2025
The AI Act in the European Union: First Comprehensive AI Legal Framework
The AI Act is the first comprehensive legal framework on artificial intelligence. It addresses the risks of AI and aims to regulate it to ensure safety, transparency and accountability while fostering innovation, with significant implications for companies, developers and users of AI technologies. It provides AI developers and deployers with clear requirements and obligations regarding specific uses.
While many AI systems present minimal or no risk and can help address numerous societal challenges, certain AI systems introduce risks that require careful management to prevent harmful outcomes, such as unfair decisions in recruitment, false information or manipulation. Existing legislation offers some protection but falls short of addressing the unique challenges posed by AI systems — which is why the European Union acted to regulate this widely demanded technology.
Risk-based categorisation of AI systems
The AI Act classifies AI systems into four risk categories: unacceptable risk, high risk, limited risk and minimal risk.
- Unacceptable risk: AI systems that pose a clear threat to people's safety, livelihoods or rights are banned — for example social scoring by public authorities, or toys using voice assistance that encourage dangerous behaviour. The use of real-time remote biometric identification in public spaces for law-enforcement purposes is generally prohibited, with narrowly defined exceptions such as searching for a missing child, preventing a specific and imminent terrorist threat, or locating a suspect of a serious criminal offence.
- High risk: AI applications that can significantly impact people's lives — employment, education, critical infrastructure, law enforcement and the other areas listed in Annex III. A common example is CV-sorting software used in recruitment. High-risk systems are permitted but subject to strict obligations before they can be placed on the market: high-quality datasets to minimise discriminatory outcomes, detailed technical documentation, appropriate human oversight, and logging of activity to ensure traceability.
- Limited risk: Systems such as chatbots and virtual assistants are subject to transparency obligations — people must be informed that they are interacting with an AI, and AI-generated content on matters of public interest must be disclosed as such, so that people can make informed decisions.
- Minimal risk: Systems such as AI in video games or spam filters have no new requirements. According to the Commission, this is the majority of AI use in the EU.
Providers and deployers must also report serious incidents and malfunctions. To prevent bias and discrimination, the Act mandates stringent data-governance standards, including training data that is accurate, representative and free of bias, alongside self-assessment and mitigation of systemic risks, testing and model evaluation, and cybersecurity requirements.
Recognising the need for innovation, the Act provides for regulatory sandboxes — controlled environments where companies can test AI applications under the supervision of regulators. Small and medium-sized enterprises and startups receive extra support to meet compliance requirements.
When does it apply?
The Regulation entered into force on 1 August 2024 and applies in stages. The general provisions and the prohibited practices (Chapters I and II) have applied since 2 February 2025. The rules on notifying authorities, general-purpose AI models, governance and penalties have applied since 2 August 2025. Most remaining obligations, including those for high-risk systems listed in Annex III, are scheduled to apply from 2 August 2026, and the obligations for high-risk AI embedded in products covered by EU product-safety legislation (Annex I) from 2 August 2027. Timelines for certain high-risk obligations have been the subject of EU-level amendment proposals, so businesses should verify the applicable dates before relying on them.
The full regulation is available on EUR-Lex: Regulation (EU) 2024/1689.