The EU AI Act is the world's first comprehensive AI law. Learn the four risk tiers, GPAI rules, compliance obligations, and enforcement timelines.
The European Union’s Artificial Intelligence Act is the world’s first comprehensive, horizontal legal framework for AI. Adopted by the European Parliament in March 2024 and published on July 12, 2024, the Act entered into force on August 1, 2024. It applies a tiered, risk-proportionate approach — regulating AI systems according to the harm they could cause rather than the technology itself. For developers, enterprises, and policymakers operating globally, this law is not optional.
The EU AI Act (Regulation (EU) 2024/1689) is a single-market regulation binding across all 27 EU member states. It applies not only to companies based in the EU but to any provider or deployer whose AI systems affect people inside the EU — making its reach genuinely global.
The Act was proposed by the European Commission in April 2021. Nearly three years of negotiations, accelerated by the public debut of large language models, produced a text covering both narrow AI applications and foundation models. Enforcement runs through a European AI Office, national competent authorities in each member state, and a newly created AI Board.
Unlike sector-specific laws such as GDPR or MiCA, the AI Act cuts horizontally across industries — health, finance, transport, law enforcement, education, and more.
The Act’s organizing principle is a four-level risk pyramid. Every AI system or application must be mapped to one of these tiers.
These practices are banned outright because they are deemed incompatible with EU values and fundamental rights:
Prohibited practices were the first provisions to apply, from February 2, 2025.
High-risk AI systems can be marketed but carry a substantial compliance burden before and after deployment. The Act identifies two categories:
Annex I — regulated products: AI systems embedded in products already subject to EU safety legislation, including medical devices, machinery, aviation components, motor vehicles, and toys.
Annex II — eight standalone domains:
Providers of high-risk systems must:
Deployers must conduct a fundamental rights impact assessment and monitor systems in use. High-risk obligations apply in full from August 2, 2026.
Systems in this tier pose modest risks but must be transparent with users. Chatbots must identify as AI. Deepfakes must be labeled. Emotion-recognition outputs must be disclosed to the individuals they are applied to. These are the lightest obligations and cover a large portion of consumer-facing AI products.
The vast majority of AI applications — spam filters, inventory tools, recommendation engines outside sensitive domains — fall here. No mandatory obligations apply, though providers are encouraged to follow voluntary codes of conduct.
One of the Act’s most consequential additions is Title VIII on General-Purpose AI (GPAI) models — large foundation models trained on broad data that serve many downstream purposes: language models, image generators, and multimodal systems.
All GPAI model providers must:
GPAI models with systemic risk face additional obligations. Systemic risk is presumed when a model is trained using more than 10^25 floating-point operations (FLOPs) — a threshold that currently captures only the most capable frontier models. Providers can also be designated by the Commission on other grounds. For context on why compute scale matters economically, see our guide on AI Inference Costs Explained: Why Running AI Is Expensive.
For models above the threshold, obligations include:
Energy and environmental reporting are expected to feature in the GPAI codes of practice — see our guide on Data Center Transparency and AI’s Environmental Impact.
The GPAI provisions apply from August 2, 2025 — one year after entry into force. Providers of models released before that date have until August 2, 2027 to comply if the model has been significantly modified or remains actively marketed.
The penalty structure is deliberately asymmetric to deter the most serious violations:
| Violation | Maximum Fine |
|---|---|
| Prohibited practices | €35 million or 7% of global annual turnover (whichever is higher) |
| Other non-compliance (high-risk, GPAI) | €15 million or 3% of global annual turnover |
| Providing incorrect information | €7.5 million or 1.5% of global annual turnover |
For SMEs and startups, fines are proportionate to their size. The Commission retains direct enforcement authority over GPAI providers with systemic risk, giving it a tool to act against large model developers without depending on individual member states.
| Date | What Applies |
|---|---|
| August 1, 2024 | Act enters into force |
| February 2, 2025 | Prohibited practices banned; AI literacy obligations for staff begin |
| August 2, 2025 | GPAI model rules apply; codes of practice finalized |
| August 2, 2026 | High-risk obligations fully apply; governance bodies operational |
| August 2, 2027 | AI embedded in EU product-safety-regulated products (medical devices, aviation) must comply; GPAI transitional period ends |
The EU has a track record — through GDPR, competition law, and product safety rules — of shaping global standards by virtue of market size and regulatory ambition. The AI Act is already producing a “Brussels Effect” in several observable ways.
First, multinationals are building compliance for EU rules globally. Maintaining separate product configurations by jurisdiction is expensive; applying the stricter standard everywhere is cheaper. This was GDPR’s mechanism, and AI Act compliance teams are following the same logic. For more on how large companies are shaping policy, see our guide on Big Tech’s Influence on AI Regulation and Policy.
Second, other jurisdictions are referencing the risk-based framework. The UK, Canada, and numerous US state-level bills have incorporated risk-tiering language that echoes Brussels. Our AI Regulation Tracker 2026 maps the full legislative landscape globally.
Third, the 10^25 FLOP compute threshold has become a de facto reference point in policy conversations well beyond the EU.
Cybersecurity obligations apply to all high-risk systems. For a practical framework, see our Enterprise AI Security: The Complete 2026 Guide.
Individuals may complain to their national competent authority about non-compliant AI systems. High-risk systems affecting credit, hiring, or benefits must disclose that AI was used and, in some cases, explain the outcome.
The AI Act is not a static text. Key elements remain delegated to secondary legislation and industry-developed codes of practice:
Enforcement quality will vary by member state, at least initially — NCAs have differing resources and technical capacity, a familiar challenge from GDPR implementation.
Last updated: June 2026