EU’s AI Act Takes Effect: What Changes Now

Europe’s landmark AI law starts the clock

Europe’s Artificial Intelligence Act, the world’s first broad, horizontal law for AI, entered into force on 1 August 2024. The rules begin a staged rollout that will stretch over the next few years. The European Commission says the aim is to ensure safe and trustworthy AI while supporting innovation. The law applies to developers and users inside the European Union and, in many cases, to companies abroad that place AI systems on the EU market or whose systems affect people in Europe.

The Act takes a risk-based approach. It bans some uses outright, tightens oversight of high-risk systems, and creates special duties for general-purpose AI models. National regulators, coordinated by a new AI Office in the Commission, will enforce the rules. Companies face heavy fines for violations, with top penalties reaching up to 7% of global annual turnover, according to the final text published in the EU’s Official Journal.

What the law does

The AI Act organizes obligations by risk level. It also introduces governance to match.

• Banned practices: The law prohibits certain uses deemed unacceptable. These include social scoring by public authorities and AI that manipulates people in ways likely to cause harm. It also places strict limits on real-time remote biometric identification in public spaces for law enforcement, allowing only narrow, pre-authorized exceptions.
• High-risk systems: AI used in sensitive areas must meet strict requirements. Categories include critical infrastructure, education and exams, employment and worker management, access to essential services and benefits, law enforcement, migration and border control, and the administration of justice. Duties cover risk management, data quality, technical documentation, human oversight, cybersecurity, and post-market monitoring.
• General-purpose AI (GPAI): Developers of large, general models face transparency and safety duties. Providers must publish technical summaries, support downstream users with documentation, and respect EU copyright rules, including by enabling rights holders to opt out of text and data mining where applicable. Models with systemic risk must meet stronger obligations, such as regular evaluation and reporting of serious incidents.

Recitals to the law frame the technology broadly. As the text states, artificial intelligence is a "fast-evolving family of technologies" that can bring significant benefits while creating new risks. The Act aims to balance both.

Who is covered

Obligations vary by role in the AI value chain. The law distinguishes between providers, deployers, importers, distributors, and product manufacturers that integrate AI components.

• Providers (often the developers) bear most duties for high-risk systems and general-purpose models, including conformity assessments and documentation.
• Deployers (the users) must apply instructions, ensure human oversight, and log system operations for high-risk AI. Public bodies using high-risk AI will face additional transparency obligations.
• Importers and distributors must check that systems carry the required documentation and CE marking before entering the EU market.

Extraterritorial reach means companies outside the EU are in scope if they supply AI systems to the EU market or their systems affect people in the EU. This mirrors the approach used in the region’s data protection and digital platform laws.

Timelines and penalties

The ban on unacceptable-risk practices applies first, within months of entry into force. Transparency rules for certain AI, such as chatbots that must disclose they are AI, come next. Obligations for general-purpose models and then high-risk systems phase in over one to three years. The Commission will issue implementing acts and guidance to clarify technical details, and will support sandboxes where startups and researchers can test systems under regulatory supervision.

Non-compliance can be costly. Fines scale with the type of breach and the size of the company, with the highest tier reserved for prohibited practices. National market surveillance authorities will supervise most enforcement. A new AI Office in the Commission coordinates cross-border issues and oversees general-purpose models, supported by a scientific panel and a board of national regulators.

Support and skepticism

Backers call the Act a needed guardrail. They argue that clear rules will build trust and reduce harm, particularly in areas like hiring, credit, and public services, where AI decisions can shape lives. The law also tries to encourage smaller firms by providing sandboxes and lighter documentation for startups in early stages.

Industry voices are watching compliance costs and legal uncertainty. Some developers see risk in broad definitions and evolving standards. They argue that burdens could slow product launches and push research elsewhere if implementation is rigid. Still, many companies have already built internal policies anticipating new rules in Europe and beyond.

Researchers and civil society groups are split. Some welcome bans and transparency, but want clearer limits on biometric surveillance and emotion recognition. Others worry that self-assessment and post-market monitoring will not catch problems early enough. As one benchmark of caution, OpenAI chief executive Sam Altman told U.S. senators in 2023, "If this technology goes wrong, it can go quite wrong." That sentiment continues to shape the debate over guardrails.

Global context

Europe is not alone. The United States issued an Executive Order in late 2023 directing a "safe, secure, and trustworthy" approach to AI and tasking agencies with standards, testing, and sector guidance. The National Institute of Standards and Technology released an AI Risk Management Framework to guide organizations through practical steps. In that document, NIST notes, "AI risk management is a socio-technical challenge," highlighting that technical fixes alone will not solve governance gaps.

The United Kingdom has focused on coordinating research into model safety and hosted global summits. The G7’s Hiroshima process has pushed voluntary codes for advanced systems. Many countries are drafting sector-specific rules for health, finance, and elections. As these regimes mature, companies will face a patchwork, even as standards bodies try to harmonize practices.

What to watch next

• Implementing rules: The Commission plans guidance on high-risk classifications, GPAI technical documentation, and how to calculate systemic risk. Clarifications on biometric exceptions will draw close attention.
• Standards and testing: European standards organizations will translate legal duties into technical specifications. Providers will need to align testing, robustness, and cybersecurity practices with these norms.
• Data and copyright: The Act intersects with EU copyright and data protection law. Expect scrutiny of training data summaries, opt-out mechanisms, and how providers document data governance.
• Enforcement capacity: National regulators are hiring and building AI expertise. Coordination between the AI Office, privacy authorities, and consumer protection bodies will be a test case for complex, cross-border investigations.
• Innovation pathways: Sandboxes and research exemptions will be watched to see if they speed safe experimentation. Startups will look for predictable procedures and clear templates.

The AI Act now moves from text to practice. That shift will decide whether the law’s mix of bans, duties, and support delivers safer systems without stifling progress. The stakes are high. The outcomes will influence not only Europe’s digital market, but also how the rest of the world sets rules for a technology that is still moving fast.