The Artificial Intelligence Act (AI Act) is a European Union regulation that establishes a common regulatory and legal framework for artificial intelligence within the EU. It entered into force on 1 August 2024, with provisions coming into operation gradually over the following 6 to 36 months. The Act covers most AI systems across a wide range of sectors, with exemptions for AI used only for military, national security, research purposes, or for non-professional use. As a form of product regulation, it does not create individual rights; instead, it places duties on AI providers and on organisations that use AI in a professional context.
The Act classifies non-exempt AI applications by their risk of causing harm, creating four levels - unacceptable, high, limited, and minimal - plus an additional category for general-purpose AI. This risk-based scheme follows a product-safety model in which regulatory duties are assigned to providers and deployers of AI systems, with duties becoming more demanding as potential impact on health, safety, or fundamental rights increases. The structure aims to focus oversight on systems likely to create significant risks while allowing lighter approaches for less sensitive uses.
Legislative History
The European Commission proposed the AI Act on 21 April 2021. The European Parliament passed it on 13 March 2024, and the EU Council unanimously approved it on 21 May 2024. During the legislative process, the draft was revised to address the rise in popularity of generative AI systems, such as ChatGPT, whose general-purpose capabilities did not fit the main framework. This revision added the general-purpose AI category in 2023, covering foundation models that can perform a wide range of tasks.
The Act also creates a European Artificial Intelligence Board to promote national cooperation and ensure compliance. Like the EU's General Data Protection Regulation, the Act can apply extraterritorially to providers from outside the EU if they have users within the EU.
Risk Categories
Unacceptable Risk
AI applications in this category are banned, except for specific exemptions. When no exemption applies, this includes AI applications that manipulate human behaviour, those that use real-time remote biometric identification (such as facial recognition) in public spaces, and those used for social scoring - ranking individuals based on personal characteristics, socio-economic status, or behaviour.
High Risk
High-risk applications are those expected to pose significant threats to health, safety, or fundamental rights of persons. Notably, AI systems used in health, education, recruitment, critical infrastructure management, law enforcement, or justice fall into this category. These systems are subject to quality, transparency, human oversight, and safety obligations. In some cases, they require a Fundamental Rights Impact Assessment (FRIA) before deployment - an ex ante review to identify and mitigate potential impacts on fundamental rights. They must be evaluated both before being placed on the market and throughout their life cycle. The list of high-risk applications can be expanded over time without modifying the AI Act itself. Citizens have the right to submit complaints about AI systems and to receive explanations of decisions made by high-risk AI that affect their rights.
Limited Risk
Limited-risk AI systems have transparency obligations, ensuring users are informed that they are interacting with an AI system and allowing them to make informed choices. This category includes AI applications that generate or manipulate images, sound, or videos, such as deepfakes.
Minimal Risk
Minimal-risk applications include AI systems used for video games or spam filters. Most AI applications are expected to fall into this category. These systems are not regulated, and member states cannot impose additional regulations due to maximum harmonisation rules. Existing national laws regarding the design or use of such systems are overridden. However, a voluntary code of conduct is suggested.
General-Purpose AI
The general-purpose AI category, added in 2023, includes foundation models that can perform a wide range of tasks. If a model's weights and design are made open source, developers must publish a training data summary and a copyright policy. Closed-source models must meet broader transparency requirements. High-impact models that pose systemic risks - requiring more than 1025 floating-point operations to train - must undergo extra evaluation.
Beyond basic transparency duties, the Act sets a common list of obligations for providers of general-purpose AI models. They must publish a summary of training data, adopt a policy to comply with copyright law, and provide technical documentation to downstream providers and supervisory authorities. Models designated as posing systemic risk must also carry out model evaluations and adversarial testing, assess and mitigate risks such as bias and security failures, report serious incidents, and ensure an adequate level of cybersecurity.
A General-Purpose AI Code of Practice, published on 10 July 2025, outlines three main chapters on transparency, copyright, and safety and security to help providers demonstrate compliance. Participation in the code is voluntary.
Exemptions
Articles 2.3 and 2.6 exempt AI systems used for military or national security purposes or pure scientific research and development from the AI Act. The regulation does not apply where AI systems are used exclusively for military, defence, or national security purposes, or to systems developed and put into service solely for those purposes.
Implementation Timeline
The regulation entered into force on 1 August 2024, with provisions phasing in gradually over 6 to 36 months. This staggered approach allows providers and deployers time to adapt to new obligations. The European Artificial Intelligence Board supports national cooperation and consistent enforcement across member states.
Impact and Interpretation
Some legal scholars argue that, in practice, the Act frames "trustworthy AI" as systems that can show compliance with safety and risk thresholds. According to an initial appraisal by the European Parliamentary Research Service, the Commission's impact assessment drew on stakeholder consultations and a wide range of existing research when comparing policy options for the risk-based framework. The extraterritorial application means non-EU providers with EU users must also comply, similar to the General Data Protection Regulation's reach.
Related Concepts
The AI Act's risk-based approach relates to broader developments in artificial intelligence governance. Its provisions on general-purpose AI intersect with technologies like large language models and generative AI. The transparency requirements for deepfakes connect to deep learning applications. The Act's focus on high-risk sectors such as healthcare and law enforcement reflects concerns also addressed by organisations like Google DeepMind and OpenAI in their safety research. The Fundamental Rights Impact Assessment draws on earlier work in algorithmic impact assessments, similar to research from institutions like MIT CSAIL and Stanford AI Lab.