1. What the EU AI Act is (the short version)

• Rules scaled to risk. Regulation (EU) 2024/1689 prohibits practices that are unacceptable to society, sets requirements for "high-risk" uses that carry high risks to health, safety or fundamental rights, and imposes transparency duties on chatbots and the labelling of generated content. General-purpose AI models are covered in a separate chapter Sourced [Ref. 1, 3].
• Application is phased, and the dates have moved. Prohibitions and similar provisions applied from 2 February 2025; general-purpose AI models, governance and penalties from 2 August 2025; and general application (transparency and more) from 2 August 2026. For high-risk AI, the Digital Omnibus made the dates 2 December 2027 (Annex III) and 2 August 2028 (Annex I) Sourced [Ref. 1, 2].
• Adopted, but the surroundings are unfinished. The Digital Omnibus entered into force on 27 July 2026. Meanwhile, the high-risk classification guidelines were still at the draft stage on the check date, and we could not confirm that references to harmonised standards under the AI Act have been published in the Official Journal Not yet confirmed [Ref. 13, 14].

2. Stages of application: from entry into force in 2024 to 2030

Regulation (EU) 2024/1689 was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024, the twentieth day after publication. Article 113 provided that it applies from 2 August 2026, with exceptions by chapter. The 2026 amendment (a rewrite of the third paragraph of Article 113) changed the exceptions for high-risk AI Sourced [Ref. 1, 2].

All entries are statements in the text (Sourced). Items from 2 December 2026 onwards are Not yet confirmed as of the check date, in that the dates have not yet arrived.

3. The Digital Omnibus: from proposal to entry into force, and what changed

The "Digital Omnibus on AI" is an amendment to simplify implementation of the AI Act. It has moved from the proposal stage to being adopted and in force. We separate the dates by stage.

All entries are Sourced (as stated in each source).

The amending regulation's recitals give as reasons for the amendment that the delayed preparation of standards, which give providers of high-risk AI systems technical solutions for compliance, and the delayed establishment of governance and conformity assessment frameworks at national level, made the compliance burden heavier than expected; they also say the level of protection for health, safety and fundamental rights is not to be reduced Sourced [Ref. 2]. The main changes are as follows.

All entries summarise the text of Regulation (EU) 2026/1744 (Sourced). Read the full text in Reference 2.

4. Scope and roles: providers, deployers, extraterritorial reach, and the research exclusions

Article 2(1) sets out whom the regulation applies to Sourced [Ref. 1]. A notable feature is that it reaches operators outside the EU.

The text is Sourced. The right-hand column is our reading and does not decide whether any individual company is covered.

Some definitions are worth noting. Article 3(1) defines an "AI system" as a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. A "deployer" is a person using an AI system under its authority, except in the course of a personal non-professional activity [Ref. 1].

Where the regulation does not apply

• AI systems used exclusively for military, defence or national security purposes (Art. 2(3)).
• AI systems or models, including their output, specifically developed and put into service for the sole purpose of scientific research and development (Art. 2(6)).
• Research, testing or development activity before the AI system or model is placed on the market or put into service (Art. 2(8)). However, testing in real world conditions is not covered by this exclusion.
• The obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity (Art. 2(10)).

The research exclusion concerns activity before placing on the market. Once a system is placed on the market, put into service or tested in real conditions, whether the regulation applies has to be checked again (our reading).

5. The risk categories

The European Commission describes the AI Act in four levels of risk: unacceptable risk (prohibited), high risk, transparency risk, and minimal or no risk. General-purpose AI models have separate rules [Ref. 3].

The table organizes statements in the regulation and the Commission page (Sourced). Categories can overlap (for example, high-risk AI can also be subject to transparency duties).

6. Prohibited practices

Article 5(1) prohibits the following practices from being placed on the market, put into service or used. They have applied since 2 February 2025. The Commission published guidelines on prohibited practices on 4 February 2025 and notes that they are non-binding and that authoritative interpretation is reserved for the Court of Justice of the European Union Sourced [Ref. 1, 5].

A summary of the (amended) text (Sourced), not the full requirements of each point. The Commission counts these as one prohibition and describes nine prohibited practices in total [Ref. 3].

Closest to enterprise AI deployment is point (f), inferring emotions in the workplace. AI that infers employees' emotions from facial expressions or voice is prohibited, except for medical or safety reasons. Uses that manipulate or score people, as in points (a), (b) and (c), are also covered (our reading).

7. High-risk AI: two entry points, and what is required

There are two entry points to being classified as high-risk. Article 6(1) applies when an AI system is a safety component of a product covered by the Union harmonisation legislation in Annex I (or is itself such a product) and that product must undergo a third-party conformity assessment. Article 6(2) covers AI systems for the uses listed in Annex III. An Annex III system is not high-risk where it does not pose a significant risk (Article 6(3)), but an Annex III system that performs profiling of natural persons is always high-risk Sourced [Ref. 1].

The eight areas of Annex III

A summary of Annex III (Sourced), not the full text of each point. Most relevant to manufacturers are area 4 (employment and workers' management: recruitment, performance evaluation and monitoring) and AI that is a safety component of an Annex I product (our reading).

Annex I Section A lists legislation including toys, recreational craft, lifts, equipment for explosive atmospheres, radio equipment, pressure equipment, cableway installations, personal protective equipment, gas appliances and medical devices. The 2026 amendment deleted the Machinery Directive item from Section A and added Machinery Regulation (EU) 2023/1230 to Section B [Ref. 1, 2]. For high-risk AI related to Section B legislation, only some provisions of the AI Act apply directly (Art. 2(2)). On the machinery side, an amendment provides that delegated acts reflecting AI requirements are to apply by 2 August 2028 [Ref. 2].

Overview of what is required

A summary of the text (Sourced). See the articles and annexes for the detailed requirements.

The method of conformity assessment differs by area. High-risk AI under Annex III points 2 to 8 follows the procedure based on internal control (Annex VI), with no notified body involved (Art. 43(2)). For Annex III point 1 (biometrics), where harmonised standards have been applied the provider can choose between internal control and the involvement of a notified body, and in other cases (for example where no standards exist) follows the Annex VII procedure (Art. 43(1)). Products under Annex I Section A follow the conformity assessment procedure of the legislation concerned, with the Section 2 requirements forming part of it (Art. 43(3)) [Ref. 1].

Harmonised standards, and where things stand

Where references to harmonised standards have been published in the Official Journal, a high-risk AI system in conformity with them is presumed to meet the Section 2 requirements to the extent the standards cover them (Art. 40(1)) [Ref. 1]. The CEN-CENELEC Joint Technical Committee 21 (JTC 21) is developing harmonised standards in support of the AI Act, with AI risk management, an AI quality management system, AI conformity assessment and an AI trustworthiness framework among the main items [Ref. 14]. We could not confirm, in this survey, that references to harmonised standards under the AI Act had been published in the Official Journal as of the check date. The recitals of the amending regulation give the delay in standards as one reason for postponing the high-risk dates [Ref. 2]. We also could not confirm that international standards such as ISO/IEC 42001 have been cited as harmonised standards in the Official Journal.

To help with classification in practice, the Commission was asked under Article 6(5) to issue guidelines (including a list of practical examples of high-risk and non-high-risk use cases) by 2 February 2026. The Commission's page says it has published a draft, held a further targeted consultation until 23 July 2026, and will incorporate the feedback before adopting the final version Not yet confirmed [Ref. 1, 13]. The guidelines are not legally binding and reflect the Commission's interpretation [Ref. 13]. The Commission also says it is preparing other guidelines, for example on the practical application of the high-risk requirements, responsibilities along the AI value chain, substantial modification, a voluntary template for post-market monitoring, and a template for the fundamental rights impact assessment [Ref. 15].

8. General-purpose AI models

A general-purpose AI (GPAI) model is defined as an AI model, including where trained with a large amount of data using self-supervision at scale, that displays significant generality, is capable of competently performing a wide range of distinct tasks, and can be integrated into a variety of downstream systems or applications (Article 3(63); models used for research, development or prototyping before being placed on the market are excluded). "Systemic risk" is a risk specific to the high-impact capabilities of GPAI models, with a significant impact on the Union market and able to propagate at scale across the value chain (Article 3(65)) Sourced [Ref. 1].

The compute reference points

Article 51 treats a GPAI model as a systemic-risk model if it has high-impact capabilities. A model is presumed to have high-impact capabilities when the cumulative compute used for training exceeds 10²⁵ floating point operations (FLOP) (Art. 51(2)). The Commission can amend this by delegated act (Art. 51(3)). A provider must notify the Commission without delay, and in any event within two weeks, after the condition is met (Art. 52(1)) [Ref. 1]. The Commission's guidelines (18 July 2025) give an indicative criterion for whether a model is a GPAI model: training compute greater than 10²³ FLOP and the ability to generate language (text or audio), text-to-image or text-to-video. They explain that this roughly corresponds to the compute typically used to train a model with one billion parameters on a large amount of data [Ref. 7]. The indicative criterion for when a downstream modifier becomes the provider of a modified GPAI model is that the compute used for the modification exceeds one third of the training compute of the original model. If that cannot be known or estimated, one third of 10²⁵ FLOP is used when the original is a systemic-risk model, and otherwise one third of 10²³ FLOP [Ref. 7]. These are the Commission's non-binding interpretation.

Obligations of providers

A summary of the text (Sourced).

In July 2025 the Commission published three instruments: the guidelines on the scope of the obligations of GPAI model providers (18 July 2025); the GPAI Code of Practice (10 July 2025; chapters on transparency, copyright, and safety and security, the last for providers of systemic-risk models); and the template for the public summary of training content (24 July 2025). The Commission and the AI Board have confirmed the code of practice as an adequate voluntary tool for GPAI model providers to demonstrate compliance Sourced [Ref. 6-9]. The obligations have applied since 2 August 2025, and the Commission's enforcement powers (including fines) apply from 2 August 2026. Models placed on the market before 2 August 2025 must comply by 2 August 2027 [Ref. 6].

9. Transparency obligations (Article 50)

Article 50 sets the following transparency obligations for certain AI systems. They apply from 2 August 2026 Sourced [Ref. 1, 12].

A summary of the (amended) text (Sourced). "Deep fake" is defined in Article 3(60) as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful.

The Commission has published documents to help with implementation. 1. Code of practice (transparency of AI-generated content): on 8 July 2026 the Commission concluded that the code adequately covers Article 50(2), (4) and (5), and the next day the AI Board adopted its adequacy assessment. Providers and deployers who sign can rely on its measures to demonstrate compliance. However, adherence to the code is not conclusive evidence of compliance [Ref. 10, 11]. The Commission's page says about 190 companies and organisations had signed by the end of July 2026 [Ref. 10]. 2. Guidelines (Article 50): published on 20 July 2026, they clarify the scope, definitions and exceptions [Ref. 12]. 3. Transitional rule: providers of generative systems placed on the market before 2 August 2026 are to meet Article 50(2) by 2 December 2026 (Art. 111(4)) [Ref. 2].

Content provenance and watermarking techniques, and national legal regimes on deepfakes, are covered in our explainer on copyright, provenance and deepfakes.

10. Penalties and enforcement: our calculation

Article 99 provides that Member States lay down penalties and enforcement measures (including administrative fines, warnings and non-monetary measures), which must be effective, proportionate and dissuasive. The ceilings are below. The 2026 amendment added to the "whichever is lower" rule for SMEs a parallel rule for small mid-cap enterprises (SMCs) Sourced [Ref. 1, 2].

The text is Sourced. In deciding on a fine, regard is given to the nature, gravity and duration of the infringement, the number of persons affected, the size and turnover of the operator, cooperation, and whether the infringement was intentional or negligent (Art. 99(7)).

Enforcement lies with Member State market surveillance authorities and the AI Office (for GPAI models and the AI systems set out in Article 75 as amended). According to the Commission's page, from 2 August 2026 the AI Office and Member State authorities are responsible for implementation, supervision and enforcement [Ref. 3].

11. Where this sits for manufacturing and R&D

For materials, chemicals and manufacturing companies, the EU AI Act is not a regulation only for companies that build AI. There are two points of contact: when a company puts a product with AI built in on the EU market, and when it uses AI in its work at an EU site (our reading). We organize what can be read from the text.

12. Limits, and what we could not confirm

(1) Interpretation and individual application

This article summarizes the text and the Commission's published documents. It does not decide whether any particular company or product has obligations. The guidelines are non-binding, and authoritative interpretation belongs to the Court of Justice of the European Union. We do not cover national authorities' practice or case law.

(2) Drafts and future items

The high-risk classification guidelines were at the draft stage on the check date. For dates from 2 December 2026 onwards (the new prohibited practices, high-risk AI under Annex III and Annex I, the transitional rules in Article 111 and so on), the dates have not yet arrived and we have not confirmed implementation.

(3) Harmonised standards

We could not confirm in this survey that references to harmonised standards under the AI Act have been published in the Official Journal. We have not checked the final status of individual CEN-CENELEC JTC 21 standards in the official standards catalogue.

(4) Signatories and operation of the codes of practice

The lists of signatories to the GPAI Code of Practice and the Code of Practice on transparency of AI-generated content, and the responses of individual signatories, are not covered.

(5) Relationship with other laws

The relationship with laws that apply in parallel, such as data protection (GDPR), product safety, copyright and consumer protection, is covered only in outline.

13. How to read evaluations and standards

The EU AI Act has to be read with a distinction between the legal obligation (the requirement) and the means used in practice to show compliance (guidelines, codes of practice, harmonised standards and international standards). Legal obligations are binding; guidelines are the Commission's interpretation; codes of practice are an optional means; and harmonised standards are a means that gives a presumption of conformity once their references are published in the Official Journal. The table below lines up, for each regulated subject, the evaluation methods and the standards or guidance, as far as they could be confirmed.

Checked against the text of the laws, the European Commission's official pages and ISO's pages (Sourced; checked 15 October 2026). The arrangement of this table is Our calculation (a reordering by this article), and the reading-note column is commentary.

Notes on reading

• Legal obligations and guidelines, codes and standards are different layers. Guidelines are the Commission's interpretation (non-binding), a code of practice is an optional way to show compliance, and a presumption of conformity from harmonised standards operates only once their references are published in the Official Journal. Certification to ISO/IEC 42001 does not mean conformity with the AI Act (our reading).
• Dates differ by provision and move with amendments. When citing one, give the article number, whether it has been amended, and the check date. "High-risk from August 2026" has been out of date since 27 July 2026.
• Distinguish a presumption from an indicative criterion. 10^25 FLOP is a presumption in the text (Art. 51(2)); 10^23 FLOP is an indicative criterion in the Commission's guidelines (non-binding). Compute depends on assumptions about precision and utilization, so even the same model can have a range of estimates.

14. Glossary

15. References

1. European Parliament and Council Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), of 13 June 2024, OJ L, 2024/1689, 12.7.2024 (as originally published) — eur-lex.europa.eu/eli/reg/2024/1689/oj
2. European Parliament and Council Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), of 8 July 2026, OJ L, 2026/1744, 24.7.2026 — eur-lex.europa.eu/eli/reg/2026/1744/oj
3. European Commission "AI Act", Shaping Europe's digital future (the Commission's explainer page; checked 15 October 2026) — digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
4. European Commission "Digital Omnibus on AI Regulation Proposal" (published 19 November 2025; links to the news item of 27 July 2026, "AI Omnibus enters into force") — digital-strategy.ec.europa.eu/en/library/digital-omnibus-ai-regulation-proposal
5. European Commission "Commission publishes the Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act" (4 February 2025) — digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
6. European Commission "Guidelines for providers of general-purpose AI models" (overview page, with application and enforcement dates) — digital-strategy.ec.europa.eu/en/policies/guidelines-gpai-providers
7. European Commission "Guidelines on the scope of the obligations for general-purpose AI models established by AI Act" (English PDF; guidelines of 18 July 2025) — ec.europa.eu/newsroom/dae/redirection/document/118340
8. European Commission "The General-Purpose AI Code of Practice" (published 10 July 2025) — digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
9. European Commission "Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models" (24 July 2025) — digital-strategy.ec.europa.eu/en/library/explanatory-notice-and-template-public-summary-training-content-general-purpose-ai-models
10. European Commission "Code of Practice on Transparency of AI-generated Content" (page of the code; states that about 190 companies and organisations had signed by the end of July 2026) — digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
11. European Commission "Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated Content" (posted 9 July 2026; Commission conclusion of 8 July, AI Board adequacy assessment the next day) — digital-strategy.ec.europa.eu/en/library/commission-opinion-assessment-code-practice-transparency-ai-generated-content
12. European Commission "Guidelines on transparency obligations for providers and deployers of AI systems" (20 July 2026) — digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems
13. European Commission "Guidelines for providers and deployers of AI high-risk systems" (page of the draft guidelines; further consultation until 23 July 2026; last updated 6 July 2026) — digital-strategy.ec.europa.eu/en/policies/guidelines-ai-high-risk-systems
14. CEN-CENELEC "Artificial Intelligence" (page on JTC 21; states that harmonised standards in support of the AI Act are being developed and give a presumption of conformity once published in the Official Journal) — www.cencenelec.eu/areas-of-work/cen-cenelec-topics/artificial-intelligence/
15. European Commission "Supporting the implementation of the AI Act with clear guidelines" (posted 4 December 2025, updated 31 July 2026) — digital-strategy.ec.europa.eu/en/news/supporting-implementation-ai-act-clear-guidelines
16. ISO/IEC "ISO/IEC 42001:2023" (Information technology — Artificial intelligence — Management system; edition 1, December 2023) — www.iso.org/standard/81230.html
17. ISO/IEC "ISO/IEC 23894:2023" (Information technology — Artificial intelligence — Guidance on risk management; edition 1, February 2023) — www.iso.org/standard/77304.html

16. Claim-to-source audit

Last updated: 15 October 2026 / Sources are limited to primary material (the texts of Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 on EUR-Lex, official pages and guidelines of the European Commission, the CEN-CENELEC official page and ISO standard pages). The full texts of standards are paid and were not read. Summaries of the text and practical readings are marked as commentary or our calculation to keep them apart from sourced facts. Whether the Act applies to any individual company or product, Official Journal references for harmonised standards, national authorities' practice, and the implementation of items from 2 December 2026 onwards could not be confirmed and are not described. This article is not legal advice. We make no guess about the outcome of pending proceedings or future amendments. Figures 2 to 6 are vector drawings; Figures 1 and 7 are frames for AI-generated images (not yet created). None of them depicts a real company, product or site.