The European AI Act explained in plain English

01What is the European AI Act?

The European AI Act is an EU regulation. A regulation is a law that applies in every member state without each country writing its own version. Its full name is Regulation (EU) 2024/1689, dated 13 June 2024, and it entered into force on 1 August 2024. The European Commission keeps a timeline of when each part applies.

The idea is to match the rules to the risk. The more an AI system could harm health, safety or basic rights, the stricter the duties. The law bans a short list of uses and puts duties on others.

The law was changed in July 2026 by a second regulation, Regulation (EU) 2026/1744, known as the Digital Omnibus on AI and published in the Official Journal on 24 July 2026. It moved several deadlines and added two new bans. This page is general information, not legal advice. For a real product or business decision, ask a lawyer or your national AI authority.

02Who does the AI Act cover?

It reaches beyond companies based in Europe. The Commission's summary of Article 2 lists providers, meaning organisations that build an AI system or model and put it on the EU market, wherever they are based. It also lists deployers, meaning organisations that use an AI system, when they are located in the EU. Importers, distributors and product makers are covered too, and so are providers and deployers outside the EU when the system's output is used in the EU.

Some activities sit outside the law. The same summary says it does not apply to a person using AI for personal, non-professional purposes, to research, testing and development work, or to national security matters.

03How does the AI Act sort AI by risk?

The law works with five practical groups.

• Banned. Article 5 lists practices such as manipulation that causes significant harm, exploiting a person's age, disability or social or economic situation, social scoring, predicting crime from profiling alone, scraping faces from the internet or CCTV to build recognition databases, and inferring emotions at work or school except for medical or safety reasons. Real-time face identification in public for law enforcement is banned too, with narrow exceptions.
• High-risk. These are uses in eight areas listed in Annex III of the law: biometrics, critical infrastructure, education, employment and worker management, essential public and private services, law enforcement, migration and border control, and justice and democratic processes. AI that is a safety part of a regulated product can be high-risk too. These systems need risk management, documentation and human oversight.
• Transparency. Article 50 says people must be told when they interact with an AI system, providers must mark AI-generated audio, image, video and text in a machine-readable way, and deployers must disclose deepfakes.
• General-purpose AI models. Separate duties apply to the makers of broad models, with extra duties for models presumed to carry systemic risk. The Commission's FAQ gives the current training-compute marker for that presumption as 10^25 floating point operations.
• Everything else. AI outside these groups has no risk-level duties of its own, though general rules such as AI literacy still apply to providers and deployers, as the FAQ explains.

04Which dates matter as of 24 October 2026?

These dates follow the Commission's timeline, which includes the July 2026 amendments.

• 1 August 2024: the law entered into force.
• 2 February 2025: definitions, AI literacy and the bans began to apply.
• 2 August 2025: rules for general-purpose AI models began, and governance bodies had to be in place.
• 2 August 2026: transparency rules apply, and enforcement starts for the bans, transparency, AI literacy and general-purpose AI.
• 2 December 2026: two new bans apply, covering AI that generates realistic sexual images of an identifiable person without consent and AI that generates child sexual abuse material. Certain providers already on the market before 2 August 2026 have until then to meet the marking duty in Article 50(2).
• 2 August 2027: each member state should have at least one AI regulatory sandbox running.
• 2 December 2027: high-risk rules for the Annex III uses apply. They were due on 2 August 2026 before the amendment.
• 2 August 2028: high-risk rules for AI built into regulated products apply. They were due on 2 August 2027 before the amendment.

05Who enforces the AI Act, and what are the fines?

Enforcement is shared. National market surveillance authorities supervise most AI systems. The Commission's AI Office has exclusive powers over general-purpose AI models, over some systems built on them by the same provider, and over AI inside very large online platforms and search engines, according to the Commission's FAQ.

Article 99 sets the top fines. Breaking a ban can cost up to EUR 35 million or 7 percent of worldwide yearly turnover, whichever is higher. Breaking most other duties, including the transparency rules, can cost up to EUR 15 million or 3 percent. Giving wrong information to authorities can cost up to EUR 7.5 million or 1 percent. For small and medium companies the lower figure applies, and the 2026 change extends that to small mid-cap companies for the second and third tiers.

These are ceilings, not usual amounts. The article tells authorities to weigh the circumstances of each case.

06What can a reader or small team do now?

You do not need to read the whole law to take a first step. This routine is general information, not legal advice.

1. List the AI tools your organisation uses and note who built each one.
2. For each tool, check whether it touches a banned practice, an Annex III area or a transparency rule. Hiring tools and school admission tools are the common high-risk examples.
3. If you publish AI-generated images, audio, video or text, read Article 50 and the Commission's current guidance on marking and disclosure.
4. Write down what you decided and why, and set a reminder to recheck before 2 December 2026.
5. Ask a lawyer or your national authority before relying on this page for a business decision.