The European Union has enacted Regulation (EU) 2024/1689, known as the AI Act, marking the first comprehensive legal framework for artificial intelligence worldwide. This legislation is designed to foster trustworthy AI, ensuring safety, fundamental rights, and human-centric development while positioning Europe as a global leader in responsible AI deployment. It forms part of a broader policy package that includes the AI Innovation Package and the creation of AI Factories, intended to strengthen uptake, investment, and innovation across the EU.
Central to the AI Act is a risk-based classification system for AI applications. At the highest level, certain AI practices deemed a clear threat to safety, livelihoods, and rights are prohibited outright. The Act bans eight specific uses, including harmful manipulation, exploitation of vulnerabilities, social scoring, untargeted scraping for facial recognition databases, emotion recognition in workplaces and schools, biometric categorisation to deduce protected characteristics, and real-time remote biometric identification for law enforcement in public spaces.
Below the prohibited tier, high-risk AI systems encompass applications with serious potential impacts on health, safety, or fundamental rights. Examples include AI safety components in critical infrastructure such as transport, AI in educational institutions influencing access to opportunities, robot-assisted surgical systems, recruitment tools sorting CVs, credit scoring systems affecting loan access, biometric identification tools, law enforcement evidence evaluation, automated visa processing, and AI used in judicial or democratic processes. These systems face stringent obligations before market entry: robust risk assessment and mitigation, high-quality datasets to reduce discriminatory outcomes, activity logging for traceability, comprehensive documentation for compliance assessment, clear deployer information, human oversight measures, and strong cybersecurity and accuracy standards.
Transparency obligations are a notable feature. The Act requires disclosure when humans interact with AI, such as chatbots, to maintain informed decision-making. Providers of generative AI must ensure AI-generated content is identifiable, with deep fakes and public-interest texts clearly labeled. These measures aim to preserve trust and prevent misuse of synthetic media.
For minimal or no-risk AI—such as AI-enabled video games or spam filters—the Act imposes no new rules, recognizing that most current EU AI systems fall into this category.
Operationally, once a high-risk AI system reaches the market, authorities conduct surveillance, deployers maintain oversight, and providers implement post-market monitoring, reporting serious incidents or malfunctions. This lifecycle approach ensures ongoing compliance and responsiveness to emerging risks.
General-purpose AI (GPAI) models, capable of a wide range of tasks and foundational to many systems, receive special attention. The Act sets transparency and copyright-related rules for these models, with additional risk assessment and mitigation for those carrying systemic risks. To support responsible GPAI development, the Commission introduced three instruments: Guidelines clarifying obligations for GPAI providers, a voluntary GPAI Code of Practice offering practical compliance guidance, and a Template for public summaries of training content, detailing data sources and processing to enable rights under EU law. These tools are designed to work in concert, reducing administrative burden while safeguarding rights and trust.
Governance of the AI Act rests with the European AI Office and Member State authorities, guided by the AI Board, Scientific Panel, and Advisory Forum. The Act entered into force on 1 August 2024, with full applicability set for 2 August 2026, allowing time for adaptation and early voluntary compliance through initiatives like the AI Pact. By structuring obligations according to risk and embedding transparency, oversight, and accountability, the AI Act provides a clear operational and ethical framework for AI innovation within Europe.