Docs

Appearance

EU AI Act ​

EU AI Act illustration

The EU AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. It gives harmonized rules on artificial intelligence. Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended it in 2026. This page gives the scope, the dates, the penalties, the enforcement, and the status of Commission guidance. The other pages of this section give each obligation with its conditions.

EU AI Act scope ​

The EU AI Act gives rules for providers, deployers, and other actors in relation to AI systems and general-purpose AI models in the Union. Article 1(1) gives its purpose:

The purpose of this Regulation is to improve the functioning of the internal market and promote the uptake of human-centric and trustworthy artificial intelligence (AI), while ensuring a high level of protection of health, safety, fundamental rights enshrined in the Charter, including democracy, the rule of law and environmental protection, against the harmful effects of AI systems in the Union and supporting innovation.

The EU AI Act is a Regulation. It is "binding in its entirety and directly applicable in all Member States" (Article 113).

The Act has two legal bases in the Treaty on the Functioning of the European Union (TFEU): Article 114 for the internal market and Article 16 for data protection. Article 16 supports "specific rules on the processing of personal data" for prohibitions concerning remote biometric identification, biometric categorization, and individual risk assessments for law enforcement. See the Commission prohibited-practices guidelines, paragraph 10.

The Article 2 scope tests and exclusions give the conditions for EU AI Act provisions to apply to providers, deployers, and other actors. Article 2(2) limits the provisions applicable to Article 6(1) high-risk systems related to Annex I Section B products.

Article 3 defines AI systems, intended purpose, and actor roles.

Digital Omnibus on AI ​

For providers, deployers, and other operators, the Digital Omnibus on AI amended the EU AI Act. This amendment is Regulation (EU) 2026/1744 of 8 July 2026, which also amends Regulations (EU) 2018/1139 and (EU) 2023/1230. It is in the Official Journal of 24 July 2026. It entered into force on 27 July 2026, the third day after its publication (Article 4 of Regulation (EU) 2026/1744). The consolidated text of the EU AI Act of 27 July 2026 contains the amendments.

These are some of the changes that Regulation (EU) 2026/1744 made to the EU AI Act:

Dates ​

For providers, deployers, and other operators, the EU AI Act has different application dates for different provisions. The EU AI Act entered into force on 1 August 2024 (Article 113). This is the twentieth day after its publication in the Official Journal of 12 July 2024. The general date of application is 2 August 2026. These are the dates of Article 113, as amended by Regulation (EU) 2026/1744:

DateProvisions that applyProvision of Article 113
From 2 February 2025Chapters I and II, for example the definitions, Article 4 on AI literacy, and Article 5(1), points (a) to (h). Not Article 5(1), points (ba) and (bb), and not Article 5(1a) and (1b)Point (a)
From 2 August 2025Chapter III Section 4 (notifying authorities and notified bodies), Chapter V (general-purpose AI models), Chapter VII (governance), Chapter XII (penalties), and Article 78. Not Article 101Point (b)
From 27 July 2026Articles 102 to 110, which amend other Union actsPoint (d)
From 2 August 2026All provisions that the other rows do not name, for example Chapter III Section 5, Article 50, Chapter IX, and Article 101Second paragraph
From 2 December 2026Article 5(1), points (ba) and (bb), and Article 5(1a) and (1b)Point (a)
From 2 December 2027Chapter III Sections 1, 2, and 3, but not Article 6(5), for AI systems classified as high-risk in Article 6(2) and Annex IIIPoint (c)(i)
From 2 August 2028Chapter III Sections 1, 2, and 3, but not Article 6(5), for AI systems classified as high-risk in Article 6(1) and Annex I. For Section B of Annex I, Article 2(2) also appliesPoint (c)(ii)

Chapter III Sections 1, 2, and 3 contain Articles 6 to 27. They give the classification rules, the requirements for high-risk AI systems, and the obligations of providers, deployers, and other parties.

Article 111 gives transitional rules for AI systems and general-purpose AI models that were placed on the market or put into service before these dates:

  • Article 111(1) — This rule is for AI systems that are components of the large-scale IT systems in Annex X. It applies if these AI systems were placed on the market or put into service before 2 August 2027. They must be brought into compliance with the EU AI Act by 31 December 2030. This rule applies "without prejudice to the application of Article 5".
  • Article 111(2) — This rule is for other high-risk AI systems placed on the market or put into service before their Chapter III date. The EU AI Act applies to the operators of these systems only if, from that date, the systems are "subject to significant changes in their designs". In all cases, providers and deployers of high-risk AI systems "intended to be used by public authorities" must "take the necessary steps to comply" by 2 August 2030. This rule also applies "without prejudice to the application of Article 5".
  • Article 111(3) — Providers of general-purpose AI models placed on the market before 2 August 2025 must "take the necessary steps in order to comply" by 2 August 2027.
  • Article 111(4) — This rule is for providers of AI systems, also general-purpose AI systems, that generate synthetic audio, image, video, or text content. If these systems were placed on the market before 2 August 2026, the providers must "take the necessary steps in order to comply" with Article 50(2) by 2 December 2026.

Recital 39 of Regulation (EU) 2026/1744 clarifies that the Article 111(2) grace period applies to a type and model of high-risk AI system. This applies if the first unit was lawfully placed on the Union market or put into service before the Article 111(2) date. Subsequent units of that same type and model can also benefit while "the design of that high-risk AI system remains unchanged". They can continue to be placed on the market, made available, or put into service "without any additional obligations, requirements or the need for additional certification". Article 5 and the public-authority deadline above continue to apply.

The test of Article 111(2), "significant changes in their designs", is different from the "substantial modification" of Article 3(23).

Article 57(1) tells each Member State to make sure that its competent authorities "establish at least one AI regulatory sandbox at national level". That sandbox "shall be operational by 2 August 2027". It "may also be established jointly with the competent authorities of other Member States". The obligation "may also be fulfilled by participating in an existing sandbox" that gives an equivalent level of national coverage. Article 57(3a) permits the AI Office to "establish an AI regulatory sandbox at Union level for AI systems covered by Article 75(1)".

Find the applicable obligations ​

Providers, deployers, and other operators find their obligations in the EU AI Act through these questions. Each item gives the rule in short, and the page that gives its conditions and exceptions.

For Article 6(1) high-risk systems related to Annex I Section B products, only Article 6(1), Article 60a, and Articles 102 to 112 apply. Articles 57, 58, and 59 apply to them only "in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation" (Article 2(2)).

  • AI literacy (Article 4) — In-scope providers and deployers must "take measures to support the development of AI literacy" as specified in Article 4, without a duty to "guarantee any specific level of AI literacy of any individual".
  • Prohibited AI practices (Article 5) — Article 5 prohibits specified AI practices, with different acts, conditions, and exceptions for each prohibition.
  • Transparency (Article 50) — Article 50 gives providers and deployers different transparency duties, with specified triggers and exceptions, for high-risk and other AI systems.
  • High-risk AI systems (Article 6) — Article 6 gives the cumulative product-related tests, the Annex III classification rules, and the conditional Article 6(3) exception.
  • General-purpose AI models (Chapter V) — Chapter V gives duties to model providers, with more duties for systemic-risk models. Model-provider and system-provider duties are different and can apply to the same organization.
  • Conformity assessment (Article 43) — Providers must make sure in-scope high-risk AI systems undergo the applicable Article 43 assessment before placing on the market or putting into service, subject to Article 46.
  • Post-market monitoring and serious incidents (Articles 72 and 73) — Providers of in-scope high-risk AI systems must comply with the applicable monitoring and serious-incident reporting duties of Articles 72 and 73.

Penalties and enforcement ​

Three groups of authorities enforce the EU AI Act: the national competent authorities, the European Data Protection Supervisor (EDPS), and the Commission. The Commission acts through the AI Office. These authorities have these competences:

  • National competent authorities — Each Member State must "establish or designate as national competent authorities at least one notifying authority and at least one market surveillance authority" (Article 70(1)). These authorities enforce the rules for the AI systems that are not in the competence of the AI Office or the EDPS.

    Article 74(8) covers high-risk systems in Annex III, points 6, 7 and 8. It also covers point 1 systems used for law enforcement, border management, and justice and democracy. For these systems, Member States must designate one of these as the market surveillance authority:

    • The competent data protection supervisory authority in Regulation (EU) 2016/679 or Directive (EU) 2016/680.
    • A different authority designated on the same conditions as those in Articles 41 to 44 of Directive (EU) 2016/680.

    Article 74(8) also protects judicial independence:

    Market surveillance activities shall in no way affect the independence of judicial authorities, or otherwise interfere with their activities when acting in their judicial capacity.

  • The EDPS — The EDPS is the market surveillance authority for the Union institutions, bodies, offices, and agencies in the scope of the EU AI Act (Article 74(9)). The Court of Justice of the European Union in its judicial capacity is an exception. The EDPS can impose fines on these Union institutions, bodies, offices, and agencies (Article 100).

  • The AI Office — Article 3(47) defines the AI Office as a function of the Commission in the Commission Decision of 24 January 2024. References to the AI Office in the EU AI Act are references to the Commission. The AI Office is exclusively competent for the supervision and enforcement of the EU AI Act for these AI systems (Article 75(1)):

    • AI systems "based on general-purpose AI models where the model and the system are developed by the same provider, or by providers forming part of the same undertaking as that provider". Article 75(1)(a) gives four exceptions:
      • AI systems related to products in Annex I
      • AI systems in Annex III point 2
      • AI systems "provided by" law enforcement authorities, border management authorities, and financial institutions, "insofar as those AI systems fall under Article 74(6)"
      • AI systems in Annex III point 8 for the administration of justice.
    • AI systems that are, or that are integrated into, a "very large online platform or very large online search engine designated in accordance with Regulation (EU) 2022/2065".

    This competence applies to the providers of these AI systems. It applies to their deployers only when the deployer is also the provider or is part of the same undertaking as the provider. For these AI systems, Articles 75a to 75d give the AI Office the powers of a market surveillance authority. They also let it impose fines and periodic penalty payments (Article 75c).

    For operators in the scope of Article 75(1), Article 75c(4) applies Article 99(3) to (7) to AI Office enforcement with the necessary adaptations. The Article 99(4) fine category also covers:

    • infringements of applicable provisions not listed in Article 99(4)
    • failure to comply with decisions or measures adopted through the powers in Article 14(4) or Article 16(3) of Regulation (EU) 2019/1020, or Article 75a
    • failure to comply with commitments made binding by a decision in Article 75b.

    Article 75c(4) also applies the Article 99(5) category to "incorrect, incomplete or misleading information" supplied to the AI Office "in reply to a request".

  • The Commission, for general-purpose AI models — The Commission has "exclusive powers to supervise and enforce Chapter V", and it entrusts these tasks to the AI Office (Article 88(1)). The Commission has the "Power to request documentation and information" in Article 91 and the "Power to request measures" in Article 93. Where "necessary and appropriate", the Commission "may request providers to" "restrict the making available on the market, withdraw or recall the model" (Article 93(1)(c)). The AI Office can do evaluations of a model (Article 92).

Chapter XII on penalties applies from 2 August 2025. But Article 101 on fines for providers of general-purpose AI models applies from 2 August 2026 (Article 113, second paragraph and point (b)). Chapter IX, with market surveillance and the Commission powers for general-purpose AI models, applies from 2 August 2026.

The Commission page "The enforcement framework of the AI Act" (last update: 6 October 2026) gives the enforcement dates. It tells providers and deployers that the enforcement powers of the AI Office and the national competent authorities apply from 2 August 2026. For other provisions, the enforcement powers "will start to apply only when those provisions become applicable".

The Member States make the rules on penalties and other enforcement measures for infringements of the EU AI Act by operators (Article 99(1)). These penalties must be "effective, proportionate and dissuasive". When imposing penalties, Member States must "take into account" the interests and economic viability of SMEs, also start-ups, and SMCs (Article 99(1)).

Each Member State must make rules on how far administrative fines can apply to public authorities and bodies established in that Member State (Article 99(8)). Article 99 gives the maximum administrative fines. For an undertaking, the maximum is the EUR value or the percentage of its total worldwide annual turnover for the preceding financial year, "whichever is higher":

InfringementMaximum fineProvision
Non-compliance with the prohibition of the AI practices in Article 5EUR 35 000 000 or 7%Article 99(3)
Non-compliance with the obligations in Articles 16, 22, 23, 24, 25(2) and (4), 26, and 50, and with the notified-body provisions in Articles 31, 33(1), (3), and (4), and 34EUR 15 000 000 or 3%Article 99(4)
The supply of "incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request"EUR 7 500 000 or 1%Article 99(5)

For SMEs, also start-ups, each of these fines has the lower of the two maximums (Article 99(6)). For SMCs, the lower maximum applies only to the fines in Article 99(4) and (5) (Article 99(6a)). For each decision on a fine, Article 99(7) gives this rule: "all relevant circumstances of the specific situation shall be taken into account". Article 99(7) also lists factors, for example "the nature, gravity and duration of the infringement".

The EU AI Act gives two more groups of fines:

  • Union institutions, bodies, offices, and agencies — The EDPS can impose fines of up to EUR 1 500 000 for non-compliance with Article 5. For non-compliance with other requirements or obligations, the maximum is EUR 750 000 (Article 100(2) and (3)).
  • Providers of general-purpose AI models — The Commission can impose fines on these providers (Article 101(1)). The maximum is 3% of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000, "whichever is higher". The Commission can do this only when it finds that the provider intentionally or negligently did one of these:
    • "infringed the relevant provisions of this Regulation"
    • "failed to comply with a request for a document or for information pursuant to Article 91, or supplied incorrect, incomplete or misleading information"
    • did not comply with a measure requested in Article 93
    • did not give the Commission access to the model for an evaluation in Article 92.

The European Artificial Intelligence Board "shall advise and assist the Commission and the Member States in order to facilitate the consistent and effective application of this Regulation" (EU AI Act Article 66). It can issue recommendations and written opinions on the development and application of codes of conduct and codes of practice (Article 66(e)(i)).

The Commission appointed a Scientific Panel and an Advisory Forum. These two groups give advice to the AI Office and to national authorities about the application of the rules (Commission publication of 1 June 2026). The AI Office has three tools for complaints and reports:

  • the AI Act Complaints Tool, for complaints about providers of AI systems that the AI Office supervises
  • the AI Act Whistleblower Tool, for persons who work with providers of AI systems or general-purpose AI models
  • a "complaints channel for downstream providers", for providers of AI systems that integrate a general-purpose AI model of a different provider.

Guidance status ​

The European Commission gives guidelines and other guidance on the EU AI Act. Commission guidelines are not binding. For example, paragraph (5) of the Article 50 guidelines tells providers and deployers: "These Guidelines are non-binding". The Commission publications below give document status at their stated publication or last-update dates:

  • Article 50 guidelines — On 20 July 2026, Communication to the Commission "C(2026) 5054 final" approved the content of the draft Article 50 guidelines. The Communication gives this condition: "The Guidelines will be formally adopted by the Commission at a later date, when all language versions are available. It is only from that moment that these Guidelines will be applicable." For the content, see Transparency obligations.
  • High-risk classification guidelines — The Commission page "Guidelines for providers and deployers of AI high-risk systems" (last update: 6 July 2026) gives draft guidelines. A targeted stakeholder consultation was open until 23 July 2026. The Commission will put the feedback "in the final version of the guidelines before adoption by the Commission". The page tells readers that the guidelines are not legally binding but "will guide enforcement". For the content, see High-risk classification.
  • Serious incidents (Article 73) — On 26 September 2025, the Commission published a draft guidance document and a draft reporting template for serious incidents. Its consultation closed on 7 November 2025. These drafts help providers, but they do not replace the obligations of Article 73. The Commission page "Supporting the implementation of the AI Act with clear guidelines" (last update: 31 July 2026) lists a template for serious-incident reports as published. See Article 73 — serious-incident reporting.
  • More guidelines — The same Commission page lists more guidelines that the AI Office prepares. Examples are guidelines on the fundamental rights impact assessment, on responsibilities along the AI value chain, and on substantial modification. One more set of guidelines gives a voluntary template for post-market monitoring. Guidelines do not change the provisions of the EU AI Act.

The Commission adopted guidelines on the definition of an AI system, on prohibited AI practices, and on the obligations of providers of general-purpose AI models. For the publication and adoption dates of each guideline, see Publication and adoption dates.

Article 95 also provides for voluntary codes of conduct. Paragraph 1 concerns voluntary application of some or all Chapter III Section 2 requirements to AI systems that are not high-risk. Paragraph 2 concerns voluntary application of "specific requirements" to all AI systems, also by deployers. These codes of conduct are different from the Article 50 and Chapter V codes of practice.

Standards and codes of practice have a different status:

Modulos ​

Modulos provides EU AI Act Frameworks OFF-1 at Organization level and MFF-1 at AI System level, with setup decisions and the Requirement table.

Frequently asked questions ​

Providers, deployers, and other operators can find short answers about the EU AI Act in Frequently asked questions about the EU AI Act.

Providers, deployers, and other operators can use these pages for the rules of the EU AI Act and of related instruments:

Roles and responsibilities

The scope, the definitions, and the obligations of providers, deployers, importers, distributors, and authorized representatives.

Prohibited practices and transparency

The prohibited AI practices of Article 5 and the transparency obligations of Article 50.

High-risk AI systems

The classification rules of Article 6 and the requirements for high-risk AI systems.

Conformity assessment and CE marking

The conformity assessment procedures, the declaration of conformity, the CE marking, and the registration.

Post-market monitoring

The post-market monitoring system and the reports of serious incidents.

General-purpose AI models

The obligations of providers of general-purpose AI models, with and without systemic risk.

EU AI Act in Modulos

The two Frameworks, the decisions, the steps, and the Requirement table.

Sources ​

Providers, deployers, and other operators can find the EU AI Act rules of this page in these sources:

Disclaimer

This page gives general information. It is not legal advice.