EU Artificial Intelligence Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus on AI

• • The AI Act is the EU's horizontal law on artificial intelligence. It bans a small set of practices outright, sets heavy obligations for 'high-risk' uses such as employment, education, credit scoring and law enforcement, adds transparency duties for AI-generated content, and creates a separate regime for general-purpose AI models.
• • It applies in stages rather than at once. Prohibitions and AI literacy rules applied from 2 February 2025; general-purpose AI model rules and national governance from 2 August 2025; most remaining rules and enforcement from 2 August 2026. The Digital Omnibus on AI then deferred the standalone high-risk obligations in Annex III to 2 December 2027 and product-embedded high-risk systems in Annex I to 2 August 2028, while adding a new prohibition on AI-generated non-consensual intimate imagery and child sexual abuse material from 2 December 2026.
• • Who is affected: anyone providing or deploying AI systems in the EU market, including non-EU companies, plus national regulators and the EU AI Office.

It is the first broad AI law of its kind and sets rules that many non-EU providers follow in practice, so the deferrals and the new prohibitions change compliance planning worldwide.

Next: 2 December 2026: the new prohibitions on non-consensual sexual deepfakes and child sexual abuse material apply, alongside the transitional deadline under Article 50(2) for synthetic-content providers already on the market. High-risk Annex III rules then follow on 2 December 2027 and Annex I on 2 August 2028.

• • A bill is not law. Until it has royal assent or its equivalent, nothing in it applies to anyone.
• • An act may not take effect immediately. Most acts commence in stages, often over years.
• • Secondary regulations usually decide the real-world impact — dates, thresholds, exemptions and enforcement.

1. Issue

   Completed

   Concern about safety, discrimination and accountability in automated decision-making.

   No legal effect; the agenda-setting stage in EU institutions and member states.

2. Commission proposal

   Completed

   The European Commission proposed the Regulation in April 2021 with an impact assessment.

   In the EU, the Commission alone proposes legislation; this text frames everything that follows.

3. European Parliament position

   Completed

   Committee scrutiny and a plenary negotiating mandate setting Parliament's changes.

   Committee reports and amendments are the main public record of lobbying positions.

4. Council general approach

   Completed

   Member state governments agreed the Council's negotiating position.

   National governments shape scope and exemptions here, often out of public view.

5. Trilogue negotiation

   Completed

   Parliament, Council and Commission negotiated a single compromise text.

   Most of the final wording is settled in these closed negotiations.

6. Adoption and publication

   Completed

   Adopted and published in the Official Journal as Regulation (EU) 2024/1689.

   A Regulation applies directly in every member state without national transposition.

7. Entry into force

   Completed

   Entered into force on 1 August 2024.

   Entry into force is not the same as application; most duties started later.

8. First application phases

   Completed

   Prohibitions and AI literacy from 2 February 2025; general-purpose AI model rules and national governance from 2 August 2025; most remaining rules and enforcement from 2 August 2026.

   Each phase creates real duties on a fixed date, whether or not standards exist.

9. Amendment — Digital Omnibus on AI

   Happening now

   Regulation (EU) 2026/1744 was approved by Parliament on 16 June 2026 and Council on 29 June 2026, published on 24 July and in force from 27 July 2026.

   An amending Regulation can move deadlines and add prohibitions without reopening the whole Act.

10. High-risk obligations

    Still to come

    New prohibitions apply from 2 December 2026; standalone Annex III high-risk rules from 2 December 2027; Annex I embedded systems from 2 August 2028; legacy public-authority systems by 2 August 2030.

    This is where most of the Act's practical burden and protection actually lands.

11. Implementation & review

    Still to come

    Member states must have at least one AI regulatory sandbox operational by 2 August 2027, and enforcement builds through the AI Office and national authorities.

    Supervisory capacity decides whether the rules bite.