The short answer
The EU AI Act is the European Union's law on artificial intelligence, which sorts AI systems by risk and sets duties for the companies that build and use them. It entered into force on 1 August 2024 and became applicable, with some exceptions, on 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved the high-risk rules to 2 December 2027 for Annex III uses such as employment and to 2 August 2028 for AI built into regulated products.
| What it is | EU law regulating AI by risk level, for providers and deployers |
|---|---|
| In force | 1 August 2024 |
| Applies | Prohibitions and AI literacy from 2 February 2025; general-purpose AI rules from 2 August 2025; most rules from 2 August 2026 |
| AI Omnibus | Proposed 19 November 2025, agreed 7 May 2026, in force 27 July 2026 |
| High-risk deadlines now | 2 December 2027 (Annex III, e.g. employment, education); 2 August 2028 (Annex I products) |
| Who supervises | The AI Office for general-purpose AI models; national authorities for most other rules |
What the EU AI Act is, in plain English
The AI Act is a European Union regulation, which means it applies directly in every member state. It does not regulate AI as a technology in general. It regulates uses of AI according to how much harm they could cause, and it places duties on two main groups: providers, the companies that develop AI systems and bring them to market, and deployers. Article 3 of the Act defines a deployer as anyone using an AI system under its authority, except in the course of a personal, non-professional activity. A company that buys an AI recruiting tool is a deployer; the vendor is the provider. Article 2 also says the law covers providers and deployers outside the EU when the output produced by their AI systems is used in the Union.
This page explains the law; it is not legal advice. Check the European Commission's pages and a qualified adviser before you make compliance decisions.
The four risk levels
- Unacceptable risk: banned. The Commission says the Act now prohibits nine practices (see below).
- High risk: allowed with strict duties. Examples include AI used in biometrics, critical infrastructure, education, employment and migration. Duties include risk management, data quality, logging, documentation, human oversight and robustness.
- Transparency risk: disclosure duties. For example, telling people they are talking to a chatbot and labelling deepfakes.
- Minimal or no risk: no specific rules. The Commission's examples are AI-enabled video games and spam filters. Most everyday office uses of AI sit here or in the transparency group.
The nine banned practices
According to the Commission, the Act prohibits: harmful AI-based manipulation and deception; harmful exploitation of vulnerabilities; social scoring; assessing or predicting an individual's risk of committing a crime; untargeted scraping of the internet or CCTV to build facial recognition databases; emotion recognition in workplaces and education institutions; biometric categorisation to deduce certain protected characteristics; real-time remote biometric identification for law enforcement in publicly accessible spaces; and, from 2 December 2026, AI that generates non-consensual sexually explicit content or child sexual abuse material, such as "nudification" apps. The first eight have applied since 2 February 2025.
The EU AI Act timeline after the AI Omnibus
The dates below come from the European Commission's AI Act page (updated 19 October 2026) and the Commission's AI Act Service Desk timeline, which takes the AI Omnibus amendments into account.
| Date | What applies |
|---|---|
| 1 August 2024 | The AI Act enters into force |
| 2 February 2025 | Definitions, AI literacy and the first eight prohibitions apply |
| 2 August 2025 | Rules for general-purpose AI models apply; governance bodies and national authorities must be in place |
| 27 July 2026 | The AI Omnibus amendments enter into force |
| 2 August 2026 | Most rules apply and enforcement starts, including Article 50 transparency rules; the AI Office and national authorities supervise and enforce |
| 2 December 2026 | Ninth prohibition (non-consensual sexual deepfakes and child sexual abuse material); transitional deadline under Article 50(2) for certain providers of systems generating synthetic content that were on the market before 2 August 2026 |
| 2 August 2027 | Each member state should have at least one AI regulatory sandbox running |
| 2 December 2027 | High-risk rules for Annex III uses (such as biometrics, critical infrastructure, education, employment, migration) |
| 2 August 2028 | High-risk rules for AI embedded in products covered by EU product law (Annex I, such as lifts or toys) |
What the AI Omnibus changed
The AI Omnibus, formally the Digital Omnibus on AI, Regulation (EU) 2026/1744, was proposed by the Commission on 19 November 2025. Political agreement was reached on 7 May 2026 and it entered into force on 27 July 2026, days before the original high-risk deadline of 2 August 2026. According to the Commission, the main changes are:
- later dates for high-risk rules: 2 December 2027 for Annex III uses and 2 August 2028 for Annex I products;
- a new, ninth prohibition on nudification apps and AI-generated child sexual abuse material, from 2 December 2026;
- stronger powers for the AI Office over AI systems built on general-purpose AI models;
- simplified requirements extended to small mid-cap companies, not only small businesses;
- broader access to regulatory sandboxes;
- clearer rules on how the Act fits with product safety laws such as the Machinery Regulation;
- a change to AI literacy: the Commission's AI literacy Q&A (updated 20 October 2026) says the obligation remains for providers and deployers, but the amended text mandates no specific or "sufficient" level.
What the EU AI Act means at work
- AI literacy is already a duty. Under Article 4, providers and deployers must take measures to support the AI literacy of their staff and of others acting for them, such as contractors. The Commission says no certificate, test or AI officer is required, and that internal training records are fine. Deployers of high-risk systems must still train staff for human oversight. Supervision by national authorities began on 2 August 2026.
- Some uses are simply banned. Emotion recognition of employees, for instance, has been prohibited in workplaces since 2 February 2025. If a vendor pitches "sentiment detection" on staff video calls, ask hard questions.
- HR and education teams should plan for high risk. Employment and education are Annex III examples, so AI used in recruiting, promotion or grading faces high-risk duties from 2 December 2027. The delay buys time; it does not remove the duty. See AI for HR teams and the best AI for HR and recruiting.
- Disclose chatbots and synthetic media. Since 2 August 2026, Article 50 transparency rules apply. If customers chat with an AI, tell them, and label AI-generated images, video and voices where the rules require it. Our text-to-speech explainer covers voice cloning.
- General-purpose AI is mainly the makers' problem. The duties for general-purpose AI models, such as those behind ChatGPT, Claude, Gemini or Le Chat, fall on their providers. Your duties depend on how you use them.
A 30-minute exercise to try with your team
- List every AI tool your team uses, including AI features inside tools you already pay for.
- For each, write one line on what it is used for, and whether it affects decisions about people (hiring, grading, access to services).
- Sort each use into the four risk levels above. Anything touching employment or education goes in a "check high risk" pile.
- Check none of the nine prohibited practices appear.
- Note what AI literacy training each user has had, and plan a short session for anyone with none. Our free lessons and guide to rolling out AI to a team can help.
The second prompt below turns your list into a first draft register. Then read how to write an AI policy for your company.
Related terms worth knowing
- AI safety: the wider field the Act draws on.
- Generative AI: the technology behind most general-purpose AI models.
- Open-source model: models whose weights anyone can download; if you release or fine-tune one, check how the general-purpose AI rules apply with the Commission's AI Office guidance.
- Benchmark: evaluations are part of how model risks are assessed.
- Prompt injection: robustness against attacks is one high-risk requirement.
Common misconceptions about the EU AI Act
- "It was delayed, so nothing applies yet." Only the high-risk rules moved. Prohibitions and AI literacy have applied since 2 February 2025, general-purpose AI rules since 2 August 2025 and most other rules since 2 August 2026.
- "It only affects EU companies." Article 2 of the Act says it covers providers and deployers based outside the EU when the output of their AI is used in the Union.
- "Using ChatGPT at work is high risk." Risk depends on the use, not the tool. Drafting emails is not high risk; ranking job applicants can be.
- "We need an AI literacy certificate." The Commission says no certificate or specific level is required, though you should be able to show the measures you took.
- "The AI Omnibus weakened everything." It also added a ninth prohibition and gave the AI Office more power over systems built on general-purpose models.
Prompts to copy
Explain the AI Act for your role
Using only the European Commission's AI Act page and its AI Act Service Desk timeline, explain what the EU AI Act means for a [job title] at a [size] company in [country] that uses AI for [list uses]. Separate what already applies from what applies on 2 December 2026, 2 December 2027 and 2 August 2028. Link the Commission page for each point and flag anything I should ask a lawyer.
You get: A role-specific briefing tied to official dates
Draft an AI use register
Turn this list of AI tools and uses into a table for an AI register: [paste list]. Columns: tool, provider, use, does it affect decisions about people (yes or no), likely EU AI Act risk level (minimal, transparency, high risk, prohibited, or check), transparency step needed, staff trained (yes or no). Mark anything uncertain as check rather than guessing.
You get: A first-draft register to review with legal or compliance