Regulating the technology

The EU AI Act and its new timetable

The EU’s AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024, although its duties did not all begin on that day. Article 113 sets a general date of application and then lists the parts that apply earlier or later, so whether the AI Act binds a client today depends on which of its parts is in question.

The earliest parts to apply, from 2 February 2025, were the AI Act’s general provisions and its list of prohibited practices, the uses of AI that it forbids, some of them subject to narrow exceptions. The general provisions include Article 4 on AI literacy, a duty that falls on providers and deployers. Providers are the people, businesses and public bodies that develop an AI system, or have one developed, and place it on the market or put it into service under their own name or trademark, whether for payment or free of charge; deployers are those that use an AI system under their authority in their work.

The duties of providers of general-purpose AI models applied next, from 2 August 2025, together with most of the AI Act’s rules on governance and penalties. The word model means the trained core of an AI product, a large file of numbers that training adjusts until its answers improve, and a general-purpose model is one trained to perform a wide range of tasks, such as the models behind chat assistants. The general date of application, 2 August 2026, brought in most of the rest, including the transparency duties in Article 50. The same date brought in the Commission’s power under Article 101 to fine the providers of general-purpose models, a year after their duties began, since Article 113 held that power back.

The Digital Omnibus on AI, Regulation (EU) 2026/1744, an amending regulation adopted on 8 July 2026 to simplify the implementation of the AI Act, entered into force on 27 July 2026 and changed several of these dates. Among its other changes, the Omnibus rewrote Article 4 as a duty to take measures to support the AI literacy of staff and others who operate or use AI systems on the provider’s or deployer’s behalf, adding that the duty does not require them to guarantee a specific level of literacy in any individual. Recital 8 of the Omnibus explains that the earlier wording obliged providers and deployers to ensure their staff’s AI literacy, an obligation that in the recital’s words creates an additional compliance burden, particularly for smaller enterprises.

High-risk systems are the category of AI systems that the AI Act subjects to its most detailed requirements, and the Omnibus postponed the dates from which those requirements apply. Under Article 113 as amended, the requirements apply from 2 December 2027 to the uses listed in Annex III, such as credit scoring, the pricing of life and health insurance and recruitment. For AI systems that are high-risk because of their place in products covered by the EU product-safety laws listed in Annex I, such as toys, lifts and medical devices, the date is 2 August 2028.

A high-risk system already placed on the market or put into service before its new date is treated more gently: Article 111(2), as amended, applies the requirements to it only if its design changes significantly after that date. Systems intended for use by public authorities are the exception, since their providers and deployers have to comply by 2 August 2030 whether or not the design changes.

Recital 40 of the Omnibus gives its reasons for the delay: the standards, common specifications and guidance that providers were to rely on had arrived late, as had the national authorities that are to enforce the AI Act. Harmonised standards are technical standards that European standards bodies draw up at the Commission’s request, and they turn general requirements such as accuracy and robustness, a system’s ability to keep working properly despite errors or unexpected inputs, into tests a provider can run on a trained model. Under Article 40, a high-risk system that follows a harmonised standard whose reference is published in the Official Journal is presumed to meet the requirements that the standard covers, and Article 41 gives the same effect to common specifications, technical rules the Commission can adopt itself where standards are missing. Until standards or common specifications exist, providers have to show compliance without that presumption, so their late arrival, with that of the national authorities, led in the words of the recital to challenges that “jeopardise the effective entry into application” of the high-risk obligations.

The Omnibus also added two prohibitions, on intimate images made without consent and on child sexual abuse material, which apply from 2 December 2026. Article 5(1)(ba) bans placing on the market, putting into service or using an AI system that generates or manipulates realistic images, video, audio or similar material showing an identifiable person’s intimate parts or that person engaged in sexually explicit activity. The ban applies where the material is made without that person’s freely given, specific, informed, unambiguous and explicit consent to that generation or manipulation. Article 5(1b) adds that altering material without increasing the exposure of intimate parts or changing the sexual activity depicted is not manipulation.

Point (bb) of the same paragraph bans systems that generate or manipulate child sexual abuse material, as Directive 2011/93/EU defines it, except where national law provides a ‘without right’ defence, which under recital 17 of that directive can cover conduct under lawful authority or with a medical, scientific or similar purpose. Recital 13 of the Omnibus says that the defence includes legitimate work by public authorities against crime and the testing of a system to check that it complies with the ban.

Article 5(1a) limits both new bans as they apply to providers. Under it, a provider breaches them by placing a system on the market or putting it into service only where generating or manipulating such material is the system’s intended purpose, or where its design makes that a reasonably foreseeable and reproducible outcome, one that users can bring about again and again, without significant technical modification. In that second case the ban applies only where the system lacks reasonable and adequate safeguards. Article 5(1a) asks the safeguards to do two jobs: reliably prevent the outcome, taking account of foreseeable misuse, and correct misuse once it is observed or reported. A deployer, for its part, breaches the bans only by using a system for the purpose of generating or manipulating that material.

Article 50 kept its start of 2 August 2026, with a grace period for marking, which means attaching to generated content a machine-readable sign that it was artificially generated or manipulated, such as a watermark. Generative systems that produce synthetic audio, images, video or text and were already on the market before that date benefit from Article 111(4), which the Omnibus added: their providers have until 2 December 2026 to mark the outputs as Article 50(2) requires. General-purpose models already on the market before 2 August 2025 have a longer period: under Article 111(3), their providers have until 2 August 2027 to comply.

Definitions and risk tiers

Whether the AI Act applies at all depends first on its definition of an AI system in Article 3(1): a machine-based system that “infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions”. Inference here means that the system works out its output from what it is given, by applying patterns it learned from examples or by reasoning from knowledge that people have encoded, as What AI is, and what it is not, a Beginner module, explains.

In its guidelines on the definition of an AI system, which it says are not binding, the Commission reads the definition to include expert systems that reason from rules and facts set down by specialists, since those systems draw conclusions by logical inference, applying their rules to new situations. On the Commission’s reading the definition leaves out basic data processing, such as a database query or an ordinary spreadsheet, meaning software that follows fixed instructions programmed by people without using logical inference or machine learning, the technique by which software learns patterns from examples. A screening tool whose engineers wrote out each rule and its result one by one would therefore probably fall outside the definition on that reading, unless it reasons from its rules by logical inference as an expert system does.

By contrast, a tool trained on past decisions would probably fall within the definition. On the Commission’s reading it falls outside if its performance could be achieved by a basic statistical rule, such as predicting the average of past results every time, or if it merely approximates a long-established method such as linear or logistic regression, standard statistical techniques that fit a simple formula to past data. The scope of those carve-outs is uncertain, and the Commission’s guidelines are not binding.

Models are treated separately from systems, since the AI system is the working product built around a model, such as a chat assistant, while the model is the trained core inside it. Under Article 3(63), a model is general-purpose where it “displays significant generality” and can competently perform a wide range of distinct tasks, whatever the way it is placed on the market, and where it can be built into a variety of downstream systems. Models used only for research, development or prototyping before they are placed on the market are excluded.

The Commission’s guidelines on general-purpose AI models give an indicative criterion based on training compute, the amount of calculation used to train a model, counted in floating-point operations, as How a model learns, an Intermediate module, explains. Article 3(67) defines a floating-point operation as any mathematical operation or assignment involving floating-point numbers, the form in which computers store numbers with fractional parts; an assignment, in computing, is the storing of a value in the computer’s memory. On that criterion, a model is likely to be general-purpose if its training used more than 10²³ floating-point operations, a one followed by 23 zeros, and it can generate language, or can generate images or video from text. That figure, on the Commission’s account, matches the compute typically used to train a model of about one billion parameters, the numbers a model adjusts as it learns, on a large amount of data. The guidelines add that a model meeting the criterion is not general-purpose if, exceptionally, it lacks significant generality, and that one falling short of it may still be general-purpose.

Most of the AI Act’s duties attach to AI systems according to their use, in tiers of decreasing severity, while its Chapter V sets separate duties for general-purpose models whatever they end up being used for. At the top of the scale, Article 5 bans practices such as deploying subliminal techniques, or purposefully manipulative or deceptive techniques, that materially distort people’s behaviour by appreciably impairing their ability to make an informed decision, in a way that causes, or is reasonably likely to cause, significant harm. Its list also includes social scoring, the evaluation or classification of people or groups over time on their social behaviour or on personal characteristics that are known, inferred or predicted. The ban applies where the score leads to detrimental treatment in contexts unrelated to those in which the data was collected, or to detrimental treatment that is unjustified or disproportionate to the behaviour scored or its gravity. Creating or expanding facial recognition databases through the untargeted scraping of facial images, meaning their indiscriminate automated collection from the internet or from CCTV footage, is banned as well. The Commission published guidelines on the prohibited practices on 4 February 2025 and describes them as non-binding, with authoritative interpretation reserved to the Court of Justice.

High-risk status comes from Article 6, in one of two ways: either the system is a safety component of a product, or is itself a product, that an EU product-safety law in Annex I subjects to a third-party conformity assessment, or its use appears in Annex III. The Omnibus narrowed the first route by adding paragraphs 1a to 1c to Article 6: a system used solely for purposes unrelated to safety, such as user assistance or performance optimisation, is not a safety component unless its failure would endanger health and safety. A product that needs a third-party assessment only for risks other than to health and safety does not meet the first route’s conditions either. Annex III lists, among other uses, systems intended to evaluate people’s creditworthiness or set their credit score, other than for detecting financial fraud, systems for risk assessment and pricing in life and health insurance, and systems for recruiting and selecting staff, such as those that filter job applications.

Article 6(3) makes an exception for an Annex III system that does not pose a significant risk of harm to people’s health, safety or rights, including by not materially influencing the outcome of decision-making. The exception applies only where one of the conditions listed in Article 6(3) is met, such as that the system performs only a narrow procedural task or a task preparatory to an assessment. Whatever the conditions, a system that profiles individuals stays high-risk in every case. Any provider relying on the exception has to document its assessment before placing the system on the market or putting it into service, and give the documentation to national authorities on request, under Article 6(4); Article 49(2) also requires it to register itself and the system in the EU database that the Commission keeps under Article 71, most of which is open to the public.

The requirements for high-risk systems follow the life of a trained model, from the data it learns from to its behaviour once in use. Article 10 governs the data used at three stages: training the model, checking and adjusting it during training, a step called validation, and testing it before release. Article 10 also requires that data to be examined for possible biases. Article 12 requires the system to allow the automatic recording of events in logs over its lifetime, and Article 15 requires an appropriate level of accuracy, robustness and cybersecurity throughout the system’s life.

Article 15 names vulnerabilities specific to AI that a provider’s technical solutions should address, among them data poisoning, in which an attacker tampers with the training data, and adversarial examples, inputs designed to cause a model to make a mistake. Some systems also continue to learn after release, updating themselves from the data they meet in use, so a biased output can come back as part of that data and push later outputs further the same way, a loop that can reinforce a bias. Article 15 requires that such systems be developed so as to eliminate or reduce as far as possible the risk that possibly biased outputs influence the input for future operations, and any such loop has to be addressed with appropriate mitigation measures.

Transparency duties form the lightest tier: under Article 50, the provider of a system intended to interact directly with people, such as a chatbot, has to design it so that they are told they are interacting with an AI system, unless that is obvious to a reasonably well-informed person. Article 50 also requires providers of generative systems to mark their outputs as machine-made and requires deployers to disclose deepfakes, duties that Open weights, images and provenance, an Advanced module, explains in detail.

General-purpose models

Article 53(1) requires every provider of a general-purpose model to keep technical documentation to give on request to national authorities and to the AI Office, the part of the European Commission that supervises these models. The provider also has to give the businesses that build the model into their own systems the information they need to understand it and meet their own duties. The same paragraph requires a policy to comply with EU copyright law, including the reservations of rights by which rightholders opt out of text and data mining, and a public summary of the content used to train the model, written on a template from the AI Office.

Article 53(2) lifts the two documentation duties, the technical documentation and the information for businesses that build on the model, for models released under a free and open-source licence where the model’s parameters, including its weights, and the information on its architecture and use are published. The weights make up most of a model’s parameters, the numbers it adjusts as it learns, and its architecture is the design that sets how those numbers are arranged and combined to produce an answer. The providers of such models still owe the copyright policy and the training summary, as Open weights, images and provenance, an Advanced module, explains, and the copyright duty is taken further in Training data and copyright, an Advanced module.

Systemic risk is the AI Act’s term, in Article 3(65), for a risk specific to the high-impact capabilities of general-purpose models that could have a significant effect on the EU market or on public health, safety, security, people’s rights or society, and could spread at scale. Article 51 classes a model as having systemic risk where it has high-impact capabilities, meaning capabilities that match or exceed those of the most advanced models, or where the Commission designates it on the criteria in Annex XIII.

Under Article 51(2), a model is presumed to have high-impact capabilities when the compute used to train it exceeded 10²⁵ floating-point operations, a hundred times the Commission’s indicative figure for a general-purpose model. Its provider has to notify the Commission under Article 52 without delay, and at the latest within two weeks of meeting that threshold or of learning that it will. The provider may argue in the notification that, exceptionally, the model does not present systemic risk because of its specific characteristics. Article 51(3) lets the Commission change the threshold by delegated act as the technology develops.

Providers of models with systemic risk lose the open-source relief in Article 53(2) and owe more under Article 55: they evaluate the model with standardised protocols, including adversarial testing in which testers deliberately try to make it misbehave, and assess and mitigate systemic risks at Union level. Article 55 also requires them to track and report serious incidents to the AI Office without undue delay and to ensure adequate cybersecurity for the model and its physical infrastructure, duties that Looking inside and testing, an Advanced module, places in the practice of safety testing.

Providers can show that they meet Articles 53 and 55 by relying on a code of practice until a harmonised standard is published. The General-Purpose AI Code of Practice, published on 10 July 2025 with chapters on transparency, copyright and safety and security, is the code that the Commission and the AI Board have confirmed as an adequate voluntary tool for that purpose. Its signatories on the Commission’s list, as read on 29 October 2026, include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI; xAI signed only the chapter on safety and security, so it has to show compliance with the transparency and copyright duties by other adequate means, and Meta does not appear on the list.

The Commission enforces the duties of providers of general-purpose models itself, through the AI Office, under Article 88. From 2 August 2026, under Article 101, it can fine a provider up to 3 per cent of its worldwide annual turnover in the preceding financial year or €15 million, whichever is higher. The Commission has to find that the provider, intentionally or negligently, breached the AI Act’s relevant provisions, failed to comply with a request for documents or information or supplied incorrect, incomplete or misleading information, failed to take a measure the Commission requested, or failed to give it access to the model for an evaluation. The Commission’s guidelines on general-purpose models explain that the duties have applied since August 2025 although the Commission’s enforcement powers, the power to fine among them, began a year later, and say that from 2 August 2026 the Commission will enforce with fines against providers that are not fully compliant.

The AI Office also supervises some AI systems directly: Article 75(1), as the Omnibus amended it, gives it exclusive competence to supervise and enforce the AI Act for AI systems based on a general-purpose model where the same provider, or providers forming part of the same undertaking, developed both the model and the system. One example is a chat assistant offered by the developer of its model, although that head of competence excepts, among others, systems in products covered by Annex I and high-risk systems that financial institutions regulated by EU financial services law place on the market, put into service or use in direct connection with those services. Article 75(1) also gives the AI Office exclusive competence for systems that form part of the very large online platforms and search engines designated under the Digital Services Act. In both cases the competence extends to the providers of those systems, and to deployers only where they are the provider or part of the same undertaking. Recital 31 of the Omnibus says that other deployers remain subject to national supervision and enforcement.

Breaches outside the AI Office’s competence are punished by the Member States, which under Article 99 set the penalties within caps that the AI Act fixes. For a prohibited practice the cap is €35 million or 7 per cent of worldwide annual turnover, whichever is higher; for breaches of the duties of providers, deployers, importers and distributors of high-risk systems, and of the transparency duties in Article 50, it is €15 million or 3 per cent; for supplying incorrect, incomplete or misleading information to authorities in reply to a request it is €7.5 million or 1 per cent. Small and medium-sized enterprises face whichever of the two figures is lower. The Omnibus extended that treatment, for all but the fines for prohibited practices, to small mid-cap enterprises. A Commission recommendation of 2025 defines these as businesses too large to count as small or medium-sized but with fewer than 750 staff and turnover of up to €150 million or a balance sheet of up to €129 million. For the systems within its competence under Article 75(1), the AI Office may itself impose fines within the same caps, under Article 75c.

Liability in the EU

The AI Act is enforced by authorities through orders and fines, and a person harmed by an AI system who wants compensation looks to the law of civil liability. In 2022 the Commission proposed an AI Liability Directive, which would have adapted non-contractual civil liability rules to AI. Its withdrawal was published in the Official Journal on 6 October 2025, in a list of proposals whose withdrawal the Commission had approved at its meeting of 16 July 2025, and the notice gives the reasons by reference to a Commission document of 11 February 2025.

The EU instrument most likely to govern a claim for harm caused by defective AI is therefore the new Product Liability Directive, Directive (EU) 2024/2853, which replaces the product liability directive of 1985. Rights under national rules on contractual liability, and on non-contractual liability on grounds other than a product’s defectiveness, such as fault, remain available beside it, since Article 2(4) leaves them unaffected. Member States have until 9 December 2026 to bring the Product Liability Directive into their national law under Article 22. Under Article 2(1), as a corrigendum published in the Official Journal on 7 May 2026 corrected it, the Directive applies to products placed on the market or put into service after 8 December 2026, in other words from 9 December 2026 onwards. Article 21 repeals the 1985 directive with effect from 9 December 2026 but keeps it applying to products placed on the market or put into service before that date.

The Product Liability Directive makes the manufacturer of a defective product liable for the damage the product causes without the injured person having to prove fault: under Article 10(1), the claimant proves that the product was defective, the damage suffered and the causal link between them. Compensation is available under Article 6(1) for death, personal injury including medically recognised harm to psychological health, damage to property, and the destruction or corruption of data not used for professional purposes. Property damage excludes three kinds of property: the defective product itself; a product damaged by a defective component that was built into it or connected to it by the product’s own manufacturer or under that manufacturer’s control; and property used only for professional purposes. Article 5 gives the right to compensation to natural persons, so the Directive does not compensate a company for its own losses.

Article 4(1) defines a product to include software, and recital 13 names AI systems among its examples of software. The recital adds that software is a product whether it is stored on a device, accessed through a network or cloud technologies, or supplied as a service, and that a provider of an AI system within the meaning of the AI Act should be treated as a manufacturer. The same recital says that information as such is not a product, and Article 2(2) leaves out free and open-source software developed or supplied outside the course of a commercial activity.

Defectiveness is measured, under Article 7(1), by whether the product provides the safety that a person is entitled to expect or that EU or national law requires. The circumstances a court weighs include, in Article 7(2)(c), the effect on the product of any ability to continue to learn or acquire new features after it is placed on the market, which brings a model that keeps learning after release within the test.

Proof of defect and causation is eased where technical complexity makes them hard to show, through the Product Liability Directive’s provisions on disclosure and on presumptions. Article 9 lets a court order the defendant to disclose relevant evidence once the claimant has presented facts and evidence enough to make the claim plausible, limited to what is necessary and proportionate and with protection for trade secrets. Article 10(2) presumes a product defective where the defendant fails to disclose that evidence, where the product breaches mandatory safety requirements meant to protect against the harm suffered, or where an obvious malfunction caused the damage during reasonably foreseeable use or under ordinary circumstances. Article 10(3) then presumes the causal link where the product is defective and the damage is of a kind typically consistent with that defect.

Article 10(4) goes further for complex cases: a court presumes defect, causation or both where the claimant faces excessive difficulties in proving them, in particular because of technical or scientific complexity, and shows that they are likely. The defendant can rebut each presumption under Article 10(5), so the presumptions shift the work of proof without deciding the result.

Software updates are where the Product Liability Directive bears most directly on AI providers. Article 11 lets a manufacturer escape liability by proving that the defect probably did not exist when the product was placed on the market. Article 11(2) withholds that defence where, among other cases, the defect is due to software, including updates and upgrades, or to the lack of an update needed to keep the product safe, so long as these are within the manufacturer’s control. Article 4(5) defines that control to include the manufacturer’s ability to supply software updates, itself or through a third party.

Article 8(2) treats a person who substantially modifies a product outside the manufacturer’s control, and then makes it available or puts it into service, as a manufacturer of that product. Article 8(2) may therefore catch a business that retrains another developer’s model, where the change counts as a substantial modification under Article 4(18), broadly one that alters the model’s performance, purpose or type in a way its developer’s risk assessment did not foresee and changes or increases the risk it presents. Recital 40 of the Product Liability Directive adds that a substantial modification can come from a software update or from the continuous learning of an AI system, and that the modified product then counts as made available on the market or put into service when the change is made. Under Article 17(1), such a substantial modification, including one made by an update, also restarts the ten-year period after which the right to compensation expires. A provider’s practice on model versions, updates and patches is therefore part of its exposure to liability under the Product Liability Directive, a subject taken further in Liability, agents and professional duty, an Advanced module.

The United Kingdom

The United Kingdom had not passed a statute comparable to the AI Act by 29 October 2026, when this module was last reviewed. The government’s response of February 2024 to its consultation on AI regulation set out an approach in which existing regulators apply five cross-sectoral principles, among them safety, transparency, fairness and accountability, each within its own remit. The government kept the principles non-statutory for the time being, saying that this offered adaptability while it established its approach, and made the case for future targeted binding requirements on the small number of organisations developing highly capable general-purpose AI systems.

The King’s Speech of 17 July 2024 said that the government would “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models”. The King’s Speech of 13 May 2026, which set out the government’s legislative programme, did not announce a bill to regulate AI or mention artificial intelligence. One of the bills it announced, the Regulating for Growth Bill, is nonetheless to provide for AI. On 8 June 2026 the Technology Secretary, Liz Kendall, said that the government was establishing new AI sandboxes, in which companies can safely test AI products, through a “cross-economy AI Growth Lab” that it would legislate for in that bill.

The government’s body for research on the risks of advanced AI took the name AI Security Institute on 14 February 2025, when the Technology Secretary renamed the AI Safety Institute. The government said that the new name reflected a focus on serious AI risks with security implications, such as the use of AI to develop chemical and biological weapons, to mount cyber-attacks or to enable crimes such as fraud and child sexual abuse. The Institute, in the government’s words, would not focus on bias or freedom of speech.

Financial services show how the United Kingdom’s approach works in practice, since the Financial Conduct Authority says on its page AI and the FCA: our approach that “We do not plan to introduce extra regulations for AI”. The FCA will rely instead on existing frameworks such as the Consumer Duty and the Senior Managers and Certification Regime, through which it emphasises the accountability of senior managers. Its AI Lab includes AI Live Testing, a programme in which firms test AI systems in real-world conditions with the FCA’s support and oversight, and the FCA said that testing for its second group of firms would start from late April 2026.

The Law Commission is reviewing the product liability provisions of the Consumer Protection Act 1987 with digital products and AI in mind. Its consultation, opened on 8 October 2026, provisionally proposes a definition of product that includes software and AI systems, however supplied, and a rebuttable presumption of defect in cases of exceptional evidential difficulty. The consultation closes on 14 January 2027, and the Law Commission expects to publish its final report with recommendations in late 2027.

Northern Ireland applies some EU rules on products under the Windsor Framework, and the UK government’s explanatory memorandum says that the new Product Liability Directive will apply to products placed on the market or put into service there on or after 9 December 2026. Article 2(1) of the Directive, as corrected in May 2026, speaks of products placed on the market or put into service after 8 December 2026, so the UK government’s explanatory memorandum and the Directive cover the same products.