Region
The EU AI Act (Regulation (EU) 2024/1689) is in force with phased application. It was amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Duties grow with risk: some uses are banned, a defined list of uses is high-risk, some systems carry transparency duties, and most carry none.
For reference purposes only. Not legal advice.
Snapshot
Yes
Risk-based AI regulation, layered on data protection and product law.
AI Office (general-purpose AI), national market surveillance authorities, data protection authorities
2 Dec 2026: two new prohibitions apply, and the marking deadline for generative systems already on the market
Last reviewed 2 Oct 2026.
How to read this page
European Union: AI-specific binding law is "Yes". Risk-based AI regulation, layered on data protection and product law. This page lists 4 main instruments and 6 key dates, names the regulators to watch, and ends with questions to put to counsel. Each record carries a certainty label and a review date; treat anything marked Verify or Unsettled as a prompt to check the primary source.
EU timeline
Status tags are computed against today's date in your browser, so a card flips from Upcoming to In effect on its own.
Banned uses of AI apply.
In effect since 2 Feb 2025
Duties for providers of general-purpose models apply.
In effect since 2 Aug 2025
Article 50 duties apply, including machine-readable marking of AI-generated content. Generative systems already on the market before 2 Aug 2026 have until 2 Dec 2026 to meet the marking duty.
Second date: 2 Dec 2026 (transition for existing systems)
In effect since 2 Aug 2026
Two prohibitions added by the Digital Omnibus apply: using AI to generate non-consensual intimate imagery of identifiable people, and child sexual abuse material.
Added by Regulation (EU) 2026/1744
In 60 days
Annex III uses such as employment, credit and education.
Moved from 2 Aug 2026
In 425 days
AI embedded in regulated products under Annex I.
Moved from 2 Aug 2027
In 669 days
Dates are a summary. Confirm them with qualified counsel for your own case.
Instruments
| Instrument | Type | Status | Applies to | Key duties | Dates |
|---|---|---|---|---|---|
EU AI Act, Regulation (EU) 2024/1689Primary source ↗ · Checked 3 Oct 2026 VerifyPlain-language summaryThe core AI law. It sorts AI systems into risk tiers and sets duties by role (provider, deployer and others in the value chain). Check dates after the Digital Omnibus. Not settledPublication (24 Jul 2026) and entry into force (27 Jul 2026) of Regulation (EU) 2026/1744 are corroborated by secondary summaries. Application dates are summarised in the key dates above. Check the consolidated text before relying on any date. | Regulation | In force, phased | Providers and deployers placing AI on the EU market, or whose outputs are used in the EU | Risk tiers, prohibited practices, high-risk duties, transparency, general-purpose AI. | See key dates above |
General Data Protection Regulation (GDPR)Primary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryApplies to AI whenever personal data is involved, in training or in use. Article 22 limits decisions based solely on automated processing that significantly affect people. SimplifiedThis is a short summary. Exceptions and thresholds apply, and some dates changed under the Digital Omnibus on AI in 2026. Read the source and check the consolidated text. | Regulation | In force | Anyone processing personal data of people in the EU, in scope of the Regulation | Lawful basis, transparency, data protection impact assessments, rights on solely automated decisions (Art. 22). | |
Revised Product Liability Directive (EU) 2024/2853Primary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryExtends strict product liability to software. National implementing rules apply from late 2026; confirm the exact application date. Not settledExact application date not yet checked against the Directive. Confirm before relying on it. | Directive | Enacted, not yet in force | Manufacturers and others in the supply chain for products including software | Software, including AI, treated as a product for liability. | National rules apply from late 2026 |
Digital Services ActPrimary source ↗ · Checked 2 Oct 2026 VerifyPlain-language summaryPlatform duties that can affect how AI-generated content and recommender systems are handled. SimplifiedThis is a short summary. Exceptions and thresholds apply, and some dates changed under the Digital Omnibus on AI in 2026. Read the source and check the consolidated text. | Regulation | In force | Online intermediaries and platforms offering services in the EU | Platform duties that touch recommender systems and generated content. |
EU AI Act obligations
Provider: You develop an AI system, or have one developed, and put it on the market under your own name.Deployer: You use an AI system under your own authority, for example inside your business.
Applies since 2 Feb 2025
Provider duties
Deployer duties
2 Dec 2027 stand-alone, 2 Aug 2028 in products
Provider duties
Deployer duties
From 2 Aug 2026 (systems already on the market: marking by 2 Dec 2026)
Provider duties
Deployer duties
No fixed date
Provider duties
Deployer duties
General-purpose AI models
Since 2 August 2025, providers of general-purpose models have duties such as technical documentation, a copyright policy and a summary of training content. Models with systemic risk carry extra duties.
Simplified summary. Your role and any exceptions depend on your facts. Reviewed 2 Oct 2026.
Screen a systemOfficial EU AI Act platform and Compliance Checker ↗
Enforcement
Supervises general-purpose AI models.
Check that AI systems on the market meet the AI Act.
Enforce the GDPR, including on AI that uses personal data.
Penalty amounts are not stated here because they have not been verified from the primary source.
Actions
Not settled
Official answers
These bodies can give official guidance. ClearPath is for reference only.
Sources
It can. It covers providers placing AI on the EU market, and providers and deployers whose system outputs are used in the EU.
A provider develops an AI system, or has one developed, and puts it on the market under its own name. A deployer uses a system under its own authority.
Reviewed 2 Oct 2026.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction