EU AI Act Adopted — The EU's Comprehensive AI Regulation

On 13 March 2024, the plenary of the European Parliament approved the Artificial Intelligence Act. The vote was 523 in favour, 46 against, 49 abstaining.

The European Commission calls it "the first-ever comprehensive legal framework on AI worldwide"—enforceable by substantial fines and reaching operators outside the Union. But the plenary vote was not the end of the legislative process. Council adoption followed on 21 May, publication in the Official Journal on 12 July (Regulation (EU) 2024/1689), and entry into force twenty days later, on 1 August. Application then began provision by provision. Approved, adopted, in force and applicable are four different dates.

Risk Tiers

The Act's skeleton is a four-tier classification of AI systems.

1. Unacceptable risk — prohibited outright

• Social scoring—not limited to public authorities; private deployment is caught too
• Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes, subject to narrow exceptions
• Untargeted scraping of facial images from the internet or CCTV footage to build recognition databases
• Biometric categorisation that infers sensitive characteristics
• Predictive policing based solely on profiling a person's traits
• Systems that exploit human vulnerabilities (age, disability, etc.)
• Subliminal manipulation techniques
• Emotion recognition in workplaces and educational institutions

2. High risk — strict obligations

• Hiring, credit scoring, judicial decision-making, law enforcement, education, immigration, critical infrastructure, medical devices, and similar high-stakes domains

Such systems must implement risk management, data governance, transparency, human oversight, and demonstrated accuracy and robustness.

3. Limited risk — transparency obligations

• Chatbots, generative systems (deepfakes, etc.)

Users must be told they are interacting with AI or seeing AI-generated content.

4. Minimal risk — free

• Everything else (spam filters, game AI, …)

Special Regime for General-Purpose AI

General-purpose models like ChatGPT, Claude, and Gemini do not fit cleanly into the risk tiers. The Act creates a separate category, General-Purpose AI Model (GPAI), with a two-tier compute-based regulation.

• All GPAI: draw up technical documentation, comply with EU copyright law, and publish a sufficiently detailed summary of the content used for training.
• GPAI with systemic risk: additionally, model evaluations, adversarial testing, cybersecurity hardening, and serious-incident reporting.

Article 51(2) sets the trigger as a presumption: a model "shall be presumed to have high impact capabilities" when "the cumulative amount of computation used for its training measured in floating point operations is greater than 10²⁵". Classification runs through provider notification to the AI Office, not through a published list of model names. By Epoch AI's count, GPT-4 (March 2023) was the first model trained at this scale, and more than 30 publicly announced models had passed it by June 2025.

For contrast, the reporting trigger in the US EO 14110 was 10²⁶ integer or floating-point operations—an order of magnitude apart, and measured differently.

Fines

Article 99's schedule exceeds the GDPR's ceiling (€20 million or 4%). In each band the fine is the higher of the two figures.

• Breach of the Article 5 prohibitions: up to €35 million, or 7% of total worldwide annual turnover for the preceding financial year
• Breach of other obligations, high-risk duties included: up to €15 million, or 3%
• Supplying incorrect, incomplete or misleading information: up to €7.5 million, or 1%

The "percentage of worldwide turnover" formulation has bite even for the largest firms.

Phased Application—and the 2026 Postponement

The Council of the EU adopted the Act on 21 May 2024. It appeared in the Official Journal on 12 July and entered into force twenty days later, on 1 August. Not all provisions begin together:

• 2 February 2025: the prohibitions and the AI-literacy duty apply.
• 2 August 2025: GPAI obligations apply; models already on the market before that date have until 2 August 2027.
• 2 August 2026: the general date of application, including the Article 50 transparency duties. The Commission's power to fine GPAI providers (Article 101: up to €15 million or 3%) was held back from the 2025 date and applies from here.

Between the second and third dates came the General-Purpose AI Code of Practice, published by the Commission on 10 July 2025. It is voluntary and has three chapters—Transparency, Copyright, and Safety and Security, the last only for systemic-risk models. Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI are on the Commission's signatory list; xAI signed only the Safety and Security chapter. Meta refused: on 18 July 2025 Joel Kaplan, its Chief Global Affairs Officer, wrote that "Europe is heading down the wrong path on AI."

In July 2026 the timetable was rewritten. The Digital Omnibus on AI, proposed by the Commission on 19 November 2025, became Regulation (EU) 2026/1744, adopted on 8 July 2026, published in the Official Journal on 24 July and in force on 27 July—six days before the AI Act's own general application date.

The Commission's proposal had tied the high-risk deadlines to the arrival of harmonised standards and guidance, with 2 December 2027 and 2 August 2028 only as backstops. At the political agreement of 7 May 2026 Parliament and Council swapped that for fixed dates, which is what the final text contains:

• Stand-alone high-risk systems under Annex III: 2 August 2026 → 2 December 2027
• High-risk systems embedded in regulated products under Annex I: 2 August 2027 → 2 August 2028
• New Article 5 prohibitions: AI-generated non-consensual intimate imagery and child sexual abuse material, with a transition to 2 December 2026
• Deadline for member states to stand up AI regulatory sandboxes: 2 August 2026 → 2 August 2027
• Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) duty to mark output as AI-generated

The GPAI regime (Articles 51–56) and the 10²⁵ FLOP threshold were left alone. As of October 2026, then, the prohibitions, the GPAI duties and the general provisions apply, and the Commission can enforce the GPAI rules; the stand-alone high-risk regime starts on 2 December 2027. The law the Commission bills as the first comprehensive AI framework had its central high-risk chapter pushed back once before it ever took effect.

The Brussels Effect

The Act has de facto reach beyond the EU. American companies selling AI systems into the European market must comply; in practice, building one global product to the EU standard is cheaper than maintaining two variants.

This is the latest case of the "Brussels effect"—European regulation becoming the de facto global standard for firms based in countries without equivalent law—first widely observed under the GDPR (in force 2016, applicable from 25 May 2018).

National AI policies elsewhere have had the AI Act in view, explicitly or not; Japan chose a lighter, promotion-first statute (Japan's AI Promotion Act). The pull is not uniform. Washington rescinded its own executive order in January 2025 and has since pressed the opposite case, and Brussels itself spent late 2025 and 2026 simplifying and deferring. The plenary vote of 13 March 2024 is the day Brussels put a comprehensive standard for AI on the table—a standard that has been renegotiated since.