The AI Act is a landmark European Union regulation (Regulation (EU) 2024/1689) that establishes a common legal framework for Artificial Intelligence (AI) within the EU. It is the world's first comprehensive legal framework for AI, proposed by the European Commission in April 2021 to address the risks posed by AI systems to safety and fundamental rights, such as non-discrimination and human dignity. The regulation was formally adopted by the European Council on May 21, 2024, and entered into force on August 1, 2024.
The Act works by applying a risk-based approach, classifying AI systems into four categories: unacceptable, high, limited, and minimal risk. Unacceptable risk systems, such as government-led social scoring or AI that manipulates vulnerable groups, are banned outright. High-risk systems, which include AI used in critical infrastructure, education, employment, and law enforcement (listed in Annex III), face stringent requirements like risk management, data governance, and human oversight. Limited-risk systems, like chatbots, only have transparency obligations, requiring users to be informed they are interacting with an AI.
The AI Act connects closely with the EU's General Data Protection Regulation (GDPR), which governs the processing of personal data. While the GDPR is a fundamental rights law focused on data privacy, the AI Act is a product safety law focused on the safe and ethical deployment of AI systems, with both seeking to safeguard fundamental rights. Like the GDPR, the AI Act has extraterritorial reach, applying to non-EU providers if their AI systems are used within the EU market.
Recently, the application deadlines for certain provisions have been amended to allow businesses more time for compliance. Obligations for high-risk AI systems are now set to apply from December 2, 2027, for those listed in Annex III, and from August 2, 2028, for systems embedded in products. A recent change also introduced a ban on AI systems used to create non-consensual sexual content, including "nudifier" apps, with compliance required by December 2, 2026.