EU AI Act

This Regulation lays down harmonised rules for the placing on the market, putting into service and use of artificial intelligence systems in the Union.

This Regulation applies to providers, deployers, importers, distributors and product manufacturers of AI systems in the Union.

Key definitions including AI system, provider, deployer, high-risk AI system, and other terms used throughout the Regulation.

Providers and deployers must take measures to support the development of AI literacy of their staff and other persons dealing with AI systems. This obligation does not require guaranteeing any specific level of AI literacy of any individual.

AI practices that are prohibited in the Union, including subliminal manipulation, social scoring, and certain biometric identification uses. A new category (CSAM / non-consensual intimate imagery) was added by the Digital Omnibus on AI, effective 2 December 2026 — see amended_by field.

AI systems are classified as high-risk based on their intended purpose and the risks they pose to health, safety and fundamental rights.

Providers of high-risk AI systems shall establish and implement a risk management system throughout the entire lifecycle.

Training, validation and testing data sets shall be subject to appropriate data governance practices.

Providers must draw up technical documentation before a high-risk AI system is placed on the market, keep it up to date, and include the minimum elements set out in Annex IV; SMEs may use a simplified form.

High-risk AI systems must technically allow automatic logging of events over their lifetime, sufficient to identify risk situations and substantial modifications and to support post-market monitoring.

Providers shall design high-risk AI systems in a way that is sufficiently transparent for deployers to interpret the system's output and use it appropriately.

High-risk AI systems shall be designed to allow effective human oversight measures to reduce risks.

High-risk AI systems shall be designed and developed to achieve an appropriate level of accuracy, robustness, and cybersecurity.

Providers of high-risk AI systems must ensure compliance with Section 2, maintain identification details, have a quality management system, keep documentation and logs, complete conformity assessment, draw up an EU declaration of conformity, affix CE marking, register the system, take corrective action where needed, and demonstrate conformity to authorities on request.

Deployers of high-risk AI systems shall use such systems in accordance with the instructions of use.

Deployers of high-risk AI systems shall carry out a fundamental rights impact assessment before putting the system into use.

Providers choose between internal control or third-party assessment depending on the Annex III category, or follow the sectoral procedure where the system is already covered by other Union harmonisation legislation; substantial modification triggers a new assessment.

The provider must draw up a written EU declaration of conformity per high-risk AI system, keep it for 10 years, state that the system meets Section 2's requirements, and keep it up to date.

High-risk AI systems in Annex III (other than law-enforcement/migration systems) must be registered in the EU database before market placement or deployment; public-authority deployers must also register their use.

Providers and deployers of certain AI systems shall ensure sufficient transparency to enable users to interpret and appropriately use the output.

A GPAI model is classified as having systemic risk if it has high-impact capabilities, presumed where the cumulative training compute exceeds 10^25 FLOPs.

GPAI providers must keep technical documentation, provide information to downstream providers, put in place a copyright policy, and publish a summary of training content.

Providers of GPAI models with systemic risk must perform model evaluation and adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity.

Providers must establish a documented post-market monitoring system, proportionate to the system's risks, that actively collects and analyses performance data throughout the system's lifetime against a formal monitoring plan.

Providers of high-risk AI systems must report serious incidents to market surveillance authorities, generally within 15 days of becoming aware, with shorter windows (2 days) for widespread infringements or specific serious incidents, and 10 days where death occurred.

Administrative fines for infringements of the AI Act, up to EUR 35 million or 7% of global annual turnover.

The AI Act entered into force on 1 August 2024. As originally enacted, most high-risk obligations were due 2 August 2026 — this has since been superseded, see amendment note below.