Photo: Guillaume Périgois on Unsplash
The EU AI Act explained: what applies and when
In short: The EU AI Act regulates artificial intelligence according to risk. Some uses, such as social scoring, are banned. High-risk systems, such as AI used in hiring or education, face strict rules. Chatbots and AI-generated content must be transparent. It entered into force in August 2024, with most rules applying from 2 August 2026 and some high-risk rules moved to 2027 and 2028.
A law based on risk
The EU AI Act does not treat all AI the same. It sorts uses into levels of risk and sets stricter rules the more harm a system could cause:
- Unacceptable risk (banned): for example, social scoring of citizens, manipulative techniques that exploit vulnerable people, and certain uses of real-time facial recognition in public by police, with narrow exceptions.
- High risk: AI used in areas such as hiring, education, credit scoring, critical infrastructure and law enforcement. These systems must meet requirements on data quality, documentation, human oversight, accuracy and security.
- Limited risk (transparency): people must be told when they are talking to a chatbot, and AI-generated or manipulated content such as deepfakes must be labelled.
- Minimal risk: most everyday AI, such as spam filters or AI in games, has no new obligations.
Separate rules apply to general-purpose AI models, the large models behind chatbots, including transparency about training and, for the most powerful models, extra safety duties.
The key dates
| Date | What applies |
|---|---|
| 1 August 2024 | The Act entered into force. |
| 2 February 2025 | Bans on unacceptable uses and AI literacy duties. |
| 2 August 2025 | Rules for general-purpose AI models; national authorities set up. |
| 2 August 2026 | Most of the Act applies, including transparency rules; enforcement begins. |
| 2 December 2026 | New bans on AI that generates non-consensual sexual deepfakes; deadline for some existing systems to label synthetic content. |
| 2 December 2027 | Rules for high-risk systems listed in Annex III (such as hiring and education). |
| 2 August 2028 | Rules for high-risk AI built into regulated products. |
Some dates were changed by a 2026 update to the law known as the Digital Omnibus, which pushed the high-risk deadlines back. Dates can change again, so check the official AI Act Service Desk for the latest timeline.
What it means for you
- You should be told when you are chatting with an AI rather than a person.
- More AI-generated images, audio and video should carry labels. A missing label still does not prove something is real. See AI image labels.
- If an AI system is used in a decision about you, for example in a job application, high-risk rules will require human oversight and information about how it works.
What it means for organisations
Companies that build or use AI in the EU need to know which risk level each system falls into, train staff in AI literacy, and prepare documentation for high-risk uses. Fines for the most serious breaches are set as a share of global turnover, similar to data protection law. Our note on AI governance covers the practical side.
Tip: Like the GDPR, the AI Act applies to organisations outside the EU if their AI systems are used in the EU.
Key takeaways
- The EU AI Act regulates AI by risk: banned, high-risk, transparency and minimal.
- It entered into force in August 2024; most rules apply from 2 August 2026.
- Chatbots must identify themselves, and AI-generated content must be labelled.
- High-risk rules were moved to December 2027 and August 2028; check the official timeline for changes.
Sources and further reading
© 2026 FM TecHub. Original content written for FM TecHub. Share the link freely; please don't copy the text elsewhere without permission.