The European Union's Artificial Intelligence Act sorts AI systems into four risk levels: unacceptable (banned), high, transparency, and minimal. The law entered into force on August 1, 2024, and a 2026 amending regulation moved the main high-risk deadlines to December 2, 2027 and August 2, 2028. Providers and deployers outside Europe, including Canadian and American ones, can be covered when their systems are sold in the EU or their output is used there.
Key takeaways
- The Act defines four tiers of risk, and only the first three carry obligations. Systems in the minimal tier face no specific rules.
- Eight practices have been banned since February 2, 2025, and a ninth ban, on nonconsensual sexual imagery and child abuse material, is set for December 2, 2026.
- Regulation (EU) 2026/1744 delayed rules for high-risk systems: December 2, 2027 for listed uses such as hiring, and August 2, 2028 for AI built into regulated products.
- Fines for banned practices can reach EUR 35 million or 7 percent of worldwide annual turnover, whichever is higher, and are capped at the lower figure for small businesses.
The four risk tiers
The European Commission describes the Act as a risk-based framework. Unacceptable-risk practices are prohibited outright. High-risk systems, meaning uses that can seriously affect health, safety, or fundamental rights, must meet strict requirements before they reach the market. The transparency tier covers disclosure duties, such as telling people they are talking to a chatbot and labeling deepfakes. Everything else is treated as minimal risk and is left unregulated by the Act.
The European Parliament names biometrics, critical infrastructure, education, employment, and law enforcement among the areas where listed high-risk uses sit. That is a classification by purpose, not by technology. The same image model could be minimal risk in a photo app and high risk when used to screen job candidates.
What is already banned
Since February 2, 2025, Article 5 has prohibited eight practices. They are manipulation through subliminal or deceptive techniques that causes significant harm, exploiting vulnerabilities linked to age, disability, or economic situation, social scoring that leads to unrelated or disproportionate treatment, predicting criminal offences solely from profiling, untargeted scraping of facial images from the internet or CCTV, inferring emotions at work or school (with medical and safety exceptions), biometric categorization to deduce traits such as religion or sexual orientation, and real-time remote biometric identification by police in public spaces, with narrow exceptions.
The 2026 amending regulation adds a ninth ban aimed at AI systems that generate nonconsensual sexual or intimate content or child sexual abuse material, including so-called nudification apps. The Commission lists it as taking effect in December 2026.
Timeline of dates and their status
The table separates what already applies from what is scheduled. Dates come from the Commission's AI Act page, checked on October 24, 2026.
| Date | What happens | Status on October 24, 2026 |
|---|---|---|
| August 1, 2024 | The Act enters into force | In effect |
| February 2, 2025 | Prohibited practices and AI literacy duties apply | In effect |
| August 2, 2025 | Governance rules and duties for general-purpose AI models apply | In effect |
| August 2, 2026 | General application begins, with exceptions; the AI Office and national authorities start supervising and enforcing; transparency rules start | In effect |
| December 2, 2026 | Ban on AI that generates nonconsensual intimate imagery and child abuse material | Scheduled |
| December 2, 2027 | Stricter rules for high-risk systems in listed areas (Annex III of the Act) | Scheduled, moved from August 2, 2026 |
| August 2, 2028 | Rules for high-risk AI embedded in regulated products | Scheduled, moved from August 2, 2027 |
How the delay came about
The Commission proposed the change on November 19, 2025 as part of a "digital omnibus" simplification package. Its first version tied the start of high-risk rules to the availability of supporting standards and tools, with a capped delay of 16 months for the listed high-risk uses and 12 months for systems embedded in regulated products. Parliament adopted its negotiating position on March 26, 2026 by 569 votes to 45, with 23 abstentions, and asked for fixed dates instead. The Council and Parliament reached a provisional agreement on May 7, 2026, and the amending text, Regulation (EU) 2026/1744, was published in the Official Journal on July 24, 2026 and entered into force on July 27, 2026.
A proposal and an enacted regulation are different things, and the difference matters here. In late 2025 the delay was only a proposal. It became law with the July 2026 publication.
Who is covered and what it costs to get it wrong
Article 2 applies the Act to providers placing AI systems or general-purpose models on the EU market wherever they are based, to deployers located in the Union, and to providers and deployers outside the Union when the system's output is used in the Union. Article 99 sets maximum fines: EUR 35 million or 7 percent of total worldwide annual turnover for banned practices, EUR 15 million or 3 percent for most operator duties including the transparency rules, and EUR 7.5 million or 1 percent for supplying incorrect information to authorities. In each case the higher figure applies, except that small and medium-sized businesses pay the lower of the two.
This article is general information, not legal advice. Whether a particular product is high risk, or whether a Canadian or American company falls within Article 2, depends on facts that only a qualified lawyer or the text of the regulation can settle. National authorities and the Commission may also issue guidance that changes how provisions are read.
A short screening list for a product team
- Is any output used by people in the EU, even if the company is not based there?
- Does the system fall under any of the nine banned practices?
- Is the use case in a listed high-risk area, such as employment or education?
- Does it talk to people or generate synthetic media, which triggers disclosure duties?
- Has the team recorded which date applies to each obligation, using the table above?
FAQ
Is the EU AI Act in force or still a proposal?
It is in force. The Act entered into force on August 1, 2024, and its obligations phase in. Only the 2025 digital omnibus began as a proposal, and it became Regulation (EU) 2026/1744 in July 2026.
When do high-risk rules start applying?
For systems in listed areas such as employment and education, December 2, 2027. For AI embedded in products already covered by EU safety law, August 2, 2028.
Does the Act apply to a company in Canada or the United States?
Possibly. Article 2 reaches non-EU providers that place systems on the EU market, and non-EU providers or deployers whose output is used in the Union.
Is enforcement already happening?
The Commission says the AI Office and national authorities began supervising and enforcing the Act when general application started on August 2, 2026. Some provisions, such as the high-risk rules, apply later.
Related reading
- Canada's approach to AI regulation
- The debate over AI as a threat to humanity
- Whether AI is a threat or a tool
- Benefits and risks of AI across fields
More in AI Policy and Ethics.
Last verified: October 2026
Sources
- AI Act, regulatory framework for AI, European Commission, 2026
- Article 99: Penalties, AI Act Service Desk, European Commission, 2026
- Article 2 and Article 5 of Regulation (EU) 2024/1689, AI Act Service Desk, European Commission, 2026
- Artificial Intelligence Act: delayed application, ban on nudifier apps, European Parliament press room, March 26, 2026
- Artificial Intelligence: Council and Parliament agree to simplify and streamline rules, Council of the European Union, May 7, 2026
- Digital package FAQ, European Commission, November 2025