EU AI Act published and in force on 1 August 2024

The EU's AI Act has been published in the Official Journal and will come into force on 1 August 2024 with compliance phased in over a three-year period. Hailed by the EU as a global first, the AI Act is the most comprehensive attempt to regulate the use of AI to date. It takes a risk-based approach to AI, aiming to strike a balance between innovation and regulation while protecting fundamental rights.

What is covered?

• The AI Act covers all AI systems placed on the EU market, whether or not by an EU business (subject to limited exceptions).
• Certain systems considered to present an unacceptable risk are prohibited, for example, those that manipulate decisions, exploit vulnerabilities or evaluate social behaviour.
• The majority of obligations apply to designated high-risk systems that could significantly affect people's safety or fundamental rights.
• Specific rules apply to general-purpose AI models with additional obligations on GPAIs posing systemic risks.

Who is impacted?

The main obligations apply to providers and deployers of AI systems (subject to limited exceptions). However, importers, distributors, and product manufacturers are also caught.

What are the obligations?
Those in scope will have to comply with a wide range of safety and governance duties which, depending on the nature of the AI system and the role of the business, may include transparency requirements, incident reporting, risk management, compliance and monitoring, and documentation and record keeping, to name a few.

Are there fines for getting it wrong?

The AI Act imposes penalties for non-compliance of up to €35 million or 7% of annual global turnover for prohibited AI practices, up to €20 million or 4% for high-risk system violations, and fines of up to €7.5 million or 1.5% for providing incorrect or misleading information. Smaller penalties apply to SMEs.

Timeline for compliance
The AI Act comes into force on 1 August 2024 and will be brought in largely over a three-year period with rules applying to prohibited systems applying at six months, to GPAIs at 12 months, to high-risk systems under Annex III at 24 months, and to high-risk systems that are products or safety components of products covered by legislation set out in Annex I, at 36 months.  

Find out more

• See our summary of the AI Act to find out more about who is caught and what they will need to do to comply.
• Listen to Tech Me Up! - our AI webinar series.
• Read our insights on the AI Act and other AI-related developments.
• Contact our international team of experts for advice on AI.