Skip to content
AI Policy Generator

ESWhat applies

European Union · Regulation

EU Artificial Intelligence Act (AI Act)

In forceAI Act

Summary

It is the world's first comprehensive AI law. It sorts AI uses by risk: it bans some, requires transparency for chatbots and generated content, and sets strict requirements for high-risk systems. In 2026 the Digital Omnibus postponed high-risk obligations to December 2027 (Annex III) and August 2028 (Annex I), but kept the prohibitions, AI literacy and transparency duties.

Who it applies to

Providers, professional users (deployers), importers and distributors of AI in the EU, and non-EU companies whose AI outputs are used in the EU.

Penalties

Up to EUR 35M or 7% of worldwide turnover for prohibited practices; up to EUR 15M or 3% for other obligations (including Articles 26 and 50); up to EUR 7.5M or 1% for supplying incorrect information. SMEs pay the lower amount. Each Member State sets its own penalty rules; in Spain the bill meant to do so lapsed in October 2026.

Official name
Reglamento (UE) 2024/1689 del Parlamento Europeo y del Consejo, de 13 de junio de 2024, por el que se establecen normas armonizadas en materia de inteligencia artificial (Reglamento de Inteligencia Artificial)
Official reference
Reglamento (UE) 2024/1689, DO L de 12.7.2024; modificado por el Reglamento (UE) 2026/1744 (Digital Omnibus sobre IA), DO L de 24.7.2026, en vigor el 27.7.2026
Regulator
European AI Office (general-purpose models) and national market surveillance authorities (AESIA in Spain)
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
AI literacy for staffReglamento (UE) 2024/1689, art. 4 (redacción del Reglamento (UE) 2026/1744)In forceFebruary 2, 2025Any organization that develops or uses AI systems, including staff who use tools such as ChatGPT or Copilot.Verified in the official source on November 2, 2026
Avoid prohibited AI practicesReglamento (UE) 2024/1689, art. 5(1)(a)-(h)In forceFebruary 2, 2025Any organization that develops, sells or uses AI in the EU.Verified in the official source on November 2, 2026
Prohibitions on biometrics and emotion recognitionReglamento (UE) 2024/1689, art. 5(1)(e), (f) y (g)In forceFebruary 2, 2025If you use biometrics, facial or emotion recognition, monitor workers or assess students.Verified in the official source on November 2, 2026
New prohibition: non-consensual intimate imagery and child sexual abuse materialReglamento (UE) 2024/1689, art. 5(1)(ba) y (bb), 5(1a) y 5(1b), añadidos por el Reglamento (UE) 2026/1744Adopted, applies laterDecember 2, 2026If you build or distribute systems that generate images, video or audio, or if your staff use generative AI to create content.Verified in the official source on November 2, 2026
Provider transparency: disclose AI interaction and mark synthetic contentReglamento (UE) 2024/1689, art. 50(1)-(2) y art. 111(4)In forceAugust 2, 2026If you build or sell under your own name a chatbot, agent, voice assistant or a system that generates text, images, audio or video. If you build your own chatbot on a third-party model and put it into service under your brand, you are usually the provider.Verified in the official source on November 2, 2026
Deployer transparency: deepfakes, public-interest text and emotion recognitionReglamento (UE) 2024/1689, art. 50(3)-(4)In forceAugust 2, 2026If you use chatbots, agents, generated marketing content, voice or likeness cloning, or emotion recognition or biometric categorization.Verified in the official source on November 2, 2026
Obligations for general-purpose AI model providersReglamento (UE) 2024/1689, arts. 53-55 y art. 111(3)In forceAugust 2, 2025Only if you develop or substantially modify a general-purpose AI model (for example, a language model) and place it on the EU market.Verified in the official source on November 2, 2026
Using high-risk systems: human oversight, logs and monitoringReglamento (UE) 2024/1689, art. 26(1)-(6) y (8)-(12); Anexo III; art. 6(1) y Anexo I; art. 113Adopted, applies laterDecember 2, 2027If you use AI for hiring or managing staff, monitoring workers, credit scoring, life or health insurance pricing, student assessment, biometrics or access to public benefits (Annex III). Also, from Aug 2, 2028, if you use clinical AI that is a medical device subject to notified-body assessment (Annex I).Verified in the official source on November 2, 2026
Inform workers and their representatives before using high-risk AI at workReglamento (UE) 2024/1689, art. 26(7)Adopted, applies laterDecember 2, 2027If you use AI to hire, evaluate, assign tasks, decide promotions or terminations, or monitor staff.Verified in the official source on November 2, 2026
Inform and explain to people affected by high-risk decisionsReglamento (UE) 2024/1689, arts. 26(11) y 86Adopted, applies laterDecember 2, 2027If you make or support decisions about people with an Annex III high-risk system.Verified in the official source on November 2, 2026
Fundamental rights impact assessment (FRIA)Reglamento (UE) 2024/1689, art. 27Adopted, applies laterDecember 2, 2027Public bodies and private companies providing public services that use high-risk AI; and any company using AI to assess creditworthiness or price life and health insurance.Verified in the official source on November 2, 2026
Providers of Annex III high-risk systemsReglamento (UE) 2024/1689, arts. 6(3)-(4), 8-17, 43, 47-49, 72-73Adopted, applies laterDecember 2, 2027If you develop or sell under your name an AI system for an Annex III use (employment, credit, life and health insurance, education, biometrics, public services).Verified in the official source on November 2, 2026
AI in regulated products (Annex I): medical devices, machinery, toys, vehiclesReglamento (UE) 2024/1689, art. 6(1) y Anexo I; art. 113(c)(ii)Adopted, applies laterAugust 2, 2028If you make or sell regulated products where AI is a safety component or the product itself (for example, medical software, machinery or vehicles) that require third-party conformity assessment.Verified in the official source on November 2, 2026

AI literacy for staff

Reglamento (UE) 2024/1689, art. 4 (redacción del Reglamento (UE) 2026/1744)In force

Applies from February 2, 2025

When it relates
Any organization that develops or uses AI systems, including staff who use tools such as ChatGPT or Copilot.
What the rule provides
  • Take measures to support the AI literacy of staff and of anyone operating AI systems on the company's behalf.
  • Tailor training to technical knowledge, experience and context of use, and to the people affected by the system.
  • Since the 2026 amendment there is no duty to guarantee a specific level per person, but you must be able to show that measures were taken.
Typical evidence
  • AI training plan by role and risk level.
  • Attendance records, materials and dates.
  • Matrix of roles that use AI and expected competencies.
Related base documents
Verification
Verified in the official source on November 2, 2026Checked in the Commission's consolidated text: Article 4 was amended by Regulation (EU) 2026/1744. It now requires organizations to 'support' AI literacy and states that no individual level must be guaranteed. This corrects the research note, which described the change as only proposed. National authorities supervise it from Aug 2, 2026.

Avoid prohibited AI practices

Reglamento (UE) 2024/1689, art. 5(1)(a)-(h)In force

Applies from February 2, 2025

When it relates
Any organization that develops, sells or uses AI in the EU.
What the rule provides
  • Do not use AI for subliminal or deceptive manipulation, or to exploit vulnerabilities linked to age, disability or social or economic situation.
  • Do not run social scoring that leads to disproportionate or unrelated unfavorable treatment.
  • Do not predict a person's risk of committing crimes based solely on profiling or personality traits.
  • Do not build facial recognition databases by untargeted scraping of internet or CCTV images.
  • Do not infer emotions of workers or students, except for medical or safety reasons.
  • Do not use biometric categorization to infer race, political opinions, religion or sexual orientation.
  • Screen every system in the inventory against this list before buying or deploying it, and document the decision.
Typical evidence
  • Prohibited-practices checklist applied to every system in the inventory.
  • AI use policy listing prohibited uses.
  • Log of rejected use cases and the reason.
Related base documents
Verification
Verified in the official source on November 2, 2026Date and list checked in the Commission's consolidated text (Articles 5 and 113). The Commission guidelines on prohibited practices (Feb 4, 2025) are non-binding but guide interpretation.

Prohibitions on biometrics and emotion recognition

Reglamento (UE) 2024/1689, art. 5(1)(e), (f) y (g)In force

Applies from February 2, 2025

When it relates
If you use biometrics, facial or emotion recognition, monitor workers or assess students.
What the rule provides
  • Confirm that no monitoring or assessment tool infers the emotions of employees or students. Measuring a customer's tone is outside the ban; measuring the agent's tone is not.
  • Rule out biometric categorization that infers sensitive traits and facial databases built by mass image scraping.
  • Document why each permitted biometric system falls outside the prohibitions.
Typical evidence
  • Record for each biometric or monitoring system with its Article 5 analysis.
  • Vendor contract or specification confirming which features are enabled.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

New prohibition: non-consensual intimate imagery and child sexual abuse material

Reglamento (UE) 2024/1689, art. 5(1)(ba) y (bb), 5(1a) y 5(1b), añadidos por el Reglamento (UE) 2026/1744Adopted, applies later

Applies from December 2, 2026

When it relates
If you build or distribute systems that generate images, video or audio, or if your staff use generative AI to create content.
What the rule provides
  • Providers: do not place on the market systems whose purpose, or foreseeable output without adequate safeguards, is generating realistic intimate imagery of identifiable people without explicit consent, or child sexual abuse material.
  • Deployers: expressly ban using AI to create such content in the AI use policy.
  • Update the prohibited-practices checklist and safety filters before December 2, 2026.
Typical evidence
  • Checklist updated with the new cases.
  • Description of the generator's safety filters and tests (providers).
  • Use policy with the ban and a record of communicating it to staff.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Provider transparency: disclose AI interaction and mark synthetic content

Reglamento (UE) 2024/1689, art. 50(1)-(2) y art. 111(4)In force

Applies from August 2, 2026

When it relates
If you build or sell under your own name a chatbot, agent, voice assistant or a system that generates text, images, audio or video. If you build your own chatbot on a third-party model and put it into service under your brand, you are usually the provider.
What the rule provides
  • Design systems that interact with people so those people know they are dealing with AI, unless it is obvious.
  • Mark generated or manipulated audio, images, video and text in a machine-readable format, using effective and interoperable techniques.
  • Generative systems placed on the market before Aug 2, 2026: complete technical marking by Dec 2, 2026 at the latest.
  • The Commission's Code of Practice on transparency of AI-generated content can serve as a reference.
Typical evidence
  • Wording and placement of the AI-interaction notice in each channel.
  • Technical specification of marking (watermarks, metadata) and detection tests.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Deployer transparency: deepfakes, public-interest text and emotion recognition

Reglamento (UE) 2024/1689, art. 50(3)-(4)In force

Applies from August 2, 2026

When it relates
If you use chatbots, agents, generated marketing content, voice or likeness cloning, or emotion recognition or biometric categorization.
What the rule provides
  • Clearly disclose that an image, audio or video is a deepfake (content that imitates real people, places or events). For artistic or satirical works a disclosure that does not spoil the work is enough.
  • Disclose that text published to inform the public on matters of public interest was AI-generated, unless it went through human editorial review with someone accountable.
  • Inform people exposed to emotion recognition or biometric categorization.
  • Check that any third-party chatbot or agent you use discloses that it is AI; if you configure and publish it under your brand, take on the provider duties.
Typical evidence
  • Synthetic-content labeling procedure with approved examples.
  • Screenshots of notices on web, app, phone and social media.
  • Log of AI-assisted published pieces and their labels.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Obligations for general-purpose AI model providers

Reglamento (UE) 2024/1689, arts. 53-55 y art. 111(3)In force

Applies from August 2, 2025

When it relates
Only if you develop or substantially modify a general-purpose AI model (for example, a language model) and place it on the EU market.
What the rule provides
  • Keep technical documentation of the model for the AI Office and give integrators enough information.
  • Maintain a copyright compliance policy, including honoring text-and-data-mining opt-outs.
  • Publish a sufficiently detailed summary of training data, using the Commission's template.
  • Models with systemic risk: evaluations and adversarial testing, serious-incident tracking and reporting, and enhanced cybersecurity.
  • Models placed on the market before Aug 2, 2025: deadline Aug 2, 2027. The AI Office can impose fines from Aug 2, 2026.
Typical evidence
  • Technical documentation and integrator information pack.
  • Copyright policy and log of respected opt-outs.
  • Public training-data summary.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Using high-risk systems: human oversight, logs and monitoring

Reglamento (UE) 2024/1689, art. 26(1)-(6) y (8)-(12); Anexo III; art. 6(1) y Anexo I; art. 113Adopted, applies later

Applies from December 2, 2027

Deadlines by profile

  • : Annex III high-risk systems
  • : Clinical AI that is a high-risk medical device (Annex I)
When it relates
If you use AI for hiring or managing staff, monitoring workers, credit scoring, life or health insurance pricing, student assessment, biometrics or access to public benefits (Annex III). Also, from Aug 2, 2028, if you use clinical AI that is a medical device subject to notified-body assessment (Annex I).
What the rule provides
  • Use the system according to the provider's instructions.
  • Assign human oversight to people with enough competence, training, authority and support.
  • Ensure input data under your control is relevant and representative.
  • Monitor operation, suspend use when risks appear, and report serious incidents to the provider and the authority.
  • Keep automatically generated logs under your control for at least six months.
  • Public bodies: register the use in the EU database. Systems already in use by public authorities: deadline Aug 2, 2030.
Typical evidence
  • Appointment and training records of human overseers.
  • Log retention policy and sample logs.
  • Monitoring plan and incident log.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i) (Dec 2, 2027 for Annex III). Regulation (EU) 2026/1744 moved the date but not the content of Article 26.

Inform workers and their representatives before using high-risk AI at work

Reglamento (UE) 2024/1689, art. 26(7)Adopted, applies later

Applies from December 2, 2027

When it relates
If you use AI to hire, evaluate, assign tasks, decide promotions or terminations, or monitor staff.
What the rule provides
  • Inform worker representatives and affected workers before putting the system into service.
  • Follow the information and consultation procedures of national labor law.
Typical evidence
  • Dated written notice to representatives and workers.
  • Minutes of the information or consultation meeting.
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Inform and explain to people affected by high-risk decisions

Reglamento (UE) 2024/1689, arts. 26(11) y 86Adopted, applies later

Applies from December 2, 2027

When it relates
If you make or support decisions about people with an Annex III high-risk system.
What the rule provides
  • Tell people that a high-risk system is being used on them.
  • On request, give a clear and meaningful explanation of the system's role in the decision and its main elements when the decision has legal or similarly significant effects.
Typical evidence
  • Notices to affected people.
  • Explanation template and log of requests handled.
Related base documents
Verification
Verified in the official source on November 2, 2026Dates checked against the consolidated AI Act text published by the European Commission's AI Act Service Desk (version as of Jul 27, 2026, including the Regulation (EU) 2026/1744 amendments): Articles 113 and 111.

Fundamental rights impact assessment (FRIA)

Reglamento (UE) 2024/1689, art. 27Adopted, applies later

Applies from December 2, 2027

When it relates
Public bodies and private companies providing public services that use high-risk AI; and any company using AI to assess creditworthiness or price life and health insurance.
What the rule provides
  • Before first use, assess processes, duration and frequency, affected people or groups, specific risks of harm, human oversight measures and risk responses, including complaints.
  • Notify the results to the market surveillance authority using the AI Office form.
  • It can build on an existing data protection impact assessment and must be updated when factors change.
Typical evidence
  • Signed and dated FRIA.
  • Proof of notification to the authority.
Verification
Verified in the official source on November 2, 2026Date checked (Article 113(c)(i)). Scope per Article 27: it does not cover every employer using AI for hiring; some vendor websites wrongly extend it.

Providers of Annex III high-risk systems

Reglamento (UE) 2024/1689, arts. 6(3)-(4), 8-17, 43, 47-49, 72-73Adopted, applies later

Applies from December 2, 2027

When it relates
If you develop or sell under your name an AI system for an Annex III use (employment, credit, life and health insurance, education, biometrics, public services).
What the rule provides
  • Risk management system across the lifecycle and governance of training, validation and test data.
  • Technical documentation, automatic event logging, instructions for use, design for human oversight, and accuracy, robustness and cybersecurity.
  • Quality management system, conformity assessment, EU declaration of conformity, CE marking and registration in the EU database.
  • Post-market monitoring and serious-incident reporting.
  • If you conclude that your Annex III system is not high-risk (Article 6(3)), document the assessment and register it before placing it on the market.
  • Small mid-caps (fewer than 750 employees) get simplified documentation templates.
Typical evidence
  • Technical file and quality management system.
  • EU declaration of conformity and registration number.
  • Post-market monitoring plan.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(i). The small mid-cap category comes from secondary sources on Regulation (EU) 2026/1744.

AI in regulated products (Annex I): medical devices, machinery, toys, vehicles

Reglamento (UE) 2024/1689, art. 6(1) y Anexo I; art. 113(c)(ii)Adopted, applies later

Applies from August 2, 2028

When it relates
If you make or sell regulated products where AI is a safety component or the product itself (for example, medical software, machinery or vehicles) that require third-party conformity assessment.
What the rule provides
  • Integrate AI Act high-risk requirements into the sector conformity assessment (for example, under the medical devices regulation).
  • Keep a single technical file and an integrated quality management system.
  • Since 2026, convenience or optimization features count as safety components only if their failure endangers health or safety.
Typical evidence
  • Combined technical file.
  • Notified body certificate covering the AI part.
Verification
Verified in the official source on November 2, 2026Date checked in consolidated Article 113(c)(ii) (Aug 2, 2028). The narrower safety-component definition and the move of the Machinery Regulation to Annex I Section B come from secondary sources.

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)