The Artificial Intelligence Act (AI Act) is a European Union regulation concerning artificial intelligence (AI), establishing a common regulatory and legal framework for AI within the EU. The regulation entered into force on 1 August 2024, with provisions that shall come into operation gradually over the following 6 to 36 months. It covers most AI systems across a wide range of sectors, with exemptions for AI used only for military, national security, research purposes, or for non-professional use. As a form of product regulation, it does not create individual rights; instead, it places duties on AI providers and on organisations that use AI in a professional context.
The Act classifies non-exempt AI applications by their risk of causing harm, with four levels – unacceptable, high, limited, minimal – plus an additional category for general-purpose AI. Applications with unacceptable risks are banned. High-risk applications must comply with security, transparency and quality obligations, and undergo conformity assessments. Limited-risk applications only have transparency obligations. Minimal-risk applications are not regulated. For general-purpose AI, transparency requirements are imposed, with reduced requirements for open source models, and additional evaluations for high-capability models. The Act also creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance with the regulation. Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers from outside the EU if they have users within the EU.
Legislative History
Proposed by the European Commission on 21 April 2021, the draft Act passed the European Parliament on 13 March 2024, and was unanimously approved by the EU Council on 21 May 2024. The draft was revised to address the rise in popularity of generative AI systems, such as ChatGPT, whose general-purpose capabilities did not fit the main framework. The final text was published in the Official Journal of the EU in July 2024, with the regulation entering into force on 1 August 2024. The phased application timeline means that prohibitions on unacceptable-risk systems became applicable in February 2025, while general-purpose AI obligations and governance rules followed in August 2025, and most high-risk system requirements are scheduled for August 2026 or later.
Risk Categories
The Act establishes a risk-based scheme following a product-safety model in which regulatory duties are assigned to providers and deployers of AI systems, with duties becoming more demanding as potential impact on health, safety, or fundamental rights increases. This structure ensures oversight focuses on systems likely to create significant risks while allowing lighter approaches for less sensitive uses.
Unacceptable Risk
AI applications in this category are banned, except for specific exemptions. When no exemption applies, this includes AI applications that manipulate human behaviour, those that use real-time remote biometric identification (such as facial recognition) in public spaces, and those used for social scoring (ranking individuals based on personal characteristics, socio-economic status, or behaviour). These prohibitions took effect in February 2025, six months after entry into force.
High Risk
AI applications expected to pose significant threats to health, safety, or fundamental rights of persons fall into this category. Notably, AI systems used in health, education, recruitment, critical infrastructure management, law enforcement, or justice are included. They are subject to quality, transparency, human oversight, and safety obligations, and in some cases require a Fundamental Rights Impact Assessment (FRIA) before deployment. A FRIA is an ex ante review to identify and mitigate potential impacts on fundamental rights before an AI system is deployed. Earlier work on algorithmic impact assessments has suggested that such tools should identify which individuals and communities are affected by an automated system, describe possible harms, and provide a basis for public and institutional scrutiny of its use. High-risk systems must be evaluated both before they are placed on the market and throughout their life cycle. The list of high-risk applications can be expanded over time without modifying the AI Act itself. Citizens also have a right to submit complaints about AI systems and to receive explanations of decisions made by high-risk AI that affect their rights.
Limited Risk
AI systems in this category have transparency obligations, ensuring users are informed that they are interacting with an AI system and allowing them to make informed choices. This category includes AI applications that generate or manipulate images, sound, or videos, such as deepfakes. These transparency duties apply from August 2026, though some provisions related to general-purpose AI transparency took effect earlier.
Minimal Risk
This category includes AI systems used for video games or spam filters. Most AI applications are expected to fall into this category. These systems are not regulated, and Member States cannot impose additional regulations due to maximum harmonisation rules. Existing national laws regarding the design or use of such systems are overridden. However, a voluntary code of conduct is suggested.
General-Purpose AI
Added in 2023, the general-purpose AI category includes foundation models, such as ChatGPT, that can perform a wide range of tasks. If a model's weights and design are made open source, developers must publish a training data summary and a copyright policy; closed-source models must meet broader transparency requirements. High-impact models that pose systemic risks, requiring more than 10^25 floating-point operations to train, must undergo extra evaluation. A General-Purpose AI Code of Practice, published on 10 July 2025, outlines three main chapters on transparency, copyright, and safety and security to help providers demonstrate compliance with the AI Act. Participation in the code is voluntary.
Beyond basic transparency duties, the Act sets a common list of obligations for providers of general-purpose AI models. They must publish a summary of the training data, adopt a policy to comply with copyright law, and provide technical documentation to downstream providers and supervisory authorities. Models designated as posing systemic risk must also carry out model evaluations and adversarial testing, assess and mitigate risks such as bias and security failures, report serious incidents, and ensure an adequate level of cybersecurity.
Exemptions
Articles 2.3 and 2.6 exempt AI systems used for military or national security purposes or pure scientific research and development from the AI Act. The Regulation does not apply where AI systems are used exclusively for military, defence, or national security purposes, or to systems developed and put into service solely for scientific research. Additionally, AI used for non-professional personal activities falls outside the scope. These exemptions mean that defence-related AI development, such as work by organisations like Bhabha Atomic Research Centre, is not subject to the Act's obligations.
Enforcement and Governance
The Act creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance with the regulation. Each Member State must designate competent national authorities for market surveillance and supervision of AI systems. The European Commission plays a central role in overseeing general-purpose AI models, including designating systemic-risk models. Enforcement mechanisms include fines for non-compliance, which can reach up to 35 million euros or 7% of global annual turnover for prohibited practices, with lower caps for other violations. The extraterritorial scope means providers from outside the EU, including major technology companies such as OpenAI, Anthropic, and Google DeepMind, must comply if they offer AI services to users within the EU.
Implementation Timeline
The phased application began with prohibitions on unacceptable-risk systems in February 2025. Governance rules and general-purpose AI obligations, including the establishment of the AI Board and the code of practice, became applicable in August 2025. Transparency obligations for limited-risk systems and most high-risk system requirements are scheduled to apply from August 2026. High-risk systems embedded in regulated products, such as medical devices or vehicles, have an extended timeline until August 2027. This staggered approach allows providers and deployers time to adapt their compliance frameworks.
Impact and Reception
Legal scholars have noted that the Act frames "trustworthy AI" as systems that can show compliance with safety and risk thresholds. According to an initial appraisal by the European Parliamentary Research Service, the Commission's impact assessment drew on stakeholder consultations and a wide range of existing research when comparing policy options for this risk-based framework. The Act's approach has influenced AI regulation discussions globally, with other jurisdictions examining the EU model. However, some industry observers have raised concerns about compliance costs for smaller providers, while civil society groups have argued for stronger protections in areas like biometric surveillance. The voluntary code of conduct for minimal-risk systems and the general-purpose AI code of practice represent efforts to encourage best practices beyond mandatory requirements.