AI Act

Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

01What it is

The AI Act regulates artificial intelligence by risk. It prohibits specified practices, imposes substantial obligations on high-risk systems, applies transparency duties to some others, and regulates general-purpose AI models in their own right. What falls outside those categories escapes the high-risk requirements, not the Regulation: the AI literacy duty in Article 4 binds every provider and deployer, whatever the tier.

Everything therefore turns on classification — which systems fall inside, and in which role. Get that wrong and every downstream obligation is wrong with it.

02Who it applies to

The operators listed in Article 2: providers, deployers, importers and distributors of AI systems placed on the market or put into service in the EU, providers of general-purpose AI models, authorised representatives of providers established outside the Union, and product manufacturers placing a system on the market together with their product under their own name or trademark.

The role is not fixed. A deployer that fine-tunes a model, puts its own name on a system, or substantially modifies it can become a provider — with the obligations that follow. Most organisations occupy more than one role across their estate.

03Core obligations

An inventory and a classification by risk tier — not a duty the Regulation imposes in those terms, but the step without which none of the rest can be answered; what the Regulation does require is technical documentation under Article 11 and registration under Article 49, where applicable
Role determination per system: provider, deployer, importer, distributor
Prohibited practices under Article 5 — the original prohibitions admit no balancing, and the two inserted by the Digital Omnibus, in force from 2 December 2026, apply within the conditions set out in Article 5(1a) and (1b)
For high-risk systems: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness
Deployer obligations for high-risk systems under Article 26: use in accordance with the instructions, human oversight by a competent person, monitoring — and, to the extent the deployer controls the input data, ensuring that it is relevant and sufficiently representative
Fundamental rights impact assessment for certain deployers
Transparency and marking obligations under Article 50
AI literacy under Article 4, applicable since 2 February 2025: in the form given to that article by Regulation (EU) 2026/1744, providers and deployers must take measures supporting the development of AI literacy among their staff. It is a lighter duty than before, and still a duty
General-purpose AI model obligations under Articles 51–55, including the duty under Article 53(1)(b) to provide information and documentation to the providers who will integrate the model — information passes downstream, the model provider’s own obligations do not

04Timeline

2 February 2025Prohibited practices and AI literacy (Article 4).
2 August 2025GPAI obligations, governance and penalties. Providers of general-purpose AI models already on the market on that date have until 2 August 2027 to comply, under Article 111(3).
2 August 2026The Regulation becomes generally applicable (Article 113, second paragraph). What the Digital Omnibus deferred is Sections 1, 2 and 3 of Chapter III, excluding Article 6(5); Section 4 has applied since 2 August 2025. It did not defer the Regulation.
2 December 2026Two prohibitions inserted by the Digital Omnibus take effect: Article 5(1)(ba), on non-consensual intimate material, and Article 5(1)(bb), on material or performance within the meaning of Article 2, points (c) and (e), of Directive 2011/93/EU. Neither is unconditional — see below.
2 December 2026Transitional deadline under Article 111(4) for providers of AI systems generating synthetic audio, image, video or text content, placed on the market before 2 August 2026, to bring them into line with Article 50(2).
2 December 2027High-risk obligations for Annex III standalone systems — deferred by the Digital Omnibus.
2 August 2028High-risk obligations for Annex I systems embedded in regulated products — deferred by the Digital Omnibus.
2 August 2030Transitional compliance deadline under Article 111(2), as replaced by the Digital Omnibus, for providers and deployers of high-risk systems placed on the market or put into service before the date of application of Chapter III and intended to be used by public authorities. It is not a general postponement for public-sector systems.

05Where it meets the other regimes

The deferral that was widely misread

Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and deferred the high-risk obligations in Sections 1, 2 and 3 of Chapter III, excluding Article 6(5). Section 4, on notifying authorities and notified bodies, has applied since 2 August 2025. It did not defer the Regulation, which has been generally applicable since 2 August 2026 under the second paragraph of Article 113. It did not defer Article 4 on AI literacy, which has applied since February 2025 — although it did rewrite it, replacing the duty to ensure a sufficient level of AI literacy with a duty to take measures supporting it. Articles 51 to 55 on general-purpose AI were left in place. Organisations that read 'deferral' and stopped work are wrong about which parts were deferred.

The two new prohibitions are conditional, and the conditions do the work

Article 5(1a) splits the test. Placing on the market or putting into service is prohibited only where that generation or manipulation is the intended purpose of the system, or where the system's design, training, architecture, capabilities or user-facing functionalities make it a reasonably foreseeable and reproducible outcome without significant technical modification, and the system lacks reasonable and adequate safeguards to prevent and correct that misuse. Use is prohibited only where the deployer uses the system for that purpose. Article 5(1b) excludes manipulation that neither increases the exposure of any depicted intimate parts nor alters the nature of any depicted sexually explicit activities.

For a general-purpose system, the question is therefore not whether the output is possible but whether the safeguards hold — which is an evidential question, assessed against reasonably foreseeable misuse, and one that has to be answered before 2 December 2026.

AI Act ↔ GDPR

Where the system processes personal data, both apply, and they ask different questions. The AI Act asks about classification, documentation and oversight. The GDPR asks about lawful basis for training data, transparency to the people affected, and Article 22 on automated decisions. Each requires its own assessment on its own terms.

AI Act ↔ NIS2 and DORA

Where the AI system sits in critical infrastructure, NIS2 governs the security of the environment around it. Where the deployer is a financial entity, DORA governs the ICT risk, including where the model is supplied by a third party.

06What we are instructed on

AI Act classification and role determination, governance frameworks, procurement and contracting, impact assessments, and readiness reviews.

The practice →

Expertise beyond Law & Technology

Digital regulation applies to systems, not to documents. We work where law, technology and governance actually meet — which is where the obligations bite.