The EU AI Act is the European Union's law on artificial intelligence (AI), formally Regulation (EU) 2024/1689. It sorts AI by the harm it can do rather than by the technology behind it: a short list of practices is banned outright, uses that affect jobs, credit, education or policing carry heavy compliance duties, systems that talk to people or generate content must disclose it, and everything else is left largely alone. A separate chapter covers the general-purpose models that power chatbots and image generators. The law exists because the EU decided product safety and fundamental rights rules written before machine learning could not reach decisions made by statistical systems at scale. It reaches companies anywhere whose AI is placed on the EU market or whose output is used there.

How the risk tiers work

The Act runs to 113 articles and 13 annexes. Article 3 defines an AI system as a machine-based system that "infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions", the word "infers" separating it from rule-based software.

Prohibited practices under Article 5 sit at the top. Eight categories were banned from February 2, 2025, among them subliminal or manipulative techniques that materially distort behaviour, exploitation of vulnerabilities linked to age or disability, social scoring, untargeted scraping of facial images, emotion recognition in workplaces and schools, and most real-time remote biometric identification by police in public spaces. For advertisers the manipulation ban is the live question. Commission guidelines published in February 2025 separate permissible persuasion from prohibited manipulation, and ordinary persuasive advertising is not in scope unless it causes or is likely to cause significant harm.

High-risk systems form the second tier, and there are two routes in. Under Article 6(1), AI that is a safety component of a product already regulated by EU law listed in Annex I, such as machinery, medical devices or toys, is high-risk. Under Article 6(2), AI used in the eight areas of Annex III is high-risk: biometrics, critical infrastructure, education, employment, access to essential services including credit scoring and insurance pricing, law enforcement, migration, and justice and democratic processes. Article 6(3) offers an exit for Annex III systems that only perform a narrow procedural task or prepare a human decision, but never for systems that profile people.

A high-risk provider must run a risk management system, govern its training data, keep technical documentation and automatic logs, design for human oversight, meet accuracy, robustness and cybersecurity requirements, operate a quality management system under Article 17, pass a conformity assessment, affix a CE mark and register the system in an EU database. Deployers must assign trained human overseers, keep logs and, in the case of public bodies, banks and insurers, carry out a fundamental rights impact assessment under Article 27.

Transparency duties under Article 50 form the third tier. Chatbots must tell people they are talking to a machine. Providers of generative systems must mark output in a machine-readable way. Deployers must label deepfakes and AI-generated text published to inform the public.

General-purpose AI models sit beside the tiers rather than inside them. Since August 2, 2025, every provider owes technical documentation, a copyright policy and a public summary of training content under Article 53. Models trained with more than 10^25 floating-point operations are presumed to carry systemic risk and face evaluation, incident reporting and cybersecurity duties under Article 55. Supervision of these providers belongs to the Commission's AI Office; nearly everything else is enforced by national market surveillance authorities.

Fines under Article 99 are tiered: up to 35 million euros or 7% of worldwide annual turnover for prohibited practices, 15 million euros or 3% for most other breaches, and 7.5 million euros or 1% for supplying incorrect information. For small and medium-sized enterprises (SMEs), the lower of the two figures applies.

From white paper to law

The Commission published a white paper on AI in February 2020 and proposed the Act on April 21, 2021. That draft predated ChatGPT, and the European Parliament added rules for foundation models in June 2023. Trilogue talks ended on December 8, 2023 after nearly 15 hours of negotiation, according to RTE. "Historic! The EU becomes the very first continent to set clear rules for the use of AI," Thierry Breton, then internal market commissioner, wrote on X.

Parliament approved the text on March 13, 2024 by 523 votes to 46, with 49 abstentions, and the Council adopted it on May 21, 2024. Published in the Official Journal on July 12, 2024, the Act entered into force on August 1, 2024, with application staggered over three years.

The staggering soon came under strain. On July 3, 2025, more than 45 companies including ASML, Airbus and Mistral AI asked Commission President Ursula von der Leyen for a two-year postponement, according to The Decoder. "There is no grace period. There is no pause," Commission spokesperson Thomas Regnier replied the next day. On September 16, 2025, Mario Draghi, former president of the European Central Bank, called for the high-risk stage to be "paused until we better understand the drawbacks".

The omnibus rewrite

The Commission's Digital Omnibus on AI, proposed on November 19, 2025, tied the high-risk dates to the availability of standards. Parliament's committees instead backed fixed deadlines in March 2026. Talks collapsed overnight in late April before a provisional agreement on May 7, 2026. The result, Regulation (EU) 2026/1744, was published on July 24 and entered into force on July 27, 2026.

As of October 2026, the timetable reads as follows. The general date of application, August 2, 2026, did not move, and Article 50 transparency duties apply from it. Annex III high-risk obligations move from August 2, 2026 to December 2, 2027. Annex I high-risk obligations move from August 2, 2027 to August 2, 2028. Generative systems already on the market before August 2, 2026 have until December 2, 2026 to meet the marking duty, the date on which new bans on AI tools generating non-consensual intimate imagery and child sexual abuse material also apply. The omnibus also extended SME relief to "small mid-caps" and handed the AI Office exclusive supervision of AI systems built on a provider's own model or embedded in very large online platforms, with periodic penalties of up to 5% of average daily turnover.

The AI literacy duty in Article 4, applicable since February 2, 2025, illustrates how sources still diverge. PPC Land's report on the May deal described the obligation moving from companies to the Commission and member states, which would "encourage and facilitate". Law firm Akin Gump, reading the published regulation, says providers and deployers must still take measures to "support the development of AI literacy", a softer obligation than the original but not a transfer.

Why it matters for marketers

Most advertising AI, from bid optimisation to copy generation, falls outside the high-risk annex. Three routes bring the Act closer.

The first is labelling. Since August 2, 2026, an advertiser or agency that publishes an AI-generated deepfake, such as a synthetic spokesperson, must disclose it, and Commission guidelines of July 2026 deny commercial advertising the lighter regime for artistic works. Fines reach 15 million euros or 3% of turnover.

The second is the supply chain. Ad platforms are providers and advertisers deployers. Since July 2026 the ranking, creative and bidding systems inside platforms such as Facebook, Instagram, YouTube and Google Search answer to the AI Office rather than national regulators. The third is the boundary: credit scoring, candidate filtering and personalisation that exploits vulnerabilities touch high-risk or prohibited territory.

Criticism and disputes

Enforcement architecture draws the most complaints. Member states had to designate national authorities by August 2, 2025, yet Cullen International counted only three national AI laws in force, in Denmark, Finland and Italy, as of April 2026. An initial Commission list contained around 2,000 notified market surveillance authorities, according to CMS. Germany's digital association, the Bundesverband Digitale Wirtschaft (BVDW), warned in October 2025 of jurisdictional conflicts between agencies.

Standards lag the law. Harmonised standards give providers a presumption of conformity, but the first, EN 18286 on quality management, was referenced in the Official Journal only on October 14, 2026, according to ActuIA. Nine of the ten areas in the Commission's standardisation request still had no harmonised standard. Draft guidelines on high-risk classification, initially expected by February 2, 2026, appeared on May 19, 2026, according to Hunton Andrews Kurth.

Scope is contested from both sides: industry calls the definitions vague, while creative-sector organisations rejected the implementation measures on training data as insufficient.

Not the same as

GDPR. The General Data Protection Regulation governs personal data processing; the AI Act governs the system as a product. Both can apply to one tool.

Digital Services Act (DSA). Regulation (EU) 2022/2065 sets content moderation and advertising transparency duties for platforms. The AI Act borrows its platform designations.

Council of Europe Framework Convention on AI. A treaty opened for signature on September 5, 2024 that binds states, not companies, and reaches beyond the EU.

Digital Omnibus. The 2025 amending package; its data part, covering the GDPR and cookies, is still under negotiation.

Recent developments

On October 12, 2026, the Commission opened a consultation on draft procedural rules for AI systems under the AI Office's exclusive supervision, under which six types of investigative step would restart the five-year limitation period for fines. Feedback closes on November 9.

Two days later, Henna Virkkunen, executive vice-president for tech sovereignty, told the International AI Summit in Dublin that the AI Office had sent requests for information on security, external evaluation and monitoring of model use. The recipients were OpenAI and Anthropic, according to Euronews, after incidents involving AI agents. Requests for information are not findings of breach. The next fixed date is December 2, 2026.

Timeline

  • February 19, 2020: The Commission publishes its white paper on AI
  • April 21, 2021: The Commission proposes the AI Act
  • June 14, 2023: The European Parliament adopts its negotiating position, adding rules for foundation models
  • December 8, 2023: Parliament and Council reach a provisional agreement
  • March 13, 2024: Parliament approves the Act by 523 votes to 46, with 49 abstentions
  • May 21, 2024: The Council adopts the Act
  • July 12, 2024: Regulation (EU) 2024/1689 is published in the Official Journal
  • August 1, 2024: The Act enters into force
  • February 2, 2025: Prohibited practices and the AI literacy duty apply
  • February 2025: Commission guidelines on prohibited practices and the AI system definition are published
  • July 3, 2025: More than 45 companies ask for a two-year postponement
  • July 10, 2025: The General-Purpose AI Code of Practice is published
  • August 2, 2025: General-purpose model obligations and governance provisions apply
  • November 19, 2025: The Commission proposes the Digital Omnibus on AI
  • May 7, 2026: Provisional agreement on the omnibus
  • May 19, 2026: Draft guidelines on high-risk classification are published
  • July 24, 2026: Regulation (EU) 2026/1744 is published in the Official Journal
  • July 27, 2026: The omnibus enters into force
  • August 2, 2026: General application, Article 50 transparency duties and Commission enforcement powers over model providers apply
  • October 12, 2026: Consultation opens on procedural rules for AI Office supervision of AI systems
  • October 14, 2026: EN 18286 becomes the first harmonised standard referenced under the Act; Virkkunen announces the first requests for information
  • December 2, 2026: Marking deadline for existing generative systems and new prohibitions apply
  • August 2, 2027: Deadline for general-purpose models placed on the market before August 2, 2025
  • December 2, 2027: Annex III high-risk obligations apply
  • August 2, 2028: Annex I high-risk obligations apply

Summary

Who. The European Commission proposed the Act, the European Parliament and the Council adopted it, and the AI Office and national market surveillance authorities enforce it. Its duties fall on providers that build AI systems or models and on deployers that use them, including ad platforms, agencies and advertisers.

What. Regulation (EU) 2024/1689, a risk-based law that bans some AI practices, imposes conformity requirements on high-risk systems, requires disclosure of chatbots and synthetic content, and sets rules for general-purpose models, with fines up to 7% of worldwide turnover.

When. Proposed on April 21, 2021 and in force since August 1, 2024. Bans applied from February 2025, model rules from August 2025 and general application from August 2, 2026. After the 2026 omnibus, high-risk duties apply from December 2, 2027 and August 2, 2028.

Where. Across the 27 EU member states and the European Economic Area, reaching providers anywhere in the world whose AI is placed on the EU market or whose output is used there.

Why. The EU wanted a single rulebook to protect safety and fundamental rights as AI spread into consequential decisions. For marketers it governs AI labels in advertising, the transparency of the models inside ad tools and the outer limits of personalisation.