European Union · EU / EEA · Law
This page is a plain-English summary written by us, not legal advice — the official text is linked above. Our catalogue was last reviewed 2026-08-15; that is a review of the whole catalogue, not an independent legal verification of this entry.
In force, phased — prohibitions since Feb 2025; GPAI since Aug 2025; Art. 50 transparency since 2 Aug 2026 (Commission/AI Office enforcement powers over GPAI providers also became applicable that day); Annex III high-risk 2 Dec 2027; embedded/Annex I 2 Aug 2028. The later high-risk dates are now settled law: the Digital Omnibus was adopted 8 July 2026, published in the Official Journal 24 July 2026 as Regulation (EU) 2026/1744, and entered into force 27 July 2026 — the first formal amendment of the AI Act.
Practices such as social scoring, manipulative/subliminal techniques, exploitation of vulnerabilities, untargeted facial scraping, and (most) real-time remote biometric identification are banned and cannot be placed on the EU market.
Establish, document and maintain a continuous risk-management system across the AI lifecycle.
Training, validation and testing data must meet quality criteria and be examined for bias; document provenance and representativeness.
Draw up and keep up-to-date technical documentation demonstrating conformity (the Annex IV technical file).
Automatically record events (logs) over the system lifetime to ensure traceability.
Provide deployers with clear instructions: capabilities, limitations, and required human oversight.
Design the system so humans can effectively oversee it, intervene, and stop it.
Achieve appropriate accuracy, robustness and cybersecurity, and declare metrics.
Certain deployers must perform a Fundamental Rights Impact Assessment before putting the system into use.
Undergo the relevant conformity-assessment procedure and draw up an EU declaration of conformity before market entry.
Register the high-risk system in the EU database before placing it on the market.
Inform people they are interacting with an AI system (chatbots) and label AI-generated/manipulated content.
Mark AI-generated audio, image, video or text in a machine-readable, detectable way.
Operate a post-market monitoring system to collect and review performance data after deployment.
Report serious incidents and malfunctioning to the competent market-surveillance authority.
Eight unacceptable-risk practices (social scoring, manipulative AI, untargeted face-scraping, most real-time biometric ID) are banned.
Action: Confirm none of your use cases fall under a prohibited practice.
The final GPAI Code of Practice (Transparency, Copyright, Safety & Security chapters) gives providers a voluntary route to demonstrate compliance ahead of harmonised standards.
Action: Track and consider adhering to the GPAI code of practice; use its Model Documentation Form.
National competent authorities and fines (up to 7% of global turnover for prohibited use) become enforceable.
Action: Confirm your EU market roles (provider/deployer) and an accountable owner.
GPAI providers owe transparency, technical documentation, copyright policy, and systemic-risk duties for capable models.
Action: Inventory GPAI/foundation models you build or rely on and keep model documentation.
Now live. Chatbots must disclose they are AI; deepfakes and emotion-recognition/biometric-categorisation uses must be disclosed. The Commission adopted final Art. 50 guidelines on 20 July 2026, and the AI Office's enforcement powers over GPAI providers (fines up to €15M or 3% of turnover) became applicable the same day. Providers' machine-readable marking of synthetic content under Art. 50(2) has a grace period to 2 Dec 2026.
Action: These duties are already binding — audit your live products for AI disclosure now, and close the Art. 50(2) marking gap before 2 Dec 2026.
The Digital Omnibus adds a prohibition on AI systems for non-consensual intimate imagery/CSAM and ends the synthetic-content marking grace period for pre-existing systems.
Action: Confirm generation guardrails block NCII/CSAM and that legacy systems mark synthetic content.
Providers of high-risk systems must report serious incidents to authorities within 15 days (10 days on a death; 2 days for widespread infringement or critical-infrastructure disruption).
Action: Stand up an incident-detection, triage and reporting playbook with those clocks.
Full high-risk regime (risk management, data governance, logging, human oversight, accuracy, conformity assessment, registration). Moved from Aug 2026 to 2 Dec 2027 by the Digital Omnibus — Regulation (EU) 2026/1744, published in the Official Journal 24 July 2026 and in force since 27 July 2026, so this date is settled law.
Action: Start the Annex IV technical file, risk-management system, and conformity plan now.
High-risk AI embedded in regulated products (machinery, medical devices, vehicles) must comply. Moved from Aug 2027 to 2 Aug 2028 by the Digital Omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026.
Action: If your AI is a safety component of a regulated product, fold it into the sectoral conformity procedure.
Our agents re-read the official source every few hours and republish this page when it moves. Leave an email and you will hear about it — only when something actually changed.
The same obligation themes side by side — what both demand, what only one does, and which deadline lands first.
Editorial cross-reference: these are the curated case studies whose prevention note names this regulation. It is not a finding of legal breach.
Concept drift
Prevention: Post-market drift monitoring + human gatekeeping on price thresholds
Disparate impact
Prevention: Fairness audit across groups + explainability + human oversight
Runaway autonomous action
Prevention: Kill switch + blast-radius limits + staged rollout
Bias + over-reliance
Prevention: Fundamental-rights impact assessment + human oversight
Automation over-reliance
Prevention: Effective human oversight + enforced operational design domain
Unauthorized tool use
Prevention: Approval gates + least-privilege + backups + kill switch
Training-data bias
Prevention: Pre-deployment bias audit + representative, examined training data
Disparate impact
Prevention: 4/5ths disparate-impact testing before launch
Prompt injection
Prevention: Input/output filtering + least-privilege tool access
Unlawful processing
Prevention: Lawful basis + DPIA + biometric-use restrictions
Age discrimination
Prevention: Bias audit + ADEA/ADA review + human review of rejections
Deepfake social engineering
Prevention: Out-of-band verification + approval controls on payments
Discriminatory targeting
Prevention: Fairness constraints on delivery + ongoing audit
Bias
Prevention: FRIA + transparency + an appeal/override path
Data / model poisoning
Prevention: Data & model provenance + supply-chain integrity
Automation harm / over-reliance
Prevention: Human review of adverse decisions + audit trail
Hallucination
Prevention: Ground answers in approved sources (RAG) + human oversight on policy claims
Manipulation / toxic output
Prevention: Output guardrails + abuse red-teaming before release
Hallucination
Prevention: Grounding with citations + mandatory human verification
Hallucination → supply chain
Prevention: Dependency allow-listing + SBOM + provenance checks
Unlawful automated decision
Prevention: Art. 22 safeguards: meaningful human review + contest
Jailbreak / prompt injection
Prevention: Output boundaries + topic guardrails + no binding actions