High-level summary of the AI Act

Updated on 31 August 2026 in accordance with the amendments to the AI Act adopted as part of the Digital Omnibus on AI.

In this article we provide you with a high-level summary of the AI Act, selecting the parts which are most likely to be relevant to you regardless of who you are. We provide links to the original document where relevant so that you can always reference the Act text.

To explore the full text of the AI Act yourself, use our AI Act Explorer. Alternatively, if you want to know which parts of the text are most relevant to you, use our Compliance Checker.

Prohibited AI systems (Chapter II, Art. 5)

The following types of AI system are ‘Prohibited’ according to the AI Act.

AI systems:

• deploying subliminal, manipulative, or deceptive techniques with the objective, or the effect of  distorting behaviour by impairing informed decision-making, causing or reasonably like to cause significant harm.
• exploiting vulnerabilities related to age, disability, or socio-economic circumstances with the objective, or the effect of distorting behaviour, causing or reasonably likely to cause significant harm.
• biometric categorisation systems inferring sensitive attributes (race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation), except labelling or filtering of lawfully acquired biometric datasets or when law enforcement categorises biometric data.
• generating non-consensual intimate imagery and child sexual abuse material (CSAM)
• social scoring, i.e., evaluating or classifying individuals or groups based on social behaviour or personal traits, causing detrimental or unfavourable treatment of those people in social contexts unrelated to that of the data collection and/or where the effect is disproportionate.
• assessing the risk of an individual committing criminal offenses solely based on profiling or personality traits, except when used to augment human assessments based on objective, verifiable facts directly linked to criminal activity.
• compiling facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage.
• inferring emotions in workplaces or educational institutions, except for medical or safety reasons.
• ‘real-time’ remote biometric identification (RBI) in publicly accessible spaces for law enforcement, except when:

• searching for missing persons, abduction victims, and people who have been human trafficked or sexually exploited;
• preventing substantial and imminent threat to the life or physical safety of natural persons, or a foreseeable terrorist attack; or
• identifying suspects in serious crimes (e.g., murder, rape, armed robbery, illicit narcotics and weapons trafficking, organised crime, and environmental crime, etc.).

Notes on real-time remote biometric identification:

Using AI-enabled real-time RBI is only allowed to be deployed to confirm the identity of the specifically targeted individual and must account for the harm caused by not using the system, and the affected persons’ rights and freedoms.

Before deployment, police must complete a fundamental rights impact assessment and register the system in the EU database, though, in duly justified cases of urgency, deployment can commence without registration, provided that it is registered later without undue delay.

Before deployment, they also must obtain authorisation from a judicial authority or independent administrative authority[1], though, in duly justified cases of urgency, deployment can commence without authorisation, provided that authorisation is requested without undue delay and in any case within 24 hours. If authorisation is rejected, deployment must cease immediately, deleting all data, results, and outputs.

↲ [1] Independent administrative authorities may be subject to greater political influence than judicial authorities (Hacker, 2024).

High-Risk AI systems (Chapter III)

Some AI systems are considered ‘high-risk’ under the AI Act. Providers of those systems will be subject to additional requirements.

Classification rules for high-risk AI systems (Art. 6)

High-risk AI systems are those:

• used as a safety component or a product covered by EU laws in Annex I AND required to undergo a third-party conformity assessment under those Annex I laws; OR
• listed under Annex III use cases (below), except if:
  • the AI system performs a narrow procedural task;
  • improves the result of a previously completed human activity;
  • detects decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment without proper human review; or
  • performs a preparatory task to an assessment relevant for the purpose of the use cases listed in Annex III.
• AI systems listed under Annex III are always considered high-risk if it profiles individuals, i.e. automated processing of personal data to assess various aspects of a person’s life, such as work performance, economic situation, health, preferences, interests, reliability, behaviour, location or movement.
• Providers whose AI system falls under the use cases in Annex III but believes it is not high-risk must document such an assessment before placing it on the market or putting it into service.

Requirements for providers of high-risk AI systems (Arts. 8–21)

High-risk AI providers must:

• Establish a risk management system throughout the high-risk AI system’s lifecycle.
• Conduct data governance, ensuring that training, validation and testing datasets are relevant, sufficiently representative and, to the best extent possible, free of errors and complete according to the intended purpose.
• Draw up technical documentation to demonstrate compliance and provide authorities with the information to assess that compliance, and keep it alongside the documentation concerning the changes approved by notified bodies as well as any decisions by them, and the EU declaration of conformity. 
• Design their high-risk AI system for record-keeping (logging) throughout the system’s lifecycle to enable it to automatically record events relevant for identifying a risk to health or safety, or to fundamental rights by the AI system, a substantial modification of the AI system, facilitating post-market monitoring, and monitoring the operation of high-risk AI systems. When under their control, the provider must keep the logs.
• Provide instructions for use to deployers to enable the latter’s compliance.
• Design their high-risk AI system to allow deployers to implement human oversight.
• Design their high-risk AI system to achieve appropriate levels of accuracy, robustness, and cybersecurity.
• Establish a quality management system to ensure compliance and keep the documentation relating to it.
• Subject their high-risk AI system to the relevant conformity assessment, draw up an EU declaration of conformity, and attach the CE marking to the system. On request, demonstrate conformity of their system with the Act. If it is no longer in conformity, take necessary corrective actions.
• Register their high-risk AI system in the EU database for high-risk AI systems.
• Make sure that their high-risk AI system complies with accessibility requirements.

General-Purpose AI (GPAI)

GPAI model means an AI model, including when trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable to competently perform a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications. This does not cover AI models that are used before placement on the market for research, development and prototyping activities.

GPAI system means an AI system which is based on a general-purpose AI model, that has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems.

GPAI systems may be used as high-risk AI systems or integrated into them. GPAI system providers should cooperate with such high-risk AI system providers to enable the latter’s compliance.

All providers of GPAI models must:

• Draw up technical documentation, including training and testing process and evaluation results.
• Draw up information and documentation to supply to downstream providers that intend to integrate the GPAI model into their own AI system in order that the latter understands capabilities and limitations and can comply with the Act.
• Establish a policy to comply with the Copyright Directive.
• Publish a sufficiently detailed summary about the content used for training the GPAI model.

Free and open-source licence GPAI models – whose parameters, including weights, information on model architecture and model usage are publicly available, allowing for access, usage, modification and distribution of the model – only have to comply with the latter two obligations above, unless the free and open-source licence GPAI model is a GPAI model with systemic risk.

GPAI models present systemic risks when the cumulative amount of compute used for its training is greater than 10^25 floating point operations (FLOPs). Providers must notify the Commission if their model meets this criterion without delay and in any case within 2 weeks. The provider may present arguments that, despite meeting the criteria, their model does not present systemic risks. The Commission may also decide on its own, or following a qualified alert from the scientific panel of independent experts, that a model presents a systemic risk, despite not reaching the compute threshold.

In addition to the four obligations above, providers of GPAI models with systemic risk must also:

• Perform model evaluations, including conducting and documenting adversarial testing to identify and mitigate systemic risk.
• Assess and mitigate possible systemic risks, including their sources.
• Track, document and report serious incidents and possible corrective measures to the AI Office and relevant national competent authorities without undue delay.
• Ensure an adequate level of cybersecurity protection.

All GPAI model providers may demonstrate compliance with their obligations if they voluntarily adhere to the General-Purpose Code of Practice until European harmonised standards are published. Providers that don’t adhere to the Code of Practice must demonstrate alternative adequate means of compliance.

The General-Purpose Code of Practice

• Voluntary tool developed in a multi-stakeholder process which GPAI model providers may use to demonstrate compliance with the AI Act’s relevant obligations. 
• Published on 10 July 2025 and declared adequate by the European Commission and the AI Board on 1 August 2025. 
• The Code of Practice contains three chapters, namely on Transparency, Copyright and Safety and Security, covering the obligations of all GPAI model providers, as well as the obligations solely applicable to the providers of GPAI models with systemic risk.
• More than 20 providers have signed up to the Code of Practice as of August 2026. 
• Alongside the Code of Practice, providers are also guided by the Commission Guidelines on on the scope of obligations for providers of general-purpose AI models under the AI Act.

Governance

How will the AI Act be implemented?

• The AI Office, sitting within the Commission, monitors the effective implementation and compliance of GPAI model providers, as well as providers of AI systems built on a GPAI model developed by the same provider (unless an exception applies), and AI systems that constitute or that are integrated into a very large online platform or very large online search engine under the Digital Services Act (DSA).
• Downstream providers can lodge a complaint regarding the upstream (GPAI model) providers’ infringement of the AI Act to the AI Office.
• The AI Office may conduct evaluations of the GPAI model to:
  • assess compliance where the information gathered under its powers to request information is insufficient
  • investigate systemic risks, particularly following a qualified alert from the scientific panel of independent experts.

Timelines

• After the AI Act entered into force on 1 August 2024, the application of the Act’s provisions has been and is continued to be rolled out gradually.
• Most prohibitions of AI systems have been applicable since 2 February 2025, with prohibitions on AI systems generating non-consensual intimate imagery and child sexual abuse material (CSAM) coming into play on 2 December 2026. 
• GPAI model obligations kicked in on 2 August 2025. The General-Purpose Code of Practice was declared adequate on 1 August 2025. 
• AI Office’s supervision and enforcement powers can be exercised from 2 August 2026.
• The transparency obligations under Article 50 apply from 2 August 2026. There is a grace period for AI systems placed on the market before this date, which have time to comply with Article 50(2) by 2 December 2026. 
• The obligations for AI systems that are high-risk under Article 6(2) and Annex III AI Act will become applicable on 2 December 2027.
• The obligations for AI systems that are high-risk under Article 6(1) and Annex I AI Act will come into play on 2 August 2028.

See our full implementation timeline for all key milestones relating to the implementation of the AI Act.