline is detailed in the enforcement timeline, with different obligations activating at 6, 12, 24, and 36 months after entry into force.
The extraterritorial scope means providers from outside the EU must comply if they have users within the EU. This mirrors the GDPR's approach and has significant implications for global AI developers, including those in the United States, China, and other major AI markets. The Act's risk-based framework follows a product-safety model where regulatory duties are assigned to providers and deployers, with duties becoming more demanding as potential impact on health, safety, or fundamental rights increases.
Broader Context and Impact
The AI Act represents one of the first comprehensive attempts to regulate artificial intelligence at a regional level. Its development paralleled rapid advances in machine learning and deep learning technologies, including the transformer architecture that underpins modern large language models. The legislative timeline reflects the challenge of regulating a fast-moving field, with the 2023 revisions responding to the explosive growth of generative AI tools.
The Act's approach has influenced discussions in other jurisdictions, though its full impact remains to be seen as implementation proceeds. The European Parliamentary Research Service provided an initial appraisal of the Commission's impact assessment, which drew on stakeholder consultations and existing research when comparing policy options. Legal scholars have noted that the Act frames "trustworthy AI" as systems that can demonstrate compliance with safety and risk thresholds, establishing a compliance-oriented approach to AI governance.
The phased rollout allows organisations time to adapt, but the complexity of the requirements, particularly for high-risk and general-purpose AI, has generated significant compliance activity across the technology sector. As of the Act's entry into force, the full operational consequences for AI developers, deployers, and users across the EU and beyond continue to unfold.