← Global AI Laws & Governance Research Library
Regulation (EU) 2024/1689
European Union Artificial Intelligence Act (EU AI Act)
Prepared by Shubhank Suman · Last reviewed
CURRENT: PHASED APPLICATION
- Legal character
- EU Regulation
- Region
- Europe
- Adopted
- 13 June 2024
What it covers
The EU AI Act creates the EU's horizontal AI regime for prohibited practices, high-risk systems, transparency, general-purpose AI models and systemic risk, governance, conformity, market surveillance, enforcement and penalties. It regulates both AI systems and general-purpose AI models.
Why it matters
Its duties vary by actor, system and application date. It operates alongside the GDPR; not all of its provisions apply yet.
Refer to it when
Use it for prohibited practices, high-risk classification and duties, provider and deployer obligations, AI literacy, fundamental-rights assessments, transparency, GPAI, enforcement, penalties and phased application.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: High
- Cyber: High
AI
EXTREMELY HIGH RELEVANCE
The Regulation is the EU's horizontal risk-differentiated framework for AI systems and general-purpose AI models.
Privacy
EXTREMELY HIGH RELEVANCE
Article 10 addresses data and data governance for high-risk systems. Article 27 creates a fundamental-rights impact assessment for qualifying deployers. These operate alongside, not instead of, GDPR obligations.
Cybersecurity
EXTREMELY HIGH RELEVANCE
Cybersecurity, robustness and resilience are explicit high-risk requirements; GPAI systemic-risk controls also address cyber-offence and loss-of-control risks.
Applicability
Providers, deployers, importers, distributors and other actors within the Regulation's territorial and functional scope, including qualifying organisations outside the EU.
Current validity
CURRENT AND IN FORCE; PROVISIONS SUBJECT TO PHASED APPLICATION. Core dates include 2 February 2025, 2 August 2025, 2 August 2026, 2 December 2027 and 2 August 2028. The consolidated text is dated 27 July 2026.
Read first
Article 3 → Article 4 → Article 5 → Article 6 → Articles 9–15 → Articles 16–27 → Article 50 → Articles 53–56 → Article 99 → Article 113 → Annexes I, III and IV.
Provisions / sections covered
Articles 3–6: Definitions, literacy, prohibitions and classification
Define regulated actors and systems, require AI literacy, prohibit specified practices and establish high-risk classification.
Articles 9–15: High-risk requirements
Cover risk management, data governance, documentation, record keeping, transparency, human oversight, accuracy, robustness and cybersecurity.
Articles 16–27: Operator duties
Cover provider and other actor responsibilities, deployer obligations and fundamental-rights impact assessments.
Article 50: Transparency
Applies transparency duties to specified AI interactions and generated or manipulated content.
Articles 53–56: GPAI
Establish duties for general-purpose AI models, including additional controls for systemic risk.
Articles 99 and 113: Penalties and application
Set the penalty framework and phased dates of application.
Subject-matter tags
- Impact assessment
- Enforcement and penalties
- Surveillance
- Prohibited AI practices
- Foundation models
- Transparency
- Human oversight
- Risk management
- AI cybersecurity
- AI documentation
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.