The EU AI Act explained: what Europe's AI law changes for you

The AI Act is the European Union regulation that governs artificial intelligence according to the risk it poses: some practices are banned, sensitive uses such as hiring are tightly controlled, and chatbots and generated content must be disclosed. For you, it mainly brings more everyday transparency and protection against systems that assess you, with rules phased in from 2025 to 2028.

The AI Act in a nutshell

The EU AI Act is officially Regulation (EU) 2024/1689. It is the first comprehensive law on artificial intelligence in the European Union. Like the GDPR for personal data, it applies directly in all 27 member states, with no need for a national law for each rule.

It does not regulate the technology itself but how it is used. The same model can write a poem or screen job applications, and only the second use counts as high risk. The law mainly targets two groups:

• providers, who build an AI system and place it on the market, including those based outside the EU, such as US or UK companies selling into Europe;
• deployers, meaning businesses, public bodies or professionals that use an AI system in their work.

In practice, when you ask an assistant for a recipe, you have no obligations. Makers and professional users are the ones who must follow the rules.

Four levels of risk

The heart of the regulation is a risk scale. The more a use can harm people, the stricter the rules.

Level	Examples	What the law requires
Unacceptable risk	Social scoring, manipulating vulnerable people	Ban
High risk	Hiring, education, credit, critical infrastructure, biometrics	Strict obligations before going on the market
Transparency	Chatbots, deepfakes, generated content	Duty to inform
Minimal risk	Spam filters, video games	No specific obligation

Banned practices

According to the European Commission’s page on the regulatory framework, updated on October 19, 2026 and consulted on October 22, 2026, banned practices include harmful manipulation and deception, exploiting people’s vulnerabilities, social scoring, predicting that someone will commit a crime based only on profiling, building facial recognition databases by mass scraping of images, emotion recognition at work and in schools, some forms of biometric categorisation and, with exceptions, real-time remote biometric identification by police in public spaces.

A ninth ban, applicable from December 2026 according to the same page, targets systems that generate non-consensual intimate content, such as sexual deepfakes, and child sexual abuse material.

High-risk systems

A system is high risk when it can affect your rights or safety: software that screens CVs, a tool that grades students, a system that assesses your creditworthiness, AI built into a medical device or a machine. These systems will have to prove the quality of their data to limit bias, keep logs, be documented and provide for human oversight.

Transparency

This is the part you will notice most. Under Article 50, consulted on the AI Act Service Desk, a chatbot must tell you that you are interacting with AI, unless that is obvious. AI-generated audio, images, video or text must be marked in a machine-readable format, for example with a watermark. Deepfakes must be disclosed, and so must generated text published to inform the public on matters of public interest, unless it has gone through human editorial review.

The timeline, checked

The regulation entered into force in 2024, but its rules apply in stages. Here are the dates published by the European Commission and on the AI Act Service Desk timeline, consulted on October 22, 2026:

Date	What applies
August 1, 2024	Regulation enters into force
February 2, 2025	Definitions, AI literacy and banned practices
August 2, 2025	Rules for general-purpose AI models; EU governance and designation of national authorities
August 2, 2026	Most rules apply, including transparency (Article 50); enforcement begins
December 2, 2026	New bans (non-consensual intimate content, child sexual abuse material); end of the marking transition for some systems already on the market before August 2, 2026
August 2, 2027	At least one AI regulatory sandbox running in each member state
December 2, 2027	Rules for high-risk systems in Annex III (hiring, education, credit…)
August 2, 2028	Rules for high-risk systems built into regulated products (Annex I)

Large models such as ChatGPT, Claude or Gemini

Assistants such as ChatGPT run on large language models, which the law calls “general-purpose AI models”. Their makers have had their own rules since August 2025. Under Article 53, consulted on the AI Act Service Desk on October 22, 2026, they must keep technical documentation, tell the businesses that build on their models about capabilities and limits, put in place a copyright compliance policy and publish a summary of their training data.

That last point matters to creators: our article on AI and copyright explains what is at stake.

The law offers relief for models released under a free and open-source licence with public weights: they are exempt from part of the documentation duties, unless they pose a “systemic risk”, a category reserved for the most powerful models. This nuance ties in with the debate in our comparison of open source vs proprietary AI.

What it changes for you, day to day

As a user, you are mainly protected:

• You know when you are talking to a machine. An automated customer service or an assistant has to say so.
• You can spot generated content more easily. Synthetic images, videos and voices must be marked, which helps fight AI-powered scams.
• You are protected from certain practices. No social scoring, no analysis of your emotions by your employer or school, except where the law allows it.
• Decisions about you will be better supervised. Job applicant, credit applicant, student: from December 2027, systems that assess you must meet strict requirements.

If you live in the UK or the US, the AI Act does not govern your own country, but it still shapes the services you use whenever their makers also sell into the EU.

Check yourself You see a very realistic video of a politician with no label at all. What does the AI Act say?

If the video was generated or altered by AI to make a scene look real, it is a deepfake: whoever publishes it in a professional context must disclose that the content is artificial. A missing label does not prove the video is genuine. Check the original source before sharing it.

What it changes for professionals

If you use AI in your work, even on a small scale, a few general principles apply. Under Article 4, consulted on the AI Act Service Desk, providers and deployers must take measures to support the AI literacy of their staff and of anyone using these systems on their behalf. If you publish generated content or use a chatbot with customers, the transparency rules concern you. If you use an AI tool to hire or assess people, the high-risk duties will apply from December 2027.

Penalties are meant to deter. Under Article 99, consulted on October 22, 2026, fines can reach 35 million euros or 7% of worldwide annual turnover for banned practices, 15 million euros or 3% for most other obligations, and 7.5 million euros or 1% for supplying incorrect information to authorities. For small and medium-sized businesses, the lower of the two amounts applies.

Before handing a sensitive task to an autonomous tool, our Can I trust an agent with this? tool helps you assess the risk. And for technical terms, the AI glossary explains them in plain language.

Common misconceptions about the AI Act

• “The AI Act bans ChatGPT in Europe.” No. It regulates assistants without banning them.
• “Everything has applied since 2024.” No. The law entered into force in 2024, but its rules are phased in until 2028.
• “Only European companies are affected.” No. Any company offering an AI system in the EU is covered, wherever it is based.
• “It replaces the GDPR.” No. The two laws work together, and the same tool often has to comply with both.

To place this regulation within Europe’s wider strategy, read our analysis of European AI versus the US and China and our overview of the companies that build AI.