EU AI Act (2024)

Never place on the market, put into service, or use an AI system for: subliminal or manipulative techniques that materially distort behaviour and cause harm; exploiting vulnerabilities of children, disabled people, or people in specific social/economic situations; social scoring leading to unjustified detrimental treatment; predicting criminal offences based solely on profiling; untargeted scraping to build facial-recognition databases; inferring emotions in workplaces or education (with narrow medical/safety exceptions); biometric categorisation inferring sensitive attributes (with narrow exceptions); or real-time remote biometric identification in public spaces for law enforcement, outside tightly defined exceptions. These are in force since 2 February 2025. Two further prohibitions apply from 2 December 2026: AI that generates or manipulates realistic images, video, audio or similar material of an identifiable person's intimate parts, or of them in sexually explicit activity, without their freely given, specific, informed, unambiguous and explicit consent; and AI that generates or manipulates child sexual abuse material (except where a 'without right' defence applies under national law). Placing on the market or putting into service is caught only when that generation is the system's intended purpose, or a reasonably foreseeable and reproducible outcome of a system that lacks adequate safeguards; use is caught only when the deployer uses the system for that purpose.

If you provide or deploy AI systems, take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, taking into account their technical knowledge, experience, education and training, the context the AI is used in, and the people or groups of people the AI systems are used on. You do not have to guarantee a specific level of AI literacy for any individual. In force since 2 February 2025.

If you place a high-risk AI system on the market or put it into service under your own name (as defined in Annex III, e.g. AI used in recruitment, credit scoring, biometric identification, critical infrastructure, education, or law enforcement), you must: run a conformity assessment, establish a risk-management system (Art. 9) and quality-management system (Art. 17), meet data-governance (Art. 10), technical-documentation (Art. 11), record-keeping/logging (Art. 12), transparency-to-deployers (Art. 13), human-oversight (Art. 14), and accuracy/robustness/cybersecurity (Art. 15) requirements, affix CE marking, and register the system in the EU database. Decide this in only if you are a provider of high-risk AI. Applies from 2 December 2027 for high-risk systems listed in Annex III and from 2 August 2028 for those covered by Annex I.

If your AI system is a safety component of, or is itself, a product already covered by the EU harmonisation legislation listed in Annex I (e.g. toys, lifts, medical devices, vehicles) and that product requires third-party conformity assessment under that legislation, the AI system is high-risk and the full Art. 16 provider obligation set applies through that product's existing conformity-assessment route. Decide this in only if you build AI embedded in this category of regulated product. This obligation only starts applying on 2 August 2028 — present here so you can prepare ahead of time, not because it binds you yet.

If you deploy (use, not build) a high-risk AI system, you must: use it according to the provider's instructions, assign human oversight to competent people, monitor its operation and inform the provider of risks or incidents, keep logs it automatically generates for at least six months, inform affected workers before deployment where required, and — for certain public-sector/high-impact deployers — run a fundamental rights impact assessment (Art. 27). Decide this in only if you deploy a high-risk AI system built by someone else. Applies from 2 December 2027 for high-risk systems listed in Annex III and from 2 August 2028 for those covered by Annex I.

If you provide an AI system intended to interact directly with people, generate synthetic audio/image/video/text content, or run emotion-recognition/biometric-categorisation systems, tell people they're interacting with AI (unless obvious) and mark AI-generated or manipulated content ('deepfakes') as such, in a machine-readable format where technically feasible. Decide this in only if you build or deploy this kind of user-facing or content-generating AI. Applies from 2 August 2026; generative AI systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking duty (Art. 50(2)).

If you provide a general-purpose AI model (e.g. a foundation/large language model made available for integration), maintain technical documentation, provide information and documentation to downstream providers integrating your model, put in place a policy to comply with EU copyright law, and publish a sufficiently detailed summary of the training content. Decide this in only if you provide a GPAI model. In force since 2 August 2025.

If your GPAI model is classified as carrying systemic risk (broadly, models trained above the compute threshold set in Annex XIII, or designated by the Commission), you must additionally: perform model evaluation including adversarial testing, assess and mitigate systemic risk, track and report serious incidents to the AI Office, and ensure an adequate level of cybersecurity protection for the model and its infrastructure. Decide this in only if your GPAI model is classified as systemic-risk. In force since 2 August 2025.