The EU AI Act in five minutes

The EU AI Act (Regulation (EU) 2024/1689) is the EU's law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages. It was amended in July 2026 by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which moved some deadlines.

The one idea

The law doesn't regulate AI as a technology. It regulates uses of AI, by how much harm they could do:

• A few uses are banned (Article 5).
• Uses that affect people's lives, safety or rights are high-risk and carry the most duties.
• Chatbots and generated content carry transparency duties.
• Everything else is minimal risk and mostly unregulated.

The same model can sit in different tiers. A language model drafting marketing emails is minimal risk; the same model ranking job applicants is high-risk.

Who it applies to

• Organisations that build AI and offer it in the EU (providers).
• Organisations that use AI in their work in the EU (deployers).
• Importers and distributors that bring AI into the EU market.
• Providers and deployers outside the EU when the AI's output is used in the EU.

It doesn't apply to purely personal use, to AI used only for military or national security purposes, or to research before anything is placed on the market.

What it asks of everyone

Since 2 February 2025, every provider and deployer must take steps on AI literacy for the staff who use AI (Article 4). Since 27 July 2026 the duty is worded as taking measures to support the development of AI literacy, matched to people's role and the AI they use; no specific level has to be guaranteed. In practice: short, role-based training plus clear internal rules, and a record that you did it.

What it asks of high-risk systems

Providers must run risk management, use good-quality data, keep technical documentation and logs, design for human oversight, ensure accuracy and security, pass a conformity assessment and register the system. Deployers must use it as instructed, assign competent people to oversee it, keep logs, tell affected people and, in some cases, do a fundamental rights impact assessment. See High-risk obligations.

Penalties

Fines can reach €35 million or 7% of worldwide annual turnover for banned practices, €15 million or 3% for most other breaches, and €7.5 million or 1% for giving regulators wrong information. For SMEs, the lower of the two amounts applies.