WHAT IS THE AIM OF THE REGULATION?
Regulation (EU) 2024/1689 aims to encourage the development and uptake of safe and trustworthy artificial intelligence (AI) systems across the European Union (EU) single market in both the private and public sectors, while ensuring EU citizens’ health and safety and respect for fundamental rights. The regulation sets out risk-based rules on:
- placing on the market, putting into service and using certain AI systems;
- banning certain AI practices;
- requirements and obligations around high-risk AI systems;
- transparency for certain AI systems;
- transparency and risk management for general-purpose AI models (powerful AI models that underpin AI systems capable of carrying out a wide range of tasks);
- market monitoring, market surveillance, governance and enforcement;
- supporting innovation, focusing on small and medium-sized enterprises (SMEs) and start-ups.
There are some exemptions, such as for systems used exclusively for military and defence or for research purposes.
KEY POINTS
What is an AI system?
An AI system is a machine-based system designed to operate with some level of autonomy that can:
- adapt after it is deployed; and
- generate outputs such as predictions, content, recommendations or decisions from input it receives (to achieve explicit or implicit objectives).
A risk-based approach
The legislation follows a risk-based approach, which means the higher the risk of causing harm to society, the stricter the rules. The regulation defines the use of AI in the following areas as high risk, due to the potential impact on fundamental rights, safety and well-being:
- safety components in products subject to EU harmonisation legislation (or as stand-alone products) that are required to undergo a third-party conformity assessment under the same EU harmonisation legislation;
- biometrics, when used for remote identification, categorising individuals by sensitive attributes (such as race or religion), or emotion recognition, except where used to simply verify identity;
- critical infrastructure, when the AI is a safety component in areas such as digital infrastructure, traffic, water, gas, heating and electricity;
- education and vocational training, including access to education issues, evaluating learning outcomes, assessing education levels or monitoring behaviour during tests;
- employment, including recruiting, selecting candidates, making decisions on employment terms (promotions, terminations), task allocation or performance monitoring;
- essential services – AI systems used by public authorities for evaluating eligibility for public services (healthcare, benefits), credit scoring, insurance risk assessment and prioritising emergency responses;
- law enforcement – AI systems used for assessing crime risks, polygraphs, evaluating evidence reliability, predicting recidivism or profiling individuals for criminal investigations;
- migration and border control – AI systems used to assess risks related to migration, asylum and visa applications, or to detect and identify individuals in migration contexts;
- administration of justice and democratic processes – AI systems used by judicial authorities for legal research and interpretation or systems that could influence election outcomes.
The regulation prohibits the following AI practices with an unacceptable level of risk
- Subliminal or deceptive techniques to manipulate individual or group behaviour, impairing their ability to make informed decisions and potentially causing harm.
- Exploiting vulnerabilities based on age, disability, or socioeconomic situations to manipulate individuals or groups, leading to potential harm.
- Social scoring, evaluating or classifying people based on behaviour or characteristics, resulting in unfair treatment unrelated to the context in which the data were collected or in a manner disproportionate to the behaviour’s severity.
- Criminal risk assessment, predicting the likelihood of committing a crime solely based on profiling or personality traits, except in objective, fact-based criminal investigations.
- Facial recognition database scraping from the internet or security cameras without specific targeting.
- Inferring emotions in sensitive areas, such as workplaces or educational institutions, unless used for medical or safety purposes.
- Biometric categorisation based on data to infer sensitive attributes like race, religion or political opinions, except for lawful use in law enforcement.
- Real-time biometric identification in public by law enforcement, unless strictly necessary for particular situations (e.g. finding missing persons, preventing imminent threats or identifying suspects of serious crimes). This must follow strict legal procedures, including prior authorisation, a limited scope and safeguards to protect rights and freedoms.
The regulation introduces disclosure obligations where a risk could arise from a lack of transparency around the use of AI:
- AI designed to impersonate humans (e.g. a chatbot) needs to inform the human it is interacting with;
- the output of generative AI needs to be marked as AI-generated in a machine-readable way;
- in certain cases, the output of generative AI needs to be visibly labelled, namely deepfakes and text that is intended to inform the public of matters of public interest.
All other AI systems are deemed to have limited risk and therefore the regulation does not introduce any further rules.
Trustworthy use of large AI models
- General-purpose AI models are AI models that are trained on large amounts of data and can perform a wide range of tasks. They can be components of AI systems.
- The regulation introduces transparency obligations for providers of such general-purpose AI models, namely technical documentation, the provision of information to downstream developers of AI systems and the disclosure of data used in training the model.
- The most powerful general-purpose AI models can pose systemic risks. If a model meets a certain threshold of capability, the provider of that model must fulfill additional risk management and cybersecurity obligations.
Governance
- The regulation sets up several governing bodies active from 2 August 2025:
- national competent authorities that will oversee and enforce the rules for AI systems;
- an AI Office within the European Commission that will coordinate the coherent application of the common rules across the EU and act as regulator for general-purpose AI models.
- The EU Member States and the AI Office will cooperate closely on an AI Board, comprising Member States’ representatives, to ensure the consistent and effective application of the regulation.
- The regulation sets up two advisory bodies for the AI Office and the AI Board:
- a scientific panel of independent experts to provide scientific advice;
- an advisory forum for stakeholders to provide technical expertise to the AI Board and the Commission.
Penalties
The fines for infringements are set as a percentage of the offending company’s annual turnover or a predetermined amount, whichever is higher. Small and medium-sized enterprises and start-ups are subject to proportional administrative fines.
Transparency and protecting fundamental rights
Increased transparency applies to the development and use of high-risk AI systems:
- before a high-risk AI system is deployed by entities providing public services, its fundamental rights impact must be assessed;
- high-risk AI systems and entities using them must be registered in an EU database.
Innovation
The regulation provides for an innovation-friendly legal framework and aims to promote evidence-based regulatory learning. It envisages AI regulatory sandboxes, enabling a controlled environment in which innovative AI systems can be developed, tested and validated, including in real-world conditions. Furthermore, the regulation allows real-world testing of high-risk AI systems under certain conditions.
Evaluation and review
The Commission assesses the need for amendments to the list of high-risk uses of AI and the list of prohibited practices every year. By 2 August 2028, and every four years thereafter, the Commission will evaluate and report on the following:
- adding to or extending the list of high-risk categories;
- amendments to the list of AI systems requiring additional transparency measures;
- amendments to improve supervision and governance.
FROM WHEN DOES THE REGULATION APPLY?
The regulation will apply from 2 August 2026. However, there are some exceptions:
- the prohibitions, definitions and obligations regarding AI literacy have applied since 2 February 2025;
- some rules will take effect on 2 August 2025, including those on governance structure, penalties, and obligations for providers of general-purpose AI models.
BACKGROUND
For further information, see:
MAIN DOCUMENT
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (OJ L, 2024/1689, 12.7.2024).
RELATED DOCUMENTS
Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, pp. 1–102).
Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC (OJ L 409, 4.12.2020, pp. 1–27).
Successive amendments to Directive (EU) 2020/1828 have been incorporated into the original text. This consolidated version is of documentary value only.
Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (OJ L 151, 7.6.2019, pp. 15–69).
Directive (EU) 2019/882 of the European Parliament and of the Council of 17 April 2019 on the accessibility requirements for products and services (OJ L 151, 7.6.2019, pp. 70–115).
Regulation (EU) 2019/1020 of the European Parliament and of the Council of 20 June 2019 on market surveillance and compliance of products and amending Directive 2004/42/EC and Regulations (EC) No 765/2008 and (EU) No 305/2011 (OJ L 169, 25.6.2019, pp. 1–44).
See consolidated version.
Regulation (EU) 2019/2144 of the European Parliament and of the Council of 27 November 2019 on type-approval requirements for motor vehicles and their trailers, and systems, components and separate technical units intended for such vehicles, as regards their general safety and the protection of vehicle occupants and vulnerable road users, amending Regulation (EU) 2018/858 of the European Parliament and of the Council and repealing Regulations (EC) No 78/2009, (EC) No 79/2009 and (EC) No 661/2009 of the European Parliament and of the Council and Commission Regulations (EC) No 631/2009, (EU) No 406/2010, (EU) No 672/2010, (EU) No 1003/2010, (EU) No 1005/2010, (EU) No 1008/2010, (EU) No 1009/2010, (EU) No 19/2011, (EU) No 109/2011, (EU) No 458/2011, (EU) No 65/2012, (EU) No 130/2012, (EU) No 347/2012, (EU) No 351/2012, (EU) No 1230/2012 and (EU) 2015/166 (OJ L 325, 16.12.2019, pp. 1–40).
See consolidated version.
Regulation (EU) 2018/858 of the European Parliament and of the Council of 30 May 2018 on the approval and market surveillance of motor vehicles and their trailers, and of systems, components and separate technical units intended for such vehicles, amending Regulations (EC) No 715/2007 and (EC) No 595/2009 and repealing Directive 2007/46/EC (OJ L 151, 14.6.2018, pp. 1–218).
See consolidated version.
Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018 on common rules in the field of civil aviation and establishing a European Union Aviation Safety Agency, and amending Regulations (EC) No 2111/2005, (EC) No 1008/2008, (EU) No 996/2010, (EU) No 376/2014 and Directives 2014/30/EU and 2014/53/EU of the European Parliament and of the Council, and repealing Regulations (EC) No 552/2004 and (EC) No 216/2008 of the European Parliament and of the Council and Council Regulation (EEC) No 3922/91 (OJ L 212, 22.8.2018, pp. 1–122).
See consolidated version.
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, pp. 39–98).
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1–88).
See consolidated version.
Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, pp. 89–131).
See consolidated version.
Directive (EU) 2016/797 of the European Parliament and of the Council of 11 May 2016 on the interoperability of the rail system within the European Union (recast) (OJ L 138, 26.5.2016, pp. 44–101).
See consolidated version.
Directive (EU) 2016/2102 of the European Parliament and of the Council of 26 October 2016 on the accessibility of the websites and mobile applications of public sector bodies (OJ L 327, 2.12.2016, pp. 1–15).
Directive 2014/90/EU of the European Parliament and of the Council of 23 July 2014 on marine equipment and repealing Council Directive 96/98/EC (OJ L 257, 28.8.2014, pp. 146–185).
See consolidated version.
Regulation (EU) No 167/2013 of the European Parliament and of the Council of 5 February 2013 on the approval and market surveillance of agricultural and forestry vehicles (OJ L 60, 2.3.2013, pp. 1–51).
See consolidated version.
Regulation (EU) No 168/2013 of the European Parliament and of the Council of 15 January 2013 on the approval and market surveillance of two- or three-wheel vehicles and quadricycles (OJ L 60, 2.3.2013, pp. 52–128).
See consolidated version.
Regulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council Decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council (OJ L 316, 14.11.2012, pp. 12–33).
See consolidated version.
Regulation (EC) No 300/2008 of the European Parliament and of the Council of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002 (OJ L 97, 9.4.2008, pp. 72–84).
See consolidated version.
Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accreditation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008, pp. 30–47).
See consolidated version.
