European Union: AI and data protection regulation
The EU already requires AI literacy, avoiding prohibited practices and AI disclosures; high-risk obligations arrive in December 2027.
GROU LLC · built on AI Business Core, by Vreinn · · How we verify sources
Summary
The EU AI Act applies in every Member State without national legislation. Prohibitions, staff AI literacy, transparency for chatbots and generated content, and general-purpose model rules already apply. The 2026 Digital Omnibus postponed high-risk obligations to December 2, 2027 (employment, credit, education, biometrics) and August 2, 2028 (regulated products) without changing their content. The GDPR remains the rule with the most practical weight, and there are sector layers for finance, insurance, healthcare, platforms and software makers.
- Binding AI law today?
- Yes
- Obligations verified in the official source
- 100 %
- Information as of
Authorities
- European AI Office
Supervises general-purpose models and systems built on them by the same provider
- European Commission
Publishes guidelines, codes of practice and implementing acts
- European Data Protection Board (EDPB)
Coordinates GDPR enforcement and issues opinions on AI
- European Supervisory Authorities (EBA, EIOPA, ESMA)
AI and DORA guidance and supervision in the financial sector
- ENISA
Runs the Cyber Resilience Act single reporting platform
Rules covered
Key dates
- National measures apply · CCD2
- New prohibitions (intimate imagery, child abuse) and end of the technical-marking grace period · AI Act
- Transposition deadline · Platform Work Directive
- Transposition and application to new products · Product Liability Directive
- End of switching charges · Data Act
- General application date and deadline for key implementing acts · EHDS
- Deadline for general-purpose models placed on the market before Aug 2025 · AI Act
- Annex III high-risk (employment, credit, education, biometrics…) · AI Act
- Full application · CRA
- Annex I high-risk (regulated products) · AI Act
- Secondary use and exchange of first data categories begin · EHDS
- Deadline for high-risk systems already used by public authorities · AI Act
- Second wave of data categories (imaging, lab results, discharge reports) · EHDS
Show past dates (22)
- Data access by design (Article 3(1)) for new products · Data Act
- Reporting obligations · CRA
- General application: Article 50 transparency, supervision and penalties · AI Act
- Digital Omnibus (Reg. 2026/1744) enters into force · AI Act
- Commission guidelines on Article 50 · AI transparency code
- Commission finds the Code adequate · AI transparency code
- Public consultation closes · High-risk guidelines (Art. 6)
- Final Code published · AI transparency code
- Draft published · High-risk guidelines (Art. 6)
- Transposition deadline · CCD2
- Application date · Data Act
- Published · EIOPA AI Opinion
- General-purpose AI model obligations · AI Act
- MDCG 2025-6 guidance on MDR/IVDR and the AI Act · MDR/IVDR
- Entry into force · EHDS
- Prohibitions and AI literacy · AI Act
- Application date · DORA
- Entry into force · AI Act
- IVDR applies · MDR/IVDR
- Application date · EBA loan origination guidelines
- MDR applies · MDR/IVDR
- Application date · GDPR
Regulatory change alerts by country
Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.
- Changes to the rules of the countries you pick, when we add them to the registry.
- New application dates.
- No more than one email a week. Unsubscribe at any time.
It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.