The EU AI Act is a European Union regulation that establishes rules for artificial intelligence systems, general-purpose AI models and the organisations that develop, provide, import, distribute or use them. The applicable obligations depend on the technology, its intended purpose, the organisation's regulatory role and the risk or use category involved.
What is the EU AI Act in simple terms?
The EU AI Act is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI. It is a European Union regulation, which means it applies directly in Member States without needing national transposition in the way a directive would, although Member States designate authorities and can set national arrangements for enforcement and for matters the Act leaves to them. The Act entered into force on 1 August 2024 and applies in phases. Its purpose is to set harmonised rules for AI systems and general-purpose AI models, to protect health, safety and fundamental rights, and to support innovation and the internal market. It does not regulate AI in the abstract: it regulates defined systems, models, practices and actors, in the situations Article 2 lists.
What does the EU AI Act regulate?
The Act regulates AI systems, general-purpose AI models, and the organisations and activities connected with them. It prohibits defined AI practices in Article 5, classifies certain systems as high-risk in Article 6 and the annexes, sets requirements and duties for high-risk systems and their providers, importers, distributors, deployers and authorised representatives, sets transparency duties in Article 50, and sets duties for providers of general-purpose AI models in Chapter V. It also addresses governance, the EU database and registration, post-market monitoring, market surveillance and enforcement, and innovation support including sandboxes. A single product can engage several of those parts at once, and a product that engages none of the high-risk provisions can still engage literacy, transparency or model duties.
For the broader regulatory framework, see EU AI Act fundamentals.
Why does intended purpose matter so much?
Intended purpose is the use for which a system is intended by the provider, including the specific context and conditions of use. It anchors classification, because Article 6 tests the system as intended to be used, not as it might hypothetically be used by someone else. The same underlying technology can be used in different contexts with different consequences: a general model used to summarise documents, a system used to screen job applications, and a system used as a safety component in a product are different systems for classification purposes, even where they share a model. Product documentation should therefore describe the intended use clearly, with its context and conditions, and a deployer that uses a system outside that purpose must reassess the position, because Article 25 can change the deployer's role where the purpose change makes a system high-risk.
How does the Act treat different AI systems differently?
The Act does not treat every AI system the same. Prohibited practices under Article 5 must not be placed on the market, put into service or used in the prohibited form. High-risk systems under Article 6 face the Chapter III requirements, conformity assessment, declaration, marking and registration. Certain interaction and synthetic content uses face transparency duties under Article 50. General-purpose AI models face Chapter V duties, with additional duties for models with systemic risk. AI literacy under Article 4 applies to providers and deployers across the board. Systems that fall outside those categories can still be governed by data protection, consumer, employment, product and sectoral law. The classification question is therefore not whether a system is important or capable, but which defined category its intended purpose and context place it in.
Which organisations can have responsibilities?
Responsibilities attach to defined roles. Providers develop a system or model, or have one developed, and place it on the market or put it into service under their own name or trademark. Deployers use a system under their authority, except for personal non-professional use. Importers place on the market systems bearing a third-country person's name, distributors make systems available in the supply chain, and authorised representatives act under a written mandate for providers established outside the Union. Product manufacturers can be treated as providers in the circumstances Article 2 and Article 25 set. One organisation can perform more than one role, for different systems or different activities, and territorial scope under Article 2 can reach providers and deployers outside the Union where the market act or the use of output is in the Union.
Continue with EU AI Act timeline from 2024 to 2028.
What should businesses do first?
Businesses should begin by inventorying AI systems and models, recording the intended purpose, the provider and deployer, the users and the affected people, and the data and integration for each system. They should then screen each system against Article 5, classify it under Article 6 with the annexes, check Article 50 and Chapter V, and identify the application date for each provision that applies. The inventory should name an owner, a reviewer and a revisit trigger for each system, and should be updated when purpose, users, data or integration change. This organising work does not by itself establish compliance, but it creates the record on which conformity, documentation, oversight and monitoring work can be built, and it prevents a later classification from being reconstructed from memory.
Why does the timeline matter, and what does this guide not decide?
The timeline matters because the Act applies in phases, as amended by Regulation (EU) 2026/1744. Prohibitions and AI literacy apply from 2 February 2025, general-purpose model rules from 2 August 2025, the majority of rules including transparency from 2 August 2026, new prohibitions from 2 December 2026, Annex III high-risk rules from 2 December 2027, and Annex I high-risk rules from 2 August 2028. A business that plans only to the next date, or that relies on a pre-amendment timeline, will misjudge when duties begin. This guide explains what the Act is and how it is structured. It does not determine whether any particular system is prohibited or high-risk, or what any particular organisation must do for a specific system. Those questions need the full facts and the consolidated text, confirmed with a competent authority or legal adviser.
Frequently asked questions
Is the EU AI Act a law?
Yes. The EU AI Act is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, and forms part of European Union law. It entered into force on 1 August 2024 and applies in phases set in Article 113.
Does the EU AI Act only regulate AI developers?
No. Depending on the circumstances, obligations can apply to providers, deployers, importers, distributors, authorised representatives, product manufacturers and providers of general-purpose AI models, each in the role the Act defines for them.
Does every AI system have the same AI Act requirements?
No. Requirements depend on factors including the system's intended purpose, operator roles, risk classification, transparency and model duties, and the specific provisions that apply, as well as the application date for each provision.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗European Commission regulatory framework for AI ↗