What Is the EU AI Act (Regulation 2024/1689)?

The EU AI Act (Regulation (EU) 2024/1689) is a European Union law that establishes harmonised, risk-based rules for placing artificial intelligence systems on the market, putting them into service, and using them across the Union.

On July 12, 2024, the Official Journal of the European Union finally published Regulation 2024/1689 of the European Parliament and of the Council of June 13, 2024, which lays down harmonised rules on artificial intelligence (known as the AI Act). As stated in article 1 of the AI Act, this regulation’s purpose is to improve the functioning of the internal market and promote the uptake of human-centric and trustworthy AI, while ensuring a high level of protection of health, safety, and fundamental rights (including democracy, the rule of law, and environmental protection) against the harmful effects of AI systems, and supporting innovation.

Who Must Comply with the AI Act?

Providers and deployers placing AI systems or general-purpose AI models on the European market or putting them into service shall be aware of the new obligations that will be applied to them.

First, they should confirm if they are trading and using an AI system as defined by this Regulation in article 3 (1): a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

Second, they should be aware that there will be prohibited AI practices, such as manipulative or deceptive techniques, that distort a person’s behaviour and the evaluation and classification of natural persons, leading to unfavourable treatment, as listed in Article 5 of the AI Act.

Risk Categories and Compliance Obligations Under the AI Act

Third, providers and deployers must confirm whether their systems are high-risk, limited-risk, or minimum-risk, as explained in detail in the AI Act policy. They can use the compliance checker to help them understand whether or not the AI Act is applicable to the system they are creating or using.

This is important because several obligations will be applied according to the level of risk. Providers and deployers of high-risk systems will have to comply with several new obligations, amongst others, pursuant to articles 9 and subsequent: transparency, human oversight, risk management system, and registration.

It has been widely discussed how these systems can become explainable and, therefore, possible for any human supervision. Authors are currently debating the issue of AI explainability. For instance, there is a discussion regarding whether Explainable AI is feasible.

Providers and deployers of General-purpose AI models will have to comply with transparency rules and adopt codes of conduct, as foreseen in articles 53 and subsequent.

Entities such as the European AI Office and the European Artificial Intelligence Board have been established to assist companies in implementing this regulation, as stated in articles 64 and subsequent. Therefore, we recommend that companies follow all their initiatives, communications, and guidelines. Please check some events hosted by the AI Office here https://digital-strategy.ec.europa.eu/en/policies/ai-office and by European Artificial Intelligence Board https://digital-strategy.ec.europa.eu/en/news/commission-hosts-high-level-meeting-upcoming-eus-ai-board-drive-ai-act-implementation-forward.

Additionally, a standardization process has been put in place to create the necessary technical norms to help developers and other professionals understand the techniques that will be executed to comply with AI Act rules. A preliminary standardization work plan in support of the AI Act has been released and can be consulted in [5].

When Does the AI Act Apply?

This regulation shall apply from 2 August 2026, with some exceptions regarding prohibited AI practices and high-risk AI systems, provided for in Article 113.

Update (September 2026): the Act’s general application date of 2 August 2026 has now passed, and the phased timeline has unfolded largely as described above: the prohibited-practices rules became enforceable on 2 February 2025, and the general-purpose AI model obligations on 2 August 2025. One thing worth flagging since this post was first written: on 27 July 2026, an “AI Omnibus” package entered into force, amending the AI Act to simplify parts of the rulebook and pushing back part of the high-risk timeline — high-risk systems listed in Annex III must now comply by 2 December 2027 (rather than the originally foreseen 2 August 2027), and high-risk AI embedded in regulated products under Annex I by 2 August 2028.

The EU AI Act is the world’s first comprehensive, horizontal legal framework for artificial intelligence, and it classifies obligations by the risk a system poses rather than by the technology it uses. The following two years will be crucial for understanding how to implement these new rules fully. Let us remain alert.