Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), as amended by Regulation (EU) 2026/1744
The EU's binding, directly applicable AI law. Obligations fall by role: providers who place AI systems or general-purpose AI models on the EU market (wherever established), deployers using AI under their authority in the EU, and providers and deployers outside the EU whose AI output is used in the EU (Art. 2). Four tiers: prohibited practices (Art. 5, applying since 2 February 2025), high-risk systems (Art. 6 and Annex III; provider duties Art. 16, deployer duties Art. 26, fundamental-rights impact assessment Art. 27), transparency duties for systems that interact with people or generate synthetic content (Art. 50, applying since 2 August 2026), and general-purpose AI models (Arts. 53 and 55, applying since 2 August 2025). AI literacy (Art. 4) applies to every provider and deployer. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force 27 July 2026, moved the Annex III high-risk application date to 2 December 2027 and the Annex I date to 2 August 2028, added two prohibited practices, and recast Art. 4 as a duty to support AI literacy.
- Article 2(1) — scope Scope — Reaches providers placing AI on the EU market wherever established, deployers established in the EU, and non-EU providers and deployers whose AI output is used in the EU; also importers, distributors, product manufacturers and affected persons.
- Article 3 — definitions (3), (4), (63) Provider; deployer; general-purpose AI model — A provider develops, or has developed, an AI system or GPAI model and places it on the market under its own name; a deployer uses an AI system under its authority in a professional context; a GPAI model displays significant generality across tasks.
- Article 4 — AI literacy AI literacy — Every provider and deployer must take measures to support the AI literacy of its staff and of others operating AI on its behalf, proportionate to their role and the context of use; no specific level is guaranteed (as recast by the Omnibus).
- Article 5(1) — prohibited AI practices Prohibited AI practices — Eight practices are banned outright, applying since 2 February 2025: manipulative or deceptive techniques causing significant harm; exploiting vulnerabilities; social scoring; predicting criminality from profiling alone; untargeted scraping of facial images; emotion inference at work and in education; biometric categorisation inferring protected characteristics; real-time remote biometric identification for law enforcement save narrow exceptions. The Omnibus adds non-consensual intimate imagery and child sexual abuse material.
- Article 6 — classification of high-risk AI systems Classification rules for high-risk AI systems — High-risk if a safety component of, or itself, a product under Annex I harmonisation law needing third-party conformity assessment; or listed in Annex III (biometrics, critical infrastructure, education, employment, essential services including credit and insurance, law enforcement, migration, justice).
- Article 16 — obligations of providers of high-risk AI systems Obligations of providers of high-risk AI systems — Providers must meet the Section 2 requirements, identify themselves on the system, run a quality management system, keep documentation and logs, pass conformity assessment, draw up the EU declaration of conformity, CE-mark, register, take corrective action, demonstrate conformity on request and meet accessibility requirements.
- Article 26 — obligations of deployers of high-risk AI systems Obligations of deployers of high-risk AI systems — Deployers must use the system according to its instructions, assign competent human oversight, ensure relevant and representative input data where they control it, monitor operation and inform the provider of risks and incidents, keep logs for at least six months, inform workers' representatives, and inform affected persons of decisions taken with the system.
- Article 27 — fundamental rights impact assessment Fundamental rights impact assessment for high-risk AI systems — Before first use of an Annex III high-risk system, public bodies, private entities providing public services, and deployers of credit-scoring and life/health-insurance pricing systems must assess the impact on fundamental rights and update it when circumstances change.
- Article 50 — transparency obligations Transparency obligations for providers and deployers of certain AI systems — People must be told they are interacting with AI; synthetic audio, image, video and text must be machine-readably marked; emotion-recognition and biometric-categorisation deployers must inform those exposed; deep fakes and AI-generated text on matters of public interest must be disclosed.
- Article 53 — obligations for providers of general-purpose AI models Obligations for providers of general-purpose AI models — GPAI providers must keep technical documentation (Annex XI), give downstream providers the information to integrate the model, have a copyright policy honouring rights reservations, and publish a training-content summary; open-source models are relieved of the first two unless of systemic risk.
- Article 113 — entry into force and application (as amended) Entry into force and application — In force 1 August 2024. Chapters I–II (including prohibitions) from 2 February 2025; GPAI, governance and penalties from 2 August 2025; the Regulation generally, including Article 50, from 2 August 2026; Annex III high-risk obligations from 2 December 2027 and Annex I from 2 August 2028 (Regulation (EU) 2026/1744).