Supranational · Europe

AI regulation in the European Union

Source-linked 2 instruments · 1 binding

Overview

The European Union has the world's first comprehensive, binding, cross-sector AI law: Regulation (EU) 2024/1689, the Artificial Intelligence Act. It entered into force on 1 August 2024 and applies in phases between February 2025 and August 2027. The AI Act sits alongside the GDPR, product-safety law, the Digital Services Act and sector rules, all of which continue to apply to AI systems. The European Commission's AI Office supervises general-purpose AI models, while national market-surveillance authorities supervise most other obligations.

What is the current regulatory status?

Binding regulation in force and partially applicable. Prohibited practices and AI-literacy duties apply since 2 February 2025; general-purpose AI model obligations and the governance and penalties chapters since 2 August 2025; most remaining obligations, including Annex III high-risk requirements, are scheduled from 2 August 2026, with high-risk AI embedded in Annex I regulated products from 2 August 2027. A Commission "Digital Omnibus" proposal published in November 2025 would adjust some high-risk application dates; its adoption status must be checked against the official sources linked below.

Binding rules versus guidance

Binding: the AI Act, the GDPR, the Product Liability Directive (as revised in 2024), and sector legislation. Non-binding but official: Commission guidelines on prohibited practices and on general-purpose AI, the General-Purpose AI Code of Practice, and harmonised standards being drafted by CEN-CENELEC JTC 21.

Key policy instruments

European Union Regulation Partially applicable Binding

EU AI Act

Regulation (EU) 2024/1689 — Artificial Intelligence Act

The EU AI Act is a binding regulation that sets rules for developing, placing on the market and using AI systems in the European Union. It bans a small set of practices considered unacceptable, imposes detailed requirements on "high-risk" AI systems used in areas such as employment, education, credit, essential services, law enforcement and safety-critical products, requires transparency for chatbots and synthetic content, and creates separate duties for providers of general-purpose AI models. Obligations apply in phases between 2025 and 2027.

Applies from 2 Aug 2026 Source-linked Official source
European Union National strategy Adopted

Apply AI Strategy

The Apply AI Strategy is a Commission communication that sets out how the EU intends to speed up use of AI across ten strategic sectors (such as healthcare, manufacturing, energy, mobility and defence) and in public administration. It combines sectoral flagship initiatives with cross-cutting support such as AI Factories, testing facilities and skills measures, and creates an Apply AI Alliance to coordinate industry, academia and public bodies. It sits within the broader AI Continent Action Plan and was presented together with a companion AI in Science strategy.

Adopted 8 Oct 2025 Source-linked · checked 11 Sep 2026 Official source

Upcoming deadlines

Upcoming deadlines in European Union
DateMilestoneInstrument
High-risk AI as safety components of Annex I productsEU AI Act
General-purpose models placed on the market before 2 August 2025 must comply
confidence: medium
EU AI Act
Large-scale IT systems listed in Annex X placed on the market before 2 August 2027
confidence: medium
EU AI Act

Current priorities

Harmonised standards for high-risk AI, guidance on high-risk classification, the AI Office's supervision of general-purpose models, designation of national competent authorities and notified bodies, regulatory sandboxes in every Member State, and the legislative debate on the Digital Omnibus timing adjustments.

Latest changes

Applicable sectors, use cases and obligation areas

How to use this information

  1. Confirm whether you are a provider, deployer, importer, distributor or authorised representative for each AI system you sell or use in the EU.
  2. Screen every AI use against the Article 5 prohibited practices, which already apply.
  3. Map each system to the Annex III high-risk areas and Annex I product legislation to decide which obligations and dates apply.
  4. Check whether you place a general-purpose AI model on the EU market; if so, Chapter V obligations already apply.
  5. Track the Digital Omnibus proposal and Commission guidelines, because they can change the practical timeline.
  6. Record the official source and date for every conclusion, and have counsel review high-risk classifications.

Official government and regulator sources

  1. Regulation (EU) 2024/1689 (Artificial Intelligence Act) — Official Journal
    Publications Office of the European Union · 2024-07-12 · Tier 1 source
  2. AI Act — European Commission policy page
    European Commission · Tier 1 source
  3. European AI Office
    European Commission · Tier 1 source

Frequently asked questions

Is the EU AI Act already in force?
Yes. It entered into force on 1 August 2024, but its obligations apply in stages. Prohibited practices and AI-literacy duties have applied since 2 February 2025, general-purpose AI model duties since 2 August 2025, and most other obligations are scheduled from 2 August 2026 under Article 113 of the adopted text.
Does the EU AI Act apply to companies outside the EU?
It can. Article 2 covers providers that place AI systems or general-purpose models on the EU market or put them into service in the EU, regardless of where they are established, and providers and deployers in third countries where the output of the system is used in the EU.
Which EU rules apply to AI besides the AI Act?
The GDPR applies whenever personal data is processed, including Article 22 on automated decisions. Product safety, consumer, non-discrimination, copyright and sector laws (for example for medical devices or financial services) continue to apply, and the Digital Services Act covers online platforms.

Follow by email

Get every dated, source-linked change to this jurisdiction in a weekly email.

Double opt-in; one-click unsubscribe in every email. Choose jurisdictions

Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.