# Regulation (EU) 2024/1689 — Artificial Intelligence Act - **Record type**: Policy instrument - **Jurisdiction**: European Union - **Instrument type**: Regulation - **Status**: Partially applicable - **Binding**: Yes - **Issuing body**: European Parliament and Council of the European Union - **Adopted**: 2024-06-13 - **Published**: 2024-07-12 - **In force**: 2024-08-01 - **Applies from**: 2026-08-02 ## In brief The EU AI Act is a binding regulation of the European Union, issued by the European Parliament and Council of the European Union. It has been in force since 1 August 2024; its first obligations applied from 2 February 2025. 44 obligations are recorded against it, each with its source reference. ## Summary The EU AI Act is a binding regulation that sets rules for developing, placing on the market and using AI systems in the European Union. It bans a small set of practices considered unacceptable, imposes detailed requirements on "high-risk" AI systems used in areas such as employment, education, credit, essential services, law enforcement and safety-critical products, requires transparency for chatbots and synthetic content, and creates separate duties for providers of general-purpose AI models. Obligations apply in phases between 2025 and 2028. ## Scope Applies to providers placing AI systems or general-purpose AI models on the EU market or putting them into service, to deployers established in the EU, and to providers and deployers in third countries where the system's output is used in the EU (Article 2). Excludes AI used exclusively for military, defence or national-security purposes, and activities of purely personal non-professional use. Free and open-source models get partial relief unless they are general-purpose models with systemic risk. ## Who it applies to Providers (developers), deployers (organisations using AI under their authority), importers, distributors, authorised representatives of non-EU providers, product manufacturers integrating AI, and providers of general-purpose AI models. Public authorities are covered as deployers and have extra duties for fundamental-rights impact assessments. ## What organisations must do Inventory AI systems and determine your role for each; screen against prohibited practices now; classify systems against Annex I and Annex III; for high-risk systems build a risk-management system, data-governance controls, technical documentation, logging, human-oversight measures and a quality-management system, then complete conformity assessment and register in the EU database before placing on the market; deployers must use systems as instructed, assign trained human oversight, keep logs and, where required, complete a fundamental-rights impact assessment; label AI interactions and synthetic content under Article 50; general-purpose model providers must publish training-content summaries, maintain documentation and a copyright policy. ## Key dates Entry into force 1 August 2024. Prohibitions and AI literacy from 2 February 2025. General-purpose AI model duties, governance and penalties from 2 August 2025. General application and Article 50 transparency from 2 August 2026. Two further Article 5 prohibitions from 2 December 2026. High-risk obligations for stand-alone Annex III systems from 2 December 2027 and for AI embedded in Annex I products from 2 August 2028, as amended by Regulation (EU) 2026/1744 (pending review against the Official Journal). ## Penalties Article 99 sets administrative fines of up to EUR 35 million or 7 % of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3 % for most other obligations, and up to EUR 7.5 million or 1 % for supplying incorrect information, with the lower amount applying to SMEs. Article 101 allows the Commission to fine general-purpose AI model providers up to EUR 15 million or 3 %. ## Notes on dates "applies_from" shows the general application date in Article 113, which Regulation (EU) 2026/1744 left at 2 August 2026. The high-risk dates in the deadlines table and on the Chapter III obligations follow that amending regulation (2 December 2027 for Annex III, 2 August 2028 for Annex I). They were recorded on 26 September 2026 from concordant secondary reporting, not from the Official Journal text, which is why the record is pending review at medium confidence. Open the official source before relying on any date on this page. ## Obligations recorded against this instrument (44) - **Do not deploy or provide AI for prohibited practices** (Article 5) — Article 5 bans placing on the market, putting into service or using AI for listed practices, including subliminal or manipulative techniques that cause significant harm, exploitation of vulnerabilities, social scoring by public or private actors leading to detrimental treatment, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and education institutions except for medical or safety reasons, biometric categorisation to infer protected characteristics, and real-time remote biometric identification in publicly accessible spaces for law enforcement outside narrow exceptions. - Binding: yes - Applies from: 2025-02-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices - **Ensure AI literacy of staff operating AI systems** (Article 4) — Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account technical knowledge, experience, training, the context of use and the persons affected. - Binding: yes - Applies from: 2025-02-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy - **Establish a risk management system for high-risk AI** (Article 9) — Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: identifying known and reasonably foreseeable risks to health, safety and fundamental rights, estimating and evaluating risks including from reasonably foreseeable misuse, evaluating post-market data, and adopting targeted risk-management measures, with testing before placing on the market. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system - **Apply data governance and quality criteria to training, validation and testing data** (Article 10) — High-risk AI systems that use data-driven techniques must be developed on training, validation and testing data sets meeting quality criteria: appropriate governance practices covering design choices, data collection and origin, preparation, assumptions, availability and suitability, examination for possible biases, and measures to detect, prevent and mitigate bias. Data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete for the intended purpose. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-data-governance - **Draw up technical documentation before placing a high-risk system on the market** (Article 11 and Annex IV) — Technical documentation must be drawn up before a high-risk system is placed on the market or put into service and kept up to date. It must demonstrate compliance with the Section 2 requirements and contain at least the elements in Annex IV, including a general description, development process, monitoring and control, risk-management description, and the applied standards. SMEs may use a simplified form provided by the Commission. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation - **Design high-risk systems to log events automatically** (Article 12; Article 26(6) for deployers) — High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operational monitoring. Deployers must keep the logs generated by the system, to the extent under their control, for a period appropriate to the intended purpose and at least six months unless other law provides otherwise. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-record-keeping - **Provide deployers with clear instructions for use** (Article 13) — High-risk AI systems must be designed so their operation is sufficiently transparent for deployers to interpret output and use it appropriately, and must be accompanied by instructions for use covering the provider's identity, the system's characteristics, capabilities and limitations, performance for the intended purpose and known foreseeable misuse, human-oversight measures, expected lifetime and maintenance. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers - **Enable and assign effective human oversight** (Article 14; Article 26(2) for deployers) — High-risk systems must be designed with human-machine interface tools so natural persons can effectively oversee them, understand capacities and limitations, avoid automation bias, interpret output, decide not to use the system, and intervene or stop it. Deployers must assign oversight to people with the necessary competence, training and authority. For certain remote biometric identification systems, action requires verification by at least two competent persons. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-human-oversight - **Achieve appropriate accuracy, robustness and cybersecurity** (Article 15) — High-risk AI systems must achieve an appropriate level of accuracy, robustness and cybersecurity and perform consistently throughout their lifecycle. Accuracy levels and metrics must be declared in the instructions; systems must be resilient to errors, faults and inconsistencies, address feedback loops in continuously learning systems, and resist attempts to alter use or performance, including data poisoning, model poisoning, adversarial examples and confidentiality attacks. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity - **Operate a quality management system** (Article 17) — Providers of high-risk AI systems must put in place a documented quality management system covering regulatory-compliance strategy, design and development procedures, testing and validation, technical specifications and standards, data management, the risk-management system, post-market monitoring, incident reporting, communication with authorities, record keeping, resource management and an accountability framework. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system - **Complete conformity assessment, CE marking and EU database registration** (Articles 43, 47, 48 and 49; Annex VIII) — Before placing a high-risk system on the market, providers must complete the applicable conformity assessment (internal control or notified-body assessment depending on the system), draw up an EU declaration of conformity, affix the CE marking, and register the system in the EU database. Deployers that are public authorities must also register their use of Annex III systems. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration - **Use high-risk AI as instructed, monitor it and inform affected people** (Article 26) — Deployers of high-risk AI must take technical and organisational measures to use systems according to the instructions, assign human oversight, ensure input data is relevant where they control it, monitor operation, inform the provider and authorities of risks or serious incidents, keep logs, inform workers' representatives before deploying at the workplace, inform affected natural persons where decisions are made about them, and cooperate with authorities. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations - **Carry out a fundamental rights impact assessment before deployment** (Article 27) — Before deploying most Annex III high-risk systems, deployers that are bodies governed by public law or private entities providing public services, and deployers using systems for creditworthiness assessment or life and health insurance pricing, must assess the impact on fundamental rights: the processes, period and frequency of use, categories of affected persons, specific risks of harm, human-oversight measures and mitigation, and notify the market-surveillance authority of the results. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment - **Disclose AI interaction and label synthetic content** (Article 50) — Providers must ensure AI systems intended to interact with people inform them they are dealing with AI unless obvious; providers of systems generating synthetic audio, image, video or text must mark output in a machine-readable, detectable format; deployers of emotion-recognition or biometric-categorisation systems must inform exposed persons; deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, subject to exceptions. - Binding: yes - Applies from: 2026-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50 - **Meet general-purpose AI model provider obligations** (Article 53 and Annexes XI–XII) — Providers of general-purpose AI models must keep technical documentation (Annex XI), provide information to downstream providers integrating the model (Annex XII), put in place a policy to comply with EU copyright law including the text-and-data-mining opt-out, and publish a sufficiently detailed public summary of training content using the Commission's template. Free and open-source models are exempt from the first two duties unless they present systemic risk. Adherence to the General-Purpose AI Code of Practice can demonstrate compliance. - Binding: yes - Applies from: 2025-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations - **Manage systemic risk for high-impact general-purpose models** (Articles 51, 52 and 55) — A general-purpose model is presumed to have systemic risk when the cumulative compute used for training exceeds 10^25 floating-point operations, or when the Commission designates it. Providers must notify the Commission, perform model evaluations including adversarial testing, assess and mitigate systemic risks, track and report serious incidents, and ensure adequate cybersecurity for the model and infrastructure. - Binding: yes - Applies from: 2025-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk - **Operate a post-market monitoring system** (Article 72) — Providers must establish and document a post-market monitoring system proportionate to the nature of the AI technology and its risks, actively and systematically collecting and analysing performance data throughout the system's lifetime, based on a monitoring plan that is part of the technical documentation. The Commission is to adopt a template for the plan. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring - **Report serious incidents to market surveillance authorities** (Article 73) — Providers of high-risk AI systems must report serious incidents to the market-surveillance authority of the Member State where the incident occurred, immediately after establishing a causal link (or reasonable likelihood) and no later than 15 days after becoming aware, with shorter limits for the most serious cases such as widespread infringements or death. Deployers must inform the provider and authorities when they identify a serious incident. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting - **Verify conformity before importing or distributing high-risk AI** (Articles 23 and 24) — Importers must verify that the provider completed conformity assessment, drew up technical documentation, affixed CE marking and appointed an authorised representative where required, and must indicate their name and contact details on the system. Distributors must verify CE marking, the declaration of conformity and instructions, and refrain from making non-compliant systems available. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations - **Providers must meet the full set of provider duties for high-risk AI** (Article 16) — Article 16 lists what a provider of a high-risk AI system owes: compliance with the Section 2 requirements, its name and contact details on the system or its documentation, a quality management system, retention of documentation and logs, conformity assessment, an EU declaration of conformity, CE marking, registration, corrective action when needed, cooperation with authorities on request, and accessibility in line with the EU accessibility directives. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations - **Providers must keep high-risk AI documentation for ten years** (Article 18) — For ten years after a high-risk AI system is placed on the market or put into service, the provider must keep at the disposal of national competent authorities the technical documentation, the quality management system documentation, any changes approved by a notified body, the notified body's decisions and other documents, and the EU declaration of conformity. Financial institutions keep these as part of their sector record-keeping. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping - **Providers must retain automatically generated logs under their control** (Article 19) — Providers must keep the event logs that a high-risk AI system generates under Article 12, to the extent those logs are within their control, for a period appropriate to the system's intended purpose and in any case for at least six months, unless Union or national law on personal data sets a different period. Financial institutions keep the logs under their sector rules. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention - **Providers must take corrective action and inform the supply chain about non-conforming high-risk AI** (Article 20) — A provider that considers, or has reason to consider, that a high-risk system it has placed on the market is not in conformity must immediately correct it, withdraw it, disable it or recall it as appropriate, and inform the distributors, deployers, authorised representative and importers. Where the system presents a risk to health, safety or fundamental rights and the provider becomes aware of that risk, it must immediately investigate the causes together with the reporting deployer and inform the market surveillance authorities and, where relevant, the notified body. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information - **Providers must supply conformity evidence and log access to authorities on request** (Article 21) — On a reasoned request from a national competent authority, a provider of a high-risk AI system must supply all the information and documentation needed to show that the system meets the Section 2 requirements, in a language the authority can readily understand, and must give the authority access to the automatically generated logs it holds. Authorities must treat what they receive as confidential under Article 78. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities - **Non-EU providers must appoint an EU authorised representative for high-risk AI** (Article 22) — Before making a high-risk AI system available in the Union, a provider established outside the EU must appoint, by written mandate, an authorised representative established in the Union. The representative verifies that the EU declaration of conformity and technical documentation exist and that conformity assessment was done, keeps the provider's contact details and the documentation available for ten years, supplies information to authorities, cooperates with them, and must end the mandate if the provider acts contrary to the Regulation. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative - **Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI** (Article 25(1) and 25(2)) — A distributor, importer, deployer or other third party is treated as the provider of a high-risk AI system, with all Article 16 duties, if it puts its own name or trademark on a system already on the market, makes a substantial modification to a high-risk system that stays high-risk, or changes the intended purpose of a system so that it becomes high-risk. The original provider then ceases to be provider for that system but must cooperate and supply the information and access needed for the new provider to comply. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider - **Providers of high-risk AI must have written agreements with suppliers of components, tools and services** (Article 25(4)) — A provider of a high-risk AI system and any third party that supplies AI systems, tools, services, components or processes used in or integrated into it must set out, in a written agreement, the information, capabilities, technical access and other assistance needed for the provider to meet its obligations, based on the generally acknowledged state of the art. Suppliers of free and open-source tools and components other than general-purpose AI models are outside this duty. The AI Office may publish voluntary model terms. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers - **Providers must document and register a conclusion that an Annex III system is not high-risk** (Article 6(4); Article 49(2)) — A provider that considers a system listed in Annex III to be outside the high-risk tier because it meets one of the Article 6(3) conditions, such as performing a narrow procedural task or only preparing a human assessment, must write down that assessment before placing the system on the market or putting it into service, register the system in the EU database under Article 49(2), and hand over the assessment on request from a national competent authority. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation - **Deployers must ensure input data they control is relevant and representative** (Article 26(4)) — To the extent a deployer controls the data fed into a high-risk AI system, it must make sure that input data is relevant to, and sufficiently representative for, the system's intended purpose. The duty sits with the deployer even though the provider designed the system, because the deployer chooses what the system is run on. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data - **Deployers must monitor high-risk AI, suspend use on risk and report serious incidents** (Article 26(5)) — Deployers must monitor a high-risk AI system's operation against the provider's instructions and feed observations to the provider under Article 72. If they have reason to think the system as used may present a risk to health, safety or fundamental rights, they must inform the provider or distributor and the market surveillance authority without undue delay and suspend use. On a serious incident, they must immediately inform the provider, then the importer or distributor and the authorities. Financial institutions meet this through their internal governance rules. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension - **Employers must inform workers and their representatives before using high-risk AI at work** (Article 26(7)) — Before putting a high-risk AI system into service or using it at the workplace, a deployer that is an employer must tell the workers' representatives and the affected workers that they will be subject to the system. The information is given following the procedures and rules on informing workers and their representatives under Union and national law and practice, which may include works-council consultation. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information - **Public authorities must register their use of high-risk AI and must not use unregistered systems** (Article 26(8); Article 49(3) and 49(4)) — Deployers that are public authorities or Union institutions, bodies, offices or agencies must register their use of an Annex III high-risk AI system in the EU database before putting it into service. If they find that the system they intend to use has not been registered in the database by its provider, they must not use it and must inform the provider or distributor. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use - **Deployers must use the provider's transparency information in their data protection impact assessment** (Article 26(9)) — Where a deployer of a high-risk AI system is required to carry out a data protection impact assessment under Article 35 of the GDPR or Article 27 of the Law Enforcement Directive, it must draw on the information the provider supplied under Article 13, such as the intended purpose, performance, limitations and human-oversight measures, when producing that assessment. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information - **Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually** (Article 26(10)) — A deployer using a high-risk post-remote biometric identification system in a criminal investigation must request authorisation from a judicial or independent administrative authority in advance or within 48 hours, unless the use is only the initial identification of a potential suspect on objective and verifiable facts. Use is limited to a targeted search; if authorisation is refused, use stops and the data is deleted. No adverse legal decision may rest solely on the output, each use is documented, and the deployer reports annually to the market surveillance and data protection authorities. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation - **Deployers must tell natural persons that a high-risk AI system is used in decisions about them** (Article 26(11)) — Deployers of Annex III high-risk AI systems that take decisions about natural persons, or help take them, must inform those persons that they are subject to the system. The notice is separate from any explanation owed under Article 86 and from the worker notice in Article 26(7). In law-enforcement contexts the duty follows the information rules of the Law Enforcement Directive. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons - **Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way** (Article 50(2)) — Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text must ensure the output is marked in a machine-readable format and detectable as artificially generated or manipulated. The technical solution must be effective, interoperable, robust and reliable as far as the state of the art allows, taking account of content type and cost. Systems that only perform assistive editing or do not substantially alter the input, and law-authorised criminal-detection uses, are outside the duty. - Binding: yes - Applies from: 2026-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking - **Deployers of emotion recognition or biometric categorisation must inform exposed persons** (Article 50(3)) — A deployer of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it that the system is operating and must process their personal data in line with the GDPR, the Law Enforcement Directive and the EU institutions data protection regulation. Systems permitted by law to detect, prevent or investigate criminal offences are excepted, subject to safeguards. Use in workplaces and schools is separately banned by Article 5 except for medical or safety reasons. - Binding: yes - Applies from: 2026-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice - **Deployers must disclose deepfakes and AI-generated text published on matters of public interest** (Article 50(4)) — A deployer that generates or manipulates image, audio or video content that is a deep fake must disclose that the content has been artificially generated or manipulated, with lighter treatment for evidently artistic, creative, satirical or fictional works so that the disclosure does not spoil the work. A deployer that publishes AI-generated text to inform the public on matters of public interest must disclose this unless the text passed human review or editorial control and someone holds editorial responsibility. The disclosure must reach people clearly at the latest at first exposure. - Binding: yes - Applies from: 2026-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure - **Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold** (Article 52(1)) — A provider whose general-purpose AI model meets the Article 51(1)(a) high-impact capability condition, which is presumed once cumulative training compute exceeds 10^25 floating-point operations, must notify the Commission without delay and in any event within two weeks of the condition being met or of learning that it will be met. The notification may include arguments that the model nonetheless does not present systemic risk; the Commission decides and keeps a public list of designated models. - Binding: yes - Applies from: 2025-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification - **Providers of GPAI models must maintain technical documentation and inform downstream providers** (Article 53(1)(a) and 53(1)(b); Annexes XI and XII) — Providers of general-purpose AI models must draw up and keep up to date technical documentation covering the training and testing process and evaluation results, as set in Annex XI, and supply it to the AI Office or national authorities on request. They must also keep current the Annex XII information for providers that integrate the model into their own AI systems, so those providers understand its capabilities and limitations and can meet their own duties. Free and open-source models without systemic risk are exempt from both duties. - Binding: yes - Applies from: 2025-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation - **Non-EU providers of GPAI models must appoint an EU authorised representative** (Article 54) — Before placing a general-purpose AI model on the Union market, a provider established in a third country must appoint, by written mandate, an authorised representative established in the Union. The representative checks that the Annex XI documentation exists and the Article 53 duties are met, keeps a copy of the documentation and the provider's contact details for ten years after market placement, provides information to the AI Office on request, cooperates with authorities, and must end the mandate if the provider breaches the Regulation. Open-source models without systemic risk are exempt. - Binding: yes - Applies from: 2025-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative - **Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office** (Article 55(1)(c)) — Providers of general-purpose AI models with systemic risk must keep track of, document and report without undue delay to the AI Office and, where relevant, to national competent authorities the relevant information about serious incidents and the possible corrective measures to address them. The General-Purpose AI Code of Practice sets out timelines and content that providers may follow to demonstrate compliance. - Binding: yes - Applies from: 2025-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting - **Providers of systemic-risk GPAI models must secure the model and its infrastructure** (Article 55(1)(d)) — Providers of general-purpose AI models with systemic risk must ensure an adequate level of cybersecurity protection for the model and for the physical infrastructure it runs on, which in practice covers protection of model weights, training and inference environments, and access controls against theft, tampering and unauthorised release. Codes of practice and harmonised standards may be used to show compliance. - Binding: yes - Applies from: 2025-08-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity - **Deployers must explain individual decisions taken with high-risk AI on request** (Article 86) — A person affected by a decision that a deployer took on the basis of the output of an Annex III high-risk AI system, other than critical-infrastructure systems, which produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights, has the right to obtain from the deployer clear and meaningful explanations of the role the system played in the decision and the main elements of the decision. The right does not apply where Union or national law provides an exception. - Binding: yes - Applies from: 2027-12-02 - Record: https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation ## Dated deadlines - 2024-08-01 — Entry into force (precision: exact, status: scheduled) - 2025-02-02 — Prohibited practices and AI literacy apply (Chapters I and II) (precision: exact, status: scheduled) - 2025-08-02 — General-purpose AI, governance, notified bodies and penalties apply (precision: exact, status: scheduled) - 2026-08-02 — General application and Article 50 transparency duties (precision: exact, status: scheduled) - 2026-12-02 — Two further Article 5 prohibitions apply (non-consensual intimate imagery and child sexual abuse material generation) (precision: exact, status: scheduled) - 2027-12-02 — High-risk obligations apply to stand-alone Annex III systems (Chapter III, Sections 1 to 3) (precision: exact, status: scheduled) - 2028-08-02 — High-risk obligations apply to AI embedded in Annex I products (precision: exact, status: scheduled) - 2027-08-02 — General-purpose models placed on the market before 2 August 2025 must comply (precision: exact, status: scheduled) - 2030-12-31 — Large-scale IT systems listed in Annex X placed on the market before 2 August 2027 (precision: exact, status: scheduled) ## Provenance - **Permanent id**: AIPT-POL-0073 (https://aipolicytracker.org/id/AIPT-POL-0073; never changes or gets reused) - **Record page**: https://aipolicytracker.org/policies/eu-ai-act - **Official source**: https://eur-lex.europa.eu/eli/reg/2024/1689/oj - **Source document**: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence - **Published by**: Official Journal of the European Union - **Provision**: OJ L, 2024/1689, 12.7.2024 - **Review status**: pending review - **Confidence**: medium - **Facts last confirmed**: never confirmed against the official source - **Retrieved**: 2026-10-27 - **Licence**: https://creativecommons.org/licenses/by/4.0/ - **Cite as**: AIPolicyTracker (2026). "Regulation (EU) 2024/1689 — Artificial Intelligence Act" [AIPT-POL-0073, record version 3, not yet verified]. https://aipolicytracker.org/id/AIPT-POL-0073 (accessed 27 October 2026). > This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.