EU AI Act (Regulation (EU) 2024/1689)

What it is

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, is a horizontal law covering AI placed on the market, put into service or used in the European Union. It was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. As a regulation it applies directly in every member state, without national transposition.

The Act takes a risk-based approach. A small set of practices is prohibited. A defined set of high-risk uses carries detailed obligations across the lifecycle. Certain systems carry transparency duties. Everything else is minimal risk and largely untouched. General-purpose AI models, the models underneath most generative AI products, sit in their own regime.

On 24 July 2026 the Official Journal published Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force on 27 July 2026. It pushed back the high-risk dates, fixed them in law, added two prohibited practices and expanded the AI Office’s enforcement powers. The Act as amended is the version that applies now.

Who it applies to

The Act assigns duties by role. Providers develop an AI system or general-purpose AI model, or have one developed, and place it on the market or put it into service under their own name. Deployers use an AI system under their authority in a professional capacity. Importers, distributors and authorised representatives sit between them in the supply chain.

Reach is not limited to EU-established organisations. Providers placing systems or models on the EU market are covered wherever they are based, and so are providers and deployers outside the EU where the output of the system is used in the EU. A company with EU customers, EU users of an AI-enabled product or an EU group entity can be in scope without an EU office. Research, military and purely personal uses are excluded.

What it requires

Prohibited practices (Article 5). Banned outright since 2 February 2025. They include manipulative or exploitative techniques that cause significant harm, social scoring, predicting criminality from profiling alone, untargeted scraping of facial images, emotion recognition in workplaces and schools, biometric categorisation to infer sensitive traits, and most real-time remote biometric identification by police in public spaces. The Digital Omnibus adds AI systems used to generate non-consensual intimate content and child sexual abuse material, from 2 December 2026.

AI literacy (Article 4). Providers and deployers take measures to support the AI literacy of staff and others operating AI on their behalf. The duty has applied since 2 February 2025. The Digital Omnibus softened it from ensuring a sufficient level of literacy to supporting its development, and gave the Commission and Member States a role in promoting it.

High-risk systems. These are AI used as a safety component of, or as, a product covered by the EU product legislation in Annex I, and the stand-alone uses listed in Annex III. Annex III covers biometrics, critical infrastructure, education, employment and worker management, access to essential private and public services such as credit and insurance, law enforcement, migration and border control, and the administration of justice and democratic processes. A provider of a high-risk system needs a risk management system across the lifecycle (Article 9), data governance (Article 10), technical documentation (Article 11), automatic logging (Article 12), instructions for deployers (Article 13), human oversight by design (Article 14), and appropriate accuracy, robustness and cybersecurity (Article 15). It also needs a quality management system, a conformity assessment before market, CE marking, registration in the EU database and post-market monitoring.

Deployers of high-risk systems (Articles 26 and 27). Deployers use the system according to its instructions, assign competent human oversight, keep the logs under their control, monitor operation and inform workers before workplace use. Public bodies, private entities providing public services, and deployers using AI for creditworthiness or life and health insurance pricing must carry out a fundamental rights impact assessment before first use. Under Article 86 a person affected by a high-risk decision can ask the deployer for an explanation of the role the AI played.

Serious incidents (Article 73). Providers of high-risk systems report serious incidents to the market surveillance authority, with deadlines that run from when the provider becomes aware.

Transparency (Article 50). People must be told when they are interacting with an AI system, unless it is obvious. Providers of generative systems mark synthetic audio, image, video and text in a machine-readable way. Deployers disclose deepfakes and AI-generated text published to inform the public on matters of public interest. These duties have applied since 2 August 2026.

General-purpose AI models (Articles 53 to 55). Providers keep technical documentation, give downstream providers the information they need, maintain a copyright policy and publish a summary of training content. Models presumed to carry systemic risk, including those trained with more than 10^25 floating point operations, add model evaluation, adversarial testing, serious incident reporting and cybersecurity duties. The General-Purpose AI Code of Practice is the main route providers use to show they meet these.

Key dates

The Act applies in stages. Prohibited practices and AI literacy applied from 2 February 2025. GPAI model obligations, the governance structure and penalties applied from 2 August 2025. General application, including Article 50 transparency, began on 2 August 2026, and the Digital Omnibus did not move that date.

The Omnibus changed the rest. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to add machine-readable marking under Article 50(2). The two new prohibitions also apply from 2 December 2026. Obligations for Annex III high-risk systems now apply from 2 December 2027, and for Annex I product-embedded systems from 2 August 2028. GPAI models placed on the market before 2 August 2025 must comply by 2 August 2027.

National implementation

Each member state designates market surveillance and notifying authorities and sets national penalty rules. Ireland is one example. Its Regulation of Artificial Intelligence Bill 2026 was published on 19 June 2026 and signed into law on 21 July 2026 as the Regulation of Artificial Intelligence Act 2026. It establishes Oifig IS na hÉireann, the AI Office of Ireland, as the central coordinating authority and single point of contact with the Commission, while existing sectoral regulators supervise AI in their own fields. Provisions commence by ministerial order. National laws like this set up enforcement. They add no new obligations to assess against beyond the Act itself.

How it relates to other frameworks

The Act sits alongside the GDPR, which still governs any personal data an AI system processes, including Article 22 on solely automated decisions. A deployer’s fundamental rights impact assessment can build on an existing data protection impact assessment. Its seven underlying requirements trace back to the Ethics Guidelines for Trustworthy AI.

ISO/IEC 42001 and the NIST AI RMF are not conformity routes, but they give an organisation the management system and risk practices the Act’s lifecycle obligations assume. Harmonised European standards being developed under the Act will provide presumption of conformity once published. Outside the EU, the Council of Europe AI Convention covers similar ground from a human rights angle.

Working with it in Aicura

The EU AI Act is available as a framework in Aicura from the Essentials tier, for organisations in the EU. Once it is enabled in Settings, risk and impact assessments for each register entry apply it alongside any other frameworks you run, and governance policy reviews can use it as a source. Suggested controls from those assessments land in Risks and Controls, where each is tracked as applicable, implemented and tested. Incident tracking, in Pro, includes an Article 73 serious incident reporting pathway, alongside notification to your data protection authority. Policy review reports show where a policy stands against the frameworks it was reviewed under. Aicura gives guidance for your own judgement and your advisers’. It does not perform conformity assessments or decide whether a system is high-risk.