Scope and key definitions

The EU AI Act, Regulation (EU) 2024/1689, is a product-safety-style law for AI. It entered into force on 1 August 2024 and applies in stages. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, changed several dates and some obligations.

What counts as an AI system

Article 3(1): a machine-based system designed to operate with varying levels of autonomy, that may adapt after deployment, and that infers from the input it receives how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments. Inference is the key test; simple rule-based software written entirely by people is outside it.

Who it reaches (Article 2)

• Providers placing AI systems or general-purpose AI models on the EU market or putting them into service in the EU, wherever they are established.
• Deployers established or located in the EU.
• Providers and deployers outside the EU where the system's output is used in the EU.
• Importers, distributors, product manufacturers and authorised representatives.

Like GDPR, it reaches non-EU companies whose AI affects people in the EU.

Main exclusions

• Military, defence and national security uses.
• AI developed and used solely for scientific research and development.
• Research, testing and development before a system is placed on the market (with limits for real-world testing).
• Purely personal, non-professional use by individuals.
• Some free and open-source AI, but not if it is high-risk, prohibited or subject to the transparency duties.

How the Act is organised

Prohibited practices (Article 5), high-risk systems (Chapter III), transparency duties (Article 50), general-purpose AI models (Chapter V), measures for innovation such as sandboxes, governance and enforcement, and penalties (Article 99). Annexes list high-risk areas (Annex III), product laws (Annex I) and the technical documentation contents (Annex IV).