EU AI Act is in Force – What Now?
After years of debates and negotiations, the long-awaited EU AI Act finally came into force on 1 August 2024. This legislation with global effect aims to establish a comprehensive framework for the transparent and ethical development and use of AI throughout Europe. So now that the rules are set, what does this mean for all of us?
The scope of the AI Act
As the AI Act is European legislation, some might assume that the AI Act applies solely to market participants within the European Union who provide AI systems to the European market. However, the reality is far from this. The AI Act applies to:
providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the European Union, irrespective of whether those providers are established or located within the Union or in a third country
deployers of AI systems that have their place of establishment or are located within the European Union
providers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the European Union
deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the European Union;
importers and distributors of AI systems
product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark
authorized representatives of providers which are not established in the European Union.
Application of AI Act
AI Act shall apply from 2 August 2026, however, some of the Chapters and Articles shall become applicable earlier or even later:
From 2 February 2025: Chapter I („General provisions“) and Chapter II („Prohibited AI practices“) shall apply
From 2 August 2025: Chapter III Section 4 (“Notifying authorities and notified bodies“), Chapter V (“General-purpose AI models”), Chapter VII (“Governance”), Chapter XII (“Penalties”) except article 101 (“Fines for providers of general-purpose AI models”), and article 78 (“Confidentiality”) shall apply
From 2 August 2027: Article 6 (1) (“Classification rules for high-risk AI systems”) and the corresponding obligations in the AI Act shall apply.
The rationale behind this timeline is explained in recital 179 of the AI Act: “This Regulation should apply from 2 August 2026. However, taking into account the unacceptable risk associated with the use of AI in certain ways, the prohibitions as well as the general provisions of this Regulation should already apply from 2 February 2025. While the full effect of those prohibitions follows with the establishment of the governance and enforcement of this Regulation, anticipating the application of the prohibitions is important to take account of unacceptable risks and to have an effect on other procedures, such as in civil law. Moreover, the infrastructure related to the governance and the conformity assessment system should be operational before 2 August 2026, therefore the provisions on notified bodies and governance structure should apply from 2 August 2025. Given the rapid pace of technological advancements and adoption of general-purpose AI models, obligations for providers of general-purpose AI models should apply from 2 August 2025. Codes of practice should be ready by 2 May 2025 in view of enabling providers to demonstrate compliance on time. The AI Office should ensure that classification rules and procedures are up to date in light of technological developments. In addition, Member States should lay down and notify to the Commission the rules on penalties, including administrative fines, and ensure that they are properly and effectively implemented by the date of application of this Regulation. Therefore the provisions on penalties should apply from 2 August 2025.”
Grace period
Under Article 111 of the AI Act, the grace period is granted to certain AI systems and operators:
Without prejudice to the application of Article 5 (“Prohibited AI practices”) as referred to in Article 113(3), point (a), AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X (e.g., Schengen Information System, Visa Information System, etc.) that have been placed on the market or put into service before 2 August 2027 shall be brought into compliance with AI Act by 31 December 2030
Without prejudice to the application of Article 5 (“Prohibited AI practices”) as referred to in Article 113 (3), point (a), the AI Act shall apply to operators of high-risk AI systems, other than the systems listed in Annex X, that have been placed on the market or put into service before 2 August 2026, only if, as from that date, those systems are subject to significant changes in their designs. In any case, the providers and deployers of high-risk AI systems intended to be used by public authorities shall take the necessary steps to comply with the requirements and obligations of the AI Act by 2 August 2030
Providers of general-purpose AI models that have been placed on the market before 2 August 2025 shall take the necessary steps in order to comply with the obligations laid down in this Regulation by 2 August 2027.
Preparation at the EU level
- EU AI Pact -
Recently, more than a hundred companies - including multinational giants such as Google, Microsoft, Amazon, OpenAI, and Cisco, as well as European small and medium enterprises —signed the EU AI Pact, an initiative promoted by the European Commission. EU AI Pact supports the industry's voluntary commitments to start applying the principles of the AI Act before it enters into application.
Core voluntary commitments:
Adopting AI governance strategy
High-risk AI systems mapping
Promoting AI literacy and awareness among staff
- AI Office -
AI Office is the center of AI expertise across the European Union. It was established within the European Commission on 21 February 2024. AI Office shall play a key role in implementing the AI Act, especially for general-purpose AI.
AI Office already started drafting the first General-Purpose AI Code of Practice. To achieve this goal, the AI Office invited eligible general-purpose AI model providers, downstream providers, industry organizations, academia, and other independent experts to express their interest in contributing to the drafting of the code. This code aims to facilitate the proper application of the rules of the AI Act for general-purpose AI models. AI Office is expected to complete this code by April 2025.
In addition, the AI Office started the preparation of guidelines on the definition of AI systems and the prohibitions, both due six months after the entry into force of the AI Act.
- AI Board -
Established under Article 65 of the AI Act, the AI Board consists of one representative from each Member State. The AI Board provides advice and assistance to the European Commission and Member States to ensure the consistent and effective implementation of the AI Act.
On 10 September 2024, the European Commission hosted the first official meeting of the AI Board. The participants of the meeting focused on these matters:
- the establishment of the AI Board's organization and adoption of its rules of procedure
- an update and strategic discussion on EU AI policy, including the GenAI4EU initiative and international AI activities
- a progress update and discussion on the first deliverables of the European Commission related to the AI Act's implementation
- an exchange of best practices for national approaches to AI governance and AI Act implementation.
- European Data Protection Supervisor -
Under the AI Act European Data Protection Supervisor („EDPS“) will act as a notified body and market surveillance authority to assess the compliance of high-risk AI systems that are developed or deployed by EU institutions, bodies, offices, and agencies („EUIs“). EDPS will also take on the role of the competent authority for the supervision of the provision or use of AI systems by EUIs.
On 17 September 2024, EDPS hosted a preparatory meeting to discuss the role and responsibilities of future AI Act correspondents from EU institutions. This meeting will be followed by the first official gathering of the AI Act Correspondent Network in January.
Next Steps
Now that the AI Act is in effect, the focus must shift from observation to action. Businesses should start assessing the applicability of the AI Act to their operations and adjust their practices accordingly. The transitional period gives time for all of us to prepare and adapt for a new age of AI regulation in Europe before penalties start to apply.