EU AI Act — Regulation (EU) 2024/1689

The EU AI Act (Regulation (EU) 2024/1689) entered into force 1 August 2024 and applies in phases through 2027. It establishes a risk-based regime: prohibited, high-risk, limited-risk, and minimal-risk AI systems, with specific rules for General-Purpose AI (GPAI).

Primary source: Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024. EUR-Lex

Risk Tiers

Tier	Examples	Obligations
Prohibited (Art. 5)	Social scoring, real-time remote biometric ID in public spaces (narrow exceptions), subliminal manipulation, exploitation of vulnerabilities	Ban — cannot be placed on market or put into service
High-Risk (Art. 6, Annex III)	Medical devices, HR/recruitment, credit scoring, critical infrastructure, biometric ID (non-real-time), law enforcement, education, migration	Full conformity assessment — QMS, risk management, data governance, transparency, human oversight, accuracy/robustness, post-market monitoring
GPAI (Art. 51–56)	Foundation models, LLMs, generative AI placed as models	Systemic risk GPAI (Art. 55): model evaluation, adversarial testing, incident reporting, cybersecurity. All GPAI: technical documentation, training data summary, copyright policy
Limited-Risk (Art. 50)	Chatbots, deepfake generators, emotion recognition, biometric categorisation	Transparency — inform users they interact with AI; label synthetic content
Minimal-Risk	Spam filters, recommender systems, games	Voluntary codes of conduct (Art. 95)

High-Risk Categories (Annex III)

Biometrics — remote identification, categorisation, emotion recognition
Critical Infrastructure — road, water, energy, digital traffic management
Education — admission, assessment, monitoring
Employment — recruitment, promotion, termination, monitoring
Essential Services — credit scoring, insurance, public benefits
Law Enforcement — risk assessment, evidence analysis, predictive policing
Migration — asylum, visa, border control
Administration of Justice — legal research, sentencing assistance
Democratic Processes — political persuasion, voting systems

Primary source: Annex III, Regulation (EU) 2024/1689. EUR-Lex Annex III

High-Risk Obligations (Selected)

Requirement	Article	Summary
Risk Management System	Art. 9	Continuous iterative process throughout lifecycle
Data Governance	Art. 10	Training/validation/testing data quality, bias assessment
Technical Documentation	Art. 11	Pre-market documentation per Annex IV
Record-Keeping/Logging	Art. 12	Automatic event logging for traceability
Transparency/Instructions	Art. 13	User instructions for deployers
Human Oversight	Art. 14	Built-in oversight measures; competent human oversight
Accuracy, Robustness, Cybersecurity	Art. 15	Metrics, testing, resilience to attacks
Quality Management System	Art. 17	Documented QMS covering lifecycle
Post-Market Monitoring	Art. 72	Plan, data collection, incident reporting (Art. 73)
Conformity Assessment	Art. 43	Internal control (Annex VI) or Notified Body (Annex VII)

Phased Application Dates

Date	Provisions
1 Aug 2024	Entry into force
2 Feb 2025	Prohibited practices (Art. 5) apply
2 Aug 2025	GPAI obligations (Art. 51–56) apply
2 Aug 2026	High-risk systems (Annex III) — full conformity assessment
2 Aug 2027	High-risk systems already regulated by sectoral law (medical devices, machinery, etc.)

Primary source: Art. 113 (Entry into force and application), Regulation (EU) 2024/1689.

GPAI — Systemic Risk Threshold

A GPAI model is systemic risk if (Art. 51):

Training compute > 10²⁵ FLOPs, OR
Designated by Commission based on capabilities/impact

Systemic-risk GPAI providers must (Art. 55):

Perform model evaluation (including adversarial testing)
Assess and mitigate systemic risks
Report serious incidents to AI Office and national authorities
Ensure cybersecurity protection

Citation

Instrument: Regulation (EU) 2024/1689 (AI Act)
Publisher: European Parliament and Council
Date: 13 June 2024 (published 12 July 2024)
URL: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Status: In force; phased application 2025–2027