Regulatory sandboxes
National authorities must offer testing environments where companies can develop and test AI under supervision in near-real conditions before release.
Artificial intelligence
The EU AI Act: the world’s first comprehensive AI law
The AI Act sets rules for artificial intelligence based on the risk it poses to health, safety and fundamental rights. The higher the risk, the stricter the rules. We help companies that develop or use AI understand where their systems fall and what they need to do, and when.
Legal actRegulation (EU) 2024/1689
In force sinceAugust 2024
Amended byDigital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 2026
Highest finesUp to EUR 35 million or 7% of worldwide turnover
A risk-based approach
Four levels of risk, four sets of rules
Banned
Unacceptable risk
AI practices that are a clear threat to people’s safety or rights are prohibited, for example:
- manipulation that exploits the vulnerabilities of specific groups;
- social scoring;
- biometric categorisation based on sensitive characteristics;
- real-time remote biometric identification in public spaces, with narrow exceptions for law enforcement;
- from 2 December 2026, AI that generates child sexual abuse material or intimate images of people without their consent.
Strict obligations
High risk
Systems that can affect safety or fundamental rights must meet strict requirements, including risk management, data quality, technical documentation, human oversight and assessment before and after they reach the market. They fall into two groups:
- AI in products covered by EU safety law, such as toys, cars, medical devices and lifts;
- AI used in specific areas, such as critical infrastructure, education, employment, essential services, law enforcement, migration and the administration of justice.
Transparency
Limited risk and general-purpose AI
People must know when they interact with AI. AI-generated or manipulated content, including deepfakes, must be clearly labelled. Providers of general-purpose AI models, such as those behind chatbots, must publish documentation and a summary of the content used for training, and the most powerful models must also assess and reduce systemic risks.
No specific rules
Minimal risk
Most AI systems, such as spam filters or AI in video games, carry minimal risk and face no new obligations beyond general rules such as AI literacy for staff.
Timeline
When the rules apply
The AI Act applies in stages. The Digital Omnibus on AI, adopted in 2026, postponed the high-risk obligations to give standards and guidance time to be ready.
- 2 Feb 2025Prohibited practices and AI literacy obligations apply.
- 2 Aug 2025Rules for general-purpose AI models, governance and penalties apply.
- 2 Aug 2026The AI Act becomes generally applicable, including transparency obligations.
- 2 Dec 2026New prohibitions on non-consensual intimate images and child sexual abuse material; deadline for labelling content from generative systems already on the market.New
- 2 Aug 2027Every Member State must have at least one AI regulatory sandbox.
- 2 Dec 2027High-risk obligations apply to AI used in specific areas (Annex III).Postponed
- 2 Aug 2028High-risk obligations apply to AI in products covered by EU safety law (Annex I).Postponed
Supporting innovation
Room to test and lighter rules for smaller firms
Relief for SMEs and small mid-caps
Simplified quality management and technical documentation, and caps on fines, under the Digital Omnibus.
Guidance and codes of practice
The Commission’s AI Office issues guidelines and codes of practice, such as the code for general-purpose AI models, to help companies comply.
How we help
From inventory to compliance
The AI Act is a regulation, but supervision, sandboxes and penalties are organised nationally. We combine EU-level analysis with knowledge of how Member States apply the rules.
- 01AI inventory and classificationMapping the AI systems you develop or use and their risk level.
- 02Gap analysisComparing your current practices with the obligations that apply to you, and when.
- 03Documentation and policiesTechnical documentation, transparency notices, AI literacy programmes and internal policies.
- 04Contracts and dataAgreements with AI providers and users, and alignment with the GDPR and Digital Services Act.
Useful resources
Official sources
Contact
Developing or using AI in the EU?
Tell us what your AI system does and who uses it. We will tell you which rules apply and by when.