Global AI Monitor
Preview
EEA Page built 23 Oct 2026

European Economic Area

EEA11 active modules1 quiet
Framework status
Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.
Next milestone
: Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force (01 AI Framework Law)
Record status
Preview · baseline record · 105 sources (105 retrieved) · 35 Probable (R-3/R-4) · Not yet expert-reviewed
AI-assembled from cited sources · evidence-gated · Not yet expert-reviewed · Not legal, compliance or investment advice · Methodology →
Disclosure details

Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. See methodology.

Research checked · Updated
Record history

Research as of · Record last changed · Publication date pending · Page built

52Instruments
50Current instruments
2Binding, in force+14 more binding, in-force date not recorded
56Obligations
147Claims
13Upcoming milestones
105Sources

Summary counts across modules ?A claim can sit in more than one module; the totals above count each once.

Next milestones in this record

  • Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force Scheduled · 01 AI Framework Law
  • Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force Scheduled · 10 Authorities & Enforcement
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Scheduled · 01 AI Framework Law
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Scheduled · 01 AI Framework Law
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Scheduled · 02 Prohibited Practices
Jump to module (12)
12 of 12 modules
View options & filters
Show
Density

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

21 instruments · 5 obligations · 39 claims · Next: (Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force)

21 instruments (20 current) · 5 obligations · 39 claims · 22 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Cloud and AI Development Act proposal Draft, no legal force

    Commission proposal for an EU-wide assessment framework for cloud and AI sovereignty with a public-sector adoption mechanism.

    Verified · Official text
  • Commission guidelines on the AI system definition Valid from 2025-02-06

    Commission guidelines explaining the legal concept of an AI system.

    Non-binding · Verified · Official text
  • Commission report under Article 112(1) of the AI Act on reviewing prohibited practices and Annex III Valid from 2026-05-20

    Commission review of the prohibited-practices and Annex III lists; flags a potential gap for AI-generated CSAM and non-consensual intimate content.

    Non-binding · Verified · Official text
  • Council Decision (EU) 2026/1080 concluding the Council of Europe Framework Convention on AI Valid from 2026-04-21

    Approves the Convention on behalf of the Union and states it is implemented exclusively through the AI Act and other Union acquis.

    Binding · Verified · Official text
  • Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law Date not recorded

    First international legally binding AI treaty; the EU ratified it on 15 May 2026 and Iceland, Liechtenstein and Norway have signed.

    Conditionally binding · Verified · Official text
  • Danish Act supplementing the AI Regulation Valid from 2025-08-02

    Danish act designating national competent authorities, giving them information and inspection powers and setting fines for Article 5 breaches.

    Binding · Authority: Agency for Digital Government, Datatilsynet, Domstolsstyrelsen · Verified · Official text
  • Digital Fairness Act (announced) Draft, no legal force

    Announced Commission legislative initiative on consumer protection online; indicative date Q4 2026.

    Verified
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • Dutch draft implementation act for the AI Regulation Draft, no legal force

    Draft act on national AI supervision put out for internet consultation on 20 April 2026.

    Verified · Official text
  • European Innovation Act proposal Draft, no legal force

    Commission proposal presented with a planned separate proposal on regulatory sandboxes.

    Verified
  • General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland) Draft, no legal force

    Pre-legislative draft heads of the Irish AI implementing bill, covering the national register, serious incident reporting and contravention notices.

    Verified · Official text
  • German AI market surveillance and innovation promotion act (KI-MIG) Valid from 2026-07-29

    German act making the Bundesnetzagentur market surveillance authority, contact point and complaints body and providing for a sandbox.

    Binding · Authority: Federal Network Agency (Bundesnetzagentur) · Verified · Official text
  • Iceland: announced AI Act implementation and deepfake bills Draft, no legal force

    Icelandic minister announced a consultation on implementing the AI Act in autumn 2026 and a separate bill on copyright and deepfakes.

    Verified
  • Italian Law on artificial intelligence Valid from 2025-10-10

    Italian national framework law designating AgID and ACN, regulating AI in work and professions, copyright and criminal law.

    Binding · Authority: National Cybersecurity Agency (ACN), Agenzia per l'Italia digitale (AgID) · Verified · Official text
  • Norwegian draft AI Act (KI-loven) Draft, no legal force

    Draft law proposing incorporation of the AI Act by reference, consulted 30 June to 30 September 2025; Nkom says the Regulation is not yet incorporated or implemented.

    Verified · Official text
  • Polish Act on artificial intelligence systems Valid from 2026-08-11

    Polish act creating KRiBSI and implementing the AI Act, in force from 11 August 2026 with later start dates for some parts.

    Binding · Authority: Commission for the Development and Security of Artificial Intelligence (KRiBSI) · Verified · Official text
  • Product Liability Directive (revised) Date not recorded

    Revised EU product liability regime that treats software as a product; Member States must transpose by 9 December 2026.

    Legal force not established · Verified · Official text
  • Regulation of Artificial Intelligence Act 2026 (Ireland) Valid from 2026-07-31

    Irish act signed on 21 July 2026 establishing the AI Office of Ireland as central coordinating authority.

    Binding · Authority: AI Office of Ireland · Verified · Official text
  • Spanish draft Organic Law for the proper use and governance of AI Draft, no legal force

    Bill approved by the Council of Ministers on 26 May 2026 and before the Congress with amendments due by 30 June 2026.

    Verified · Official text
  • Proposal for a Directive on adapting non-contractual civil liability rules to AI (AI Liability Directive), COM(2022) 496 Ended 2025-10-06 Not current

    2022 Commission proposal to ease proof of causality for AI-caused harm, withdrawn on 6 October 2025.

    Draft, no legal force · Verified · Official text

Obligations

  • Article 1(5), replacing Article 4

    Providers and deployers of AI systems must take measures to support the AI literacy of their staff and other persons operating and using AI systems on their behalf.

    literacy training · Applies to: provider · Digital Omnibus on AI
  • Article 22(1)

    Member States must bring into force laws necessary to comply with the Product Liability Directive by 9 December 2026; the Directive treats software as a product.

    other · Applies to: other · Product Liability Directive (revised)
  • § 2(1)

    The Bundesnetzagentur is the market surveillance authority for compliance with the AI Act unless the KI-MIG provides otherwise.

    other · Applies to: other · German AI market surveillance and innovation promotion act (KI-MIG)
  • Long title / establishment provision (section number not confirmed)

    The Act establishes Oifig IS na hÉireann (AI Office of Ireland) as an independent statutory body and coordinating authority; the Department states it adds no operator obligations beyond the AI Act.

    other · Applies to: other · Regulation of Artificial Intelligence Act 2026 (Ireland)
  • Article 3

    The Convention is to be implemented in the Union exclusively through the AI Act and other relevant Union acquis, where applicable.

    other · Applies to: other · Council Decision (EU) 2026/1080 concluding the Council of Europe Framework Convention on AI

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Danish Act 467/2025 enters into force Met
    Danish Act supplementing the AI Regulation
  • Commission withdraws the AI Liability Directive proposal Met
    Proposal for a Directive on adapting non-contractual civil liability rules to AI (AI Liability Directive), COM(2022) 496
  • Italian Law 132/2025 enters into force Met
    Italian Law on artificial intelligence
  • Council Decision 2026/1080 takes effect (adoption) Met
    Council Decision (EU) 2026/1080 concluding the Council of Europe Framework Convention on AI
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • German KI-MIG enters into force Met
    German AI market surveillance and innovation promotion act (KI-MIG)
  • Irish Act commences (SI 403/2026) Met
    Regulation of Artificial Intelligence Act 2026 (Ireland)
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Polish AI Act enters into force Met
    Polish Act on artificial intelligence systems
  • (quarter)Indicative Commission Work Programme date for the Digital Fairness Act proposal Date passed since research; not re-checked
    Digital Fairness Act (announced)
  • Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force Upcoming
    Polish Act on artificial intelligence systems
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • Member State transposition deadline for revised Product Liability Directive Upcoming
    Product Liability Directive (revised)
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (39)
  • Regulation (EU) 2024/1689 (the AI Act) was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024.

    Confidence: Confirmed · As of 1 Aug 2024 · evidenced
    Evidence and sources
  • The AI Act is binding in its entirety and directly applicable in all EU Member States.

    Confidence: Confirmed · As of 1 Aug 2024 · evidenced
    Evidence and sources
  • Derived: Probable The AI Act applies in stages from 2 February 2025 to 2 August 2026, with Chapter III high-risk rules now applying from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) following the Digital Omnibus on AI.

    Confidence: Confirmed · As of 24 Jul 2026 · evidenced
    Evidence and sources
    • Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 113It shall apply from 2 August 2026. However: (a) Chapters I and II shall apply from 2 February 2025;
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(40)(a), amending Article 113(a) point (a) is replaced by the following: '(a) Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;';
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(40)(b), amending Article 113(b) point (c) is replaced by the following: '(c) Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III;
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Recital on application dates for high-risk systems2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I.
    • AI Act Service Desk - implementation timeline T1 · retrieved · retrieved 8 Oct 2026 · Timeline items 7-802 Dec 2027 Rules for high-risk AI systems in Annex III apply ** 8. 02 Aug 2028 Rules for high-risk AI embedded in regulated products covered by Annex I apply
    • AI Act Service Desk - implementation timeline T1 · retrieved · retrieved 8 Oct 2026 · Timeline item 502 Dec 2026 New prohibitions + Article 50(2) transition apply ** - Prohibitions, for AI systems generating non-consensual sexual deepfakes and child sexual abuse material, start to apply.
  • Derived: Probable The AI Act applies to third-country providers and deployers whose AI system's output is used in the Union.

    Confidence: Probable · As of 1 Aug 2024 · evidenced
    Evidence and sources
  • The AI Act is marked EEA-relevant but remains under scrutiny for EEA Agreement incorporation by Iceland, Liechtenstein and Norway; Norway states it is not yet incorporated or implemented.

    Confidence: Confirmed · evidenced
    Evidence and sources
  • Derived: Probable Liechtenstein is obliged under the EEA Agreement to adopt the AI Act, and pending that, its providers and deployers must comply under the market-location principle where output is used in the EU.

    Confidence: Probable · evidenced
    Evidence and sources
  • Derived: Probable Pending EEA incorporation, Liechtenstein providers and deployers must already comply with the AI Act under the market-location principle where output is used in the EU.

    Confidence: Probable · evidenced
    Evidence and sources
  • Regulation (EU) 2026/1744 (the Digital Omnibus on AI) amends the AI Act, the EASA Basic Regulation and the Machinery Regulation.

    Confidence: Confirmed · As of 24 Jul 2026 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Regulation (EU) 2026/1744, titleof 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the
  • Regulation (EU) 2026/1744 of 8 July 2026 (Digital Omnibus on AI) amends Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
  • The Omnibus Regulation entered into force on the third day following its publication in the Official Journal of 24 July 2026, which the Commission dates as 27 July 2026.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
  • The Omnibus replaces Article 4 so that providers and deployers must take measures to support AI literacy of their staff.

    Confidence: Probable · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(5), replacing Article 4Article 4 AI literacy 1. Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI
  • The Omnibus Regulation amends Regulation (EU) 2024/1689 as regards simplification of implementation.

    Confidence: Probable · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Regulation (EU) 2026/1744, titleof 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) (Text with EEA relevance) THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, Having regard to the
  • The EU ratified the Council of Europe Framework Convention on AI on 15 May 2026 declaring it will apply Chapters II to VI to private actors through the AI Act, while Iceland, Liechtenstein and Norway are signatories only.

    Confidence: Probable · As of 15 May 2026 · evidenced
    Evidence and sources
    • Council of Europe Framework Convention on AI - parties table T1 · retrieved · retrieved 8 Oct 2026 · Parties table|EU (European Union)|05-09-2024|15-05-2026 (R)| | | | |Georgia|05-09-2024| | | | | |Iceland|05-09-2024| | | | | |Israel|05-09-2024| | | | | |Japan|11-02-2025| | | | | |Liechtenstein|27-02-2025| | | | | |Moldova|05-09-2024| | | | | |Montenegro|05-11-2024| | | | | |North Macedonia|08-05-2026| | | | |
    • Council of Europe Framework Convention on AI - parties table T1 · retrieved · retrieved 8 Oct 2026 · EU declarationthe Union declares that it will apply the principles and obligations set forth in Chapters II to VI of the Convention to activities of private actors placing on the market, making available and using artificial intelligence systems in the European Union through the implementation of Regulation (EU) 2024/1689 of the European Parliament and the Council of 13 June 2024 laying down harmonised rules
    • Council of Europe Framework Convention on AI - parties table T1 · retrieved · retrieved 8 Oct 2026 · Parties table|Iceland|05-09-2024| | | | | |Israel|05-09-2024| | | | | |Japan|11-02-2025| | | | | |Liechtenstein|27-02-2025| | | | | |Moldova|05-09-2024| | | | | |Montenegro|05-11-2024| | | | | |North Macedonia|08-05-2026| | | | | |Norway|05-09-2024| | | | | |San Marino|05-09-2024| | | | |
  • The Convention enters into force on the first day of the month following three months after five signatories, including at least three Council of Europe member States, have consented to be bound.

    Confidence: Probable · evidenced
    Evidence and sources
  • A secondary report asserts the Convention takes effect for the Union on 1 September 2026; the Council of Europe Treaty Office table lists only the Union as a ratifying party, and Article 30(3) requires five ratifications including three Council of Europe member States, which that date does not satisfy.

    Confidence: Disputed · evidenced
    Evidence and sources
  • Member States must bring into force measures complying with the revised Product Liability Directive by 9 December 2026, which defines product to include software.

    Confidence: Probable · As of 9 Dec 2026 · evidenced
    Evidence and sources
  • Italian Law 23 September 2025, n. 132 on artificial intelligence was published 25 September 2025 and entered into force on 10 October 2025.

    Confidence: Probable · As of 10 Oct 2025 · evidenced
    Evidence and sources
  • The German KI-MIG entered into force on 29 July 2026, making the Bundesnetzagentur the market surveillance authority, contact point and complaints body.

    Confidence: Confirmed · As of 29 Jul 2026 · evidenced
    Evidence and sources
  • The Regulation of Artificial Intelligence Act 2026 was signed into law on 21 July 2026 and establishes the AI Office of Ireland as an independent statutory body.

    Confidence: Probable · As of 21 Jul 2026 · evidenced
    Evidence and sources
  • Commencement Order SI 403/2026 appoints 31 July 2026 as the day the Regulation of Artificial Intelligence Act 2026 comes into operation, apart from two paragraphs of a section 78 definition.

    Confidence: Confirmed · As of 31 Jul 2026 · evidenced
    Evidence and sources
  • Derived: Probable The Department states the Act is a technical implementing measure that does not add to obligations the AI Act already places on regulated entities, and establishes Oifig IS na hÉireann as an independent statutory body.

    Confidence: Probable · As of 17 Jun 2026 · evidenced
    Evidence and sources
  • The Polish Act of 3 July 2026 on artificial intelligence systems (Dz.U. 2026 poz. 1003) entered into force on 11 August 2026, with Articles 8-18 and Chapters 3-5, 8 and 9 applying from 28 October 2026.

    Confidence: Confirmed · As of 11 Aug 2026 · evidenced
    Evidence and sources
  • Derived: Probable Danish Act No. 467 of 14 May 2025 supplementing the AI Regulation entered into force on 2 August 2025.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Spain's Council of Ministers approved the draft Organic Law for the proper use and governance of AI on 26 May 2026; the Congress Bureau set an amendment period ending 30 June 2026.

    Confidence: Confirmed · As of 26 May 2026 · evidenced
    Evidence and sources
  • Derived: Probable The Dutch State Secretary for Digital Economy and Sovereignty opened internet consultation on the AI Regulation implementation act on 20 April 2026.

    Confidence: Probable · As of 20 Apr 2026 · evidenced
    Evidence and sources
    • Kabinet zet stap met toezicht op Europese AI-regels T1 · retrieved · retrieved 8 Oct 2026 · BodyState Secretary Aerdts (Digital Economy and Sovereignty) today put the proposal for the implementation act for the AI Regulation out for internet consultation.
  • Norway consulted on a draft KI-loven implementing the AI Regulation by incorporation from 30 June to 30 September 2025.

    Confidence: Confirmed · As of 30 Jun 2025 · evidenced
    Evidence and sources
  • Norway's communications regulator Nkom states that the AI Regulation has not yet been incorporated into the EEA Agreement or implemented in Norwegian law.

    Confidence: Probable · As of 10 Aug 2026 · evidenced
    Evidence and sources
  • Derived: Probable The General Scheme of the Regulation of Artificial Intelligence Bill 2026, published by Ireland's Department of Enterprise, sets out draft heads for a national AI register, serious-incident reporting and contravention notices.

    Confidence: Probable · As of 4 Feb 2026 · evidenced
    Evidence and sources
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 37(1)Head 37 - National Register and Reporting Obligations To provide that: (1) The Office shall establish and maintain a national register of: a. all instances of prohibited AI practices under Article 5; b. High-risk AI systems referred to in point 2 of Annex III.
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 42(1)Head 42 - Serious incidents To provide that: (1) Relevant Market Surveillance Authorities will receive reports of serious incidents from providers of High-Risk AI (HRAI) systems where the incident occurred.
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 55(1)Head 55 - Contravention notice To provide that: (1) An authorised officer who is of the opinion that a person or entity is contravening or has contravened any provision of this Act or the AI Act may service a notice (in this Act referred to as a 'contravention notice') on the person or entity.
  • The Commission's 2025 work programme listed the AI Liability Directive proposal COM(2022) 496 for withdrawal because there was no foreseeable agreement.

    Confidence: Confirmed · As of 11 Feb 2025 · evidenced
    Evidence and sources
    • Commission work programme 2025, Annexes 1 to 5 (COM(2025) 45), Annex IV Withdrawals T1 · retrieved · retrieved 8 Oct 2026 · Annex IV, item 32COM(2022)496 final 2022/0303 (COD) Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on adapting non-contractual civil liability rules to artificial intelligence (AI Liability) No foreseeable agreement - the Commission will assess whether another proposal should be tabled or another type of approach should be chosen.
  • Derived: Probable The Commission formally withdrew the AI Liability Directive proposal COM(2022) 496 by a notice in the Official Journal of 6 October 2025.

    Confidence: Confirmed · As of 6 Oct 2025 · evidenced
    Evidence and sources
  • Recital 19 of the Digital Omnibus on AI states that the AI Act and the Cyber Resilience Act complement each other on product safety and cybersecurity.

    Confidence: Confirmed · evidenced
    Evidence and sources
  • Derived: Probable Council Decision (EU) 2026/1080 of 21 April 2026 approves the Council of Europe Framework Convention on AI on behalf of the Union.

    Confidence: Probable · As of 21 Apr 2026 · evidenced
    Evidence and sources
  • Derived: Probable Article 3 states the Convention is implemented in the Union exclusively through the AI Act and other relevant Union acquis.

    Confidence: Probable · As of 21 Apr 2026 · evidenced
    Evidence and sources
  • The Commission adopted a proposal for a Cloud and AI Development Act (CADA, COM(2026) 502) on 3 June 2026.

    Confidence: Confirmed · As of 3 Jun 2026 · evidenced
    Evidence and sources
    • Proposal for the Cloud and AI Development Act (CADA) T1 · retrieved · retrieved 8 Oct 2026 · Proposal summaryintroducing a single EU-wide assessment framework for cloud and AI sovereignty, accompanied by a public sector adoption mechanism The CADA complements other new initiatives, including the Chips Act 2.0 and the EU Open Source Strategy.
    • Proposal for the Cloud and AI Development Act (CADA) T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphThe Commission has adopted a proposal for the Cloud and AI Development Act (CADA) with the aim of strengthening the EU's cloud and AI ecosystem, investment and infrastructure.
  • The Digital Fairness Act is listed as announced, with an indicative Commission Work Programme date of Q4 2026; no proposal has been tabled.

    Confidence: Probable · evidenced
    Evidence and sources
  • The Commission proposed a European Innovation Act on 9 September 2026 and announced a separate proposal on regulatory sandboxes.

    Confidence: Confirmed · As of 9 Sep 2026 · evidenced
    Evidence and sources
    • Commission proposes new European Innovation Act (IP/26/1810) T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphToday, the Commission proposed a new European Innovation Act to help Europe's most innovative ideas be developed, financed and scaled up in Europe.
    • Commission proposes new European Innovation Act (IP/26/1810) T1 · retrieved · retrieved 8 Oct 2026 · Section: innovation-friendly regulatory frameworkIn parallel with the European Innovation Act, the Commission will help innovators accelerate the transformation of innovative ideas into market solutions through a specific proposal on regulatory sandboxes.
  • The Commission adopted its Article 112(1) report reviewing the prohibited-practices and Annex III high-risk lists as COM(2026) 234 on 20 May 2026.

    Confidence: Confirmed · As of 20 May 2026 · evidenced
    Evidence and sources
  • The Commission's guidelines on the AI system definition are not binding.

    Confidence: Confirmed · As of 6 Feb 2025 · evidenced
    Evidence and sources
  • Derived: Probable Iceland has not incorporated the EU AI Act into national law; a minister announced a planned autumn 2026 consultation on implementing it, alongside a separate bill on copyright and deepfakes.

    Confidence: Probable · As of 27 Sep 2026 · evidenced
    Evidence and sources

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

6 instruments · 5 obligations · 7 claims · Next: (Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply)

6 instruments (6 current) · 5 obligations · 7 claims · 14 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Commission Guidelines on prohibited AI practices Valid from 2025-02-04

    Commission guidance on AI practices deemed unacceptable under Article 5 of the AI Act.

    Non-binding · Verified · Official text
  • Commission report under Article 112(1) of the AI Act on reviewing prohibited practices and Annex III Valid from 2026-05-20

    Commission review of the prohibited-practices and Annex III lists; flags a potential gap for AI-generated CSAM and non-consensual intimate content.

    Non-binding · Verified · Official text
  • Danish Act supplementing the AI Regulation Valid from 2025-08-02

    Danish act designating national competent authorities, giving them information and inspection powers and setting fines for Article 5 breaches.

    Binding · Authority: Agency for Digital Government, Datatilsynet, Domstolsstyrelsen · Verified · Official text
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • Platform Work Directive Date not recorded

    Gives platform workers transparency about, and limits on, automated monitoring and decision-making systems.

    Legal force not established · Verified · Official text

Obligations

  • Article 5(1) (first subparagraph points (a)-(h))

    The placing on the market, putting into service or use of the listed AI practices is prohibited.

    prohibition · Applies to: other · Artificial Intelligence Act
  • Article 1(7), inserting Article 5(1)(ba) and (bb)

    The placing on the market, putting into service or use of AI systems that generate or manipulate realistic intimate or sexually explicit material of an identifiable person without consent (and the CSAM-type practice in point (bb)) is prohibited.

    prohibition · Applies to: other · Digital Omnibus on AI
  • Section 10(1)(1)

    Infringement of Article 5(1)(a)-(g) of the AI Regulation is punishable by a fine unless a higher penalty applies under other legislation.

    prohibition · Applies to: other · Danish Act supplementing the AI Regulation
  • Article 7(1)(a)

    Digital labour platforms may not use automated monitoring or decision-making systems to process personal data on the emotional or psychological state of a person performing platform work.

    prohibition · Applies to: other · Platform Work Directive
  • § 4

    The Data Protection Ombudsman supervises, as market surveillance authority, compliance with the prohibited AI practices in Article 5 of the AI Act.

    other · Applies to: other · Finland: Act 1377/2025 on the supervision of certain AI systems

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Danish Act 467/2025 enters into force Met
    Danish Act supplementing the AI Regulation
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • Platform Work Directive transposition deadline Upcoming
    Platform Work Directive
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (7)
  • Derived: Probable Breach of the Article 5 prohibited-practices list is subject to fines of up to EUR 35 million or 7% of worldwide turnover, whichever is higher.

    Confidence: Confirmed · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Article 5(1)(ba) and (bb) and Article 5(1a) and (1b) of the AI Act apply from 2 December 2026, which the Commission describes as the ninth prohibition.

    Confidence: Confirmed · As of 2 Dec 2026 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(40)(a), amending Article 113(a) point (a) is replaced by the following: '(a) Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;';
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(7), inserting Article 5(1)(ba)(ba) the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person's intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person's freely-given, specific, informed, unambiguous and explicit consent for that generation or
    • AI Act - Shaping Europe's digital future T1 · retrieved · retrieved 8 Oct 2026 · Prohibited AI practicesProhibition 9 comes into effect in December 2026 and was introduced as a part of the AI Omnibus.
    • AI Act Service Desk - implementation timeline T1 · retrieved · retrieved 8 Oct 2026 · Timeline item 502 Dec 2026 New prohibitions + Article 50(2) transition apply ** - Prohibitions, for AI systems generating non-consensual sexual deepfakes and child sexual abuse material, start to apply.
  • The Commission published guidelines on prohibited AI practices on 4 February 2025.

    Confidence: Probable · As of 4 Feb 2025 · evidenced
    Evidence and sources
  • Derived: Probable Section 10 of the Danish Act makes infringement of Article 5(1)(a)-(g) of the AI Regulation punishable by a fine, unless a higher penalty applies under other legislation.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Digital labour platforms may not use automated monitoring or decision-making systems to process personal data on a worker's emotional or psychological state.

    Confidence: Confirmed · evidenced
    Evidence and sources
  • The Commission is analysing a potential gap under which AI systems generating CSAM or non-consensual intimate content are not prohibited by Article 5 AI Act.

    Confidence: Confirmed · As of 22 May 2026 · evidenced
    Evidence and sources
    • Report on the review of prohibitions and high-risk AI T1 · retrieved · retrieved 8 Oct 2026 · Main outcomesThe Commission noted and is further analysing a potential regulatory gap regarding AI systems generating child sexual abuse material and non-consensual intimate content, which are currently not prohibited by Article 5 AI Act.
  • The Data Protection Ombudsman supervises Article 5 prohibited practices and Traficom supervises Article 50 transparency obligations in Finland.

    Confidence: Confirmed · As of 1 Jan 2026 · evidenced
    Evidence and sources

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

4 instruments · 7 obligations · 9 claims · Next: (Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply)

4 instruments (4 current) · 7 obligations · 9 claims · 13 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • Draft Commission guidelines on classification of high-risk AI systems Draft, no legal force

    Draft guidelines on Article 6 classification with examples for Annex I and Annex III.

    Verified · Official text
  • German AI market surveillance and innovation promotion act (KI-MIG) Valid from 2026-07-29

    German act making the Bundesnetzagentur market surveillance authority, contact point and complaints body and providing for a sandbox.

    Binding · Authority: Federal Network Agency (Bundesnetzagentur) · Verified · Official text

Obligations

  • Article 16

    Providers of high-risk AI systems must ensure Section 2 compliance, run a quality management system, keep documentation and logs and complete conformity assessment before placing the system on the market.

    conformity assessment · Applies to: provider · Artificial Intelligence Act
  • Article 26(1)-(2)

    Deployers of high-risk AI systems must use them per instructions for use and assign human oversight to competent, trained and authorised natural persons.

    human oversight · Applies to: deployer · Artificial Intelligence Act
  • Article 73(1)-(2)

    Providers of high-risk AI systems must report serious incidents to the market surveillance authorities of the Member State where it occurred, immediately and in any event within 15 days of awareness.

    incident reporting · Applies to: provider · Artificial Intelligence Act
  • Article 4a(1)

    Providers of high-risk AI systems may exceptionally process special categories of personal data where strictly necessary for bias detection and correction, with appropriate safeguards.

    data governance · Applies to: provider · Artificial Intelligence Act
  • Article 27(1)

    Public-law bodies, private entities providing public services and deployers of certain Annex III point 5 systems must assess the impact on fundamental rights before deploying a high-risk AI system referred to in Article 6(2).

    fundamental rights impact assessment · Applies to: deployer · Artificial Intelligence Act
  • § 18

    When a provider or German authorised representative ceases business, the person responsible for liquidation or dissolution of the legal entity must discharge the Article 18(1) document-retention duty.

    record keeping · Applies to: provider · German AI market surveillance and innovation promotion act (KI-MIG)
  • Article 12, inserting Article 437-bis of the Criminal Code

    Omitting the technical safety measures or human oversight measures required for high-risk AI systems is a crime punished with one to five years' imprisonment where danger to life or public or individual safety results.

    prohibition · Applies to: provider · Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • German KI-MIG enters into force Met
    German AI market surveillance and innovation promotion act (KI-MIG)
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (9)
  • Derived: Probable Breach of provider, deployer, importer, distributor, transparency or GPAI obligations is subject to fines of up to EUR 15 million or 3% of turnover, whichever is higher.

    Confidence: Confirmed · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • High-risk AI providers must meet Article 16 duties and report serious incidents under Article 73, and deployers must meet Article 26 duties, from 2 December 2027 for Annex III systems.

    Confidence: Probable · As of 2 Dec 2027 · evidenced
    Evidence and sources
  • The Omnibus deletes point 1 of Annex I Section A of the AI Act and lists the Machinery Regulation (EU) 2023/1230 as point 21 of Section B.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
  • New Article 4a lets providers of high-risk AI systems exceptionally process special-category personal data where strictly necessary for bias detection and correction, with safeguards.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • AI Act Service Desk: Article 4a (consolidated text as amended) T1 · retrieved · retrieved 8 Oct 2026 · Article 4a(1)To the extent strictly necessary to ensure bias detection and correction in relation to high-risk AI systems in accordance with Article 10(2), points (f) and (g), of this Regulation, providers of such systems may exceptionally process special categories of personal data, subject to appropriate safeguards
  • Article 27 requires public-law bodies, public-service deployers, and certain Annex III point 5 deployers to assess fundamental-rights impact before deploying a high-risk AI system under Article 6(2).

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • AI Act Service Desk: Article 27 T1 · retrieved · retrieved 8 Oct 2026 · Article 27(1)Prior to deploying a high-risk AI system referred to in Article 6(2)... deployers that are bodies governed by public law, or are private entities providing public services... shall perform an assessment of the impact on fundamental rights that the use of such system may produce.
  • The Omnibus moves application of Chapter III Sections 1 to 3 to 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I systems.

    Confidence: Confirmed · As of 2 Dec 2027 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(40)(b), amending Article 113(b) point (c) is replaced by the following: '(c) Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III;
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Recital on application dates for high-risk systems2 December 2027 for AI systems classified as high-risk pursuant to Article 6(2) and Annex III, and to 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I.
    • AI Act - Shaping Europe's digital future T1 · retrieved · retrieved 8 Oct 2026 · Omnibus timelinesystems used in certain high-risk areas — including biometrics, critical infrastructure, education, employment, migration, asylum and border control — will apply from 2 December 2027**.
  • The Commission published draft guidelines on high-risk classification on 19 May 2026 and invited views by 23 June 2026.

    Confidence: Confirmed · As of 19 May 2026 · evidenced
    Evidence and sources
  • Section 18 KI-MIG places the Article 18(1) AI Act documentation-retention duty on the person responsible for liquidating a provider or authorised representative that ceases business.

    Confidence: Confirmed · As of 29 Jul 2026 · evidenced
    Evidence and sources
  • Derived: Probable Article 12 of the Italian decree inserts Article 437-bis into the Criminal Code, punishing omission of required high-risk AI safety/oversight measures with one to five years' imprisonment where danger to life or safety results.

    Confidence: Probable · As of 30 Sep 2026 · evidenced
    Evidence and sources

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

4 instruments · 5 obligations · 7 claims · Next: (Providers of GPAI models placed on the market before 2 August 2025 must comply)

4 instruments (4 current) · 5 obligations · 7 claims · 5 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Commission guidelines for providers of general-purpose AI models Date not recorded

    Commission guidelines clarifying the scope of obligations for GPAI model providers.

    Non-binding · Verified · Official text
  • General-Purpose AI Code of Practice Valid from 2025-07-10

    Voluntary code on safety, transparency and copyright for GPAI model providers, published 10 July 2025.

    Non-binding · Verified · Official text
  • Implementing Regulation on the scientific panel of independent experts Date not recorded

    Establishes the scientific panel that advises the AI Office and national authorities on general-purpose AI models with systemic risk.

    Binding · Authority: Scientific Panel of independent experts under the AI Act · Verified · Official text

Obligations

  • Article 53(1)(a)-(b)

    Providers of general-purpose AI models must keep up-to-date technical documentation for the AI Office and national authorities and provide information to downstream providers integrating the model.

    documentation · Applies to: provider · Artificial Intelligence Act
  • Article 53(1)(c)

    Providers of general-purpose AI models must put in place a policy to comply with Union copyright law, including identifying and complying with rights reservations under Article 4(3) of Directive (EU) 2019/790.

    other · Applies to: provider · Artificial Intelligence Act
  • Article 53(1)(d)

    Providers of general-purpose AI models must publish a sufficiently detailed summary of the content used for training according to the AI Office template.

    transparency disclosure · Applies to: provider · Artificial Intelligence Act
  • Article 55(1)

    Providers of general-purpose AI models with systemic risk must evaluate and adversarially test the model, assess and mitigate systemic risks, report serious incidents and ensure cybersecurity protection.

    risk management · Applies to: provider · Artificial Intelligence Act
  • Article 10(2)

    Experts on the scientific panel must be independent from any provider of AI systems or general-purpose AI models.

    other · Applies to: other · Implementing Regulation on the scientific panel of independent experts

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
Claims and evidence (7)
  • A GPAI model is presumed to carry systemic risk when cumulative training compute exceeds 10^25 FLOPs.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • GPAI providers must keep technical documentation, inform downstream providers, maintain a copyright-compliance policy and publish a training-content summary.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Providers of GPAI models with systemic risk must additionally evaluate and adversarially test the model, mitigate systemic risks, report serious incidents and secure the model.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Derived: Probable The Commission may fine GPAI providers up to EUR 15 million or 3% of worldwide turnover, whichever is higher, under Article 101(1).

    Confidence: Confirmed · evidenced
    Evidence and sources
    • AI Act Service Desk: Article 101 T1 · retrieved · retrieved 8 Oct 2026 · Article 101(1)The Commission may impose on providers of general-purpose AI models fines not exceeding 3 % of their annual total worldwide turnover in the preceding financial year or EUR 15 000 000, whichever is higher.
  • The Commission issued guidelines clarifying the scope of obligations for providers of general-purpose AI models.

    Confidence: Probable · evidenced
    Evidence and sources
  • The General-Purpose AI Code of Practice was published on 10 July 2025 and providers who voluntarily sign it can use adherence to show compliance with the AI Act.

    Confidence: Probable · As of 10 Jul 2025 · evidenced
    Evidence and sources
  • Commission Implementing Regulation (EU) 2025/454 establishes the scientific panel of independent experts in the field of artificial intelligence.

    Confidence: Confirmed · As of 7 Mar 2025 · evidenced
    Evidence and sources

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

6 instruments · 8 obligations · 9 claims · Next: (Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply)

6 instruments (6 current) · 8 obligations · 9 claims · 14 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Code of Practice on transparency of AI-generated content Date not recorded

    Voluntary code on marking, detection and labelling of AI-generated content, confirmed adequate by the Commission and AI Board.

    Non-binding · Verified · Official text
  • Commission guidelines on Article 50 transparency obligations Valid from 2026-07-20

    Commission guidelines defining the scope of Article 50 transparency obligations, published 20 July 2026.

    Non-binding · Verified · Official text
  • Denmark: draft Copyright Act amendment on realistic digital imitations (deepfakes) Draft, no legal force

    Draft Danish copyright amendment protecting people's likeness and voice against realistic AI imitations, with satire and parody carve-outs.

    Verified · Official text
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • Italian Law on artificial intelligence Valid from 2025-10-10

    Italian national framework law designating AgID and ACN, regulating AI in work and professions, copyright and criminal law.

    Binding · Authority: National Cybersecurity Agency (ACN), Agenzia per l'Italia digitale (AgID) · Verified · Official text

Obligations

  • Article 50(1)

    Providers must design AI systems that interact directly with natural persons so that those persons are informed they are interacting with an AI system, unless obvious.

    transparency disclosure · Applies to: provider · Artificial Intelligence Act
  • Article 50(2)

    Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text must mark outputs in a machine-readable format and make them detectable as artificially generated or manipulated.

    marking or watermarking · Applies to: provider · Artificial Intelligence Act
  • Article 50(3)

    Deployers of emotion recognition or biometric categorisation systems must inform the natural persons exposed to the operation of the system.

    transparency disclosure · Applies to: deployer · Artificial Intelligence Act
  • Article 50(4)

    Deployers of AI systems that generate or manipulate image, audio or video content constituting a deep fake must disclose that the content has been artificially generated or manipulated.

    transparency disclosure · Applies to: deployer · Artificial Intelligence Act
  • Article 1(39)(b), inserting Article 111(4)

    Providers of generative AI systems placed on the market before 2 August 2026 must take the necessary steps to comply with Article 50(2) by 2 December 2026.

    marking or watermarking · Applies to: provider · Digital Omnibus on AI
  • Art. 26(1)(c), inserting Art. 612-quater of the Penal Code

    Unlawfully disseminating without consent images, video or voices falsified or altered with AI systems and capable of misleading about their genuineness, causing unjust harm, is an offence.

    prohibition · Applies to: other · Italian Law on artificial intelligence
  • § 5(1)

    Traficom supervises, as market surveillance authority, compliance with the Article 50 transparency obligations of the AI Act.

    transparency disclosure · Applies to: other · Finland: Act 1377/2025 on the supervision of certain AI systems
  • Draft Copyright Act amendment (TRIS 2025/0654/DK)

    Unauthorised publication of realistic digital imitations of a person would be illegal and reportable to online sharing platforms as illegal content, with exceptions for satire and parody.

    prohibition · Applies to: other · Denmark: draft Copyright Act amendment on realistic digital imitations (deepfakes)

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Italian Law 132/2025 enters into force Met
    Italian Law on artificial intelligence
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • (month)Danish minister's hoped-for start of the deepfake copyright amendment Upcoming
    Denmark: draft Copyright Act amendment on realistic digital imitations (deepfakes)
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (9)
  • Article 50 requires AI-interaction disclosure, machine-readable marking of synthetic content, emotion/biometric notice, and deep-fake disclosure, all applying from 2 August 2026.

    Confidence: Confirmed · As of 2 Aug 2026 · evidenced
    Evidence and sources
  • Providers of generative AI systems placed on the market before 2 August 2026 must comply with Article 50(2) by 2 December 2026.

    Confidence: Confirmed · As of 2 Dec 2026 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 1(39)(b), inserting Article 111(4)Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.';
    • AI Act Service Desk - implementation timeline T1 · retrieved · retrieved 8 Oct 2026 · Timeline item 502 Dec 2026 New prohibitions + Article 50(2) transition apply ** - Prohibitions, for AI systems generating non-consensual sexual deepfakes and child sexual abuse material, start to apply.
  • The Commission and the AI Board confirmed the Code of Practice on transparency of AI-generated content is an adequate voluntary tool, and more than 180 organisations have signed it.

    Confidence: Confirmed · evidenced
    Evidence and sources
  • The Commission published guidelines on Article 50 transparency obligations on 20 July 2026.

    Confidence: Probable · As of 20 Jul 2026 · evidenced
    Evidence and sources
  • Article 26 of Law 132/2025 inserts Article 612-quater into the Penal Code, criminalising unlawful dissemination of AI-generated or altered images, video or voices that cause unjust harm.

    Confidence: Probable · As of 10 Oct 2025 · evidenced
    Evidence and sources
    • Gazzetta Ufficiale Serie Generale n. 223 of 25-9-2025 (Legge 132/2025 full text) T1 · retrieved · retrieved 8 Oct 2026 · Art. 26(1)(c), inserting Art. 612-quater c.p.Whoever causes unjust harm to a person by transferring, publishing or otherwise disseminating, without their consent, images, videos or voices falsified or altered through the use of artificial intelligence systems and capable of misleading as to their genuineness
  • The Data Protection Ombudsman supervises Article 5 prohibited practices and Traficom supervises Article 50 transparency obligations in Finland.

    Confidence: Confirmed · As of 1 Jan 2026 · evidenced
    Evidence and sources
  • Denmark has notified to the European Commission, under TRIS procedure 2025/0654/DK, a draft act amending its Copyright Act to address realistic AI-generated digital imitations (deepfakes).

    Confidence: Confirmed · As of 1 Jun 2026 · evidenced
    Evidence and sources
    • Denmark's proposed copyright rules on deepfakes T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphDenmark has notified a draft act amending its Copyright Act to address realistic digitally generated imitations, commonly known as 'deepfakes'.
  • Derived: Probable Denmark was due to introduce the deepfake bill to the Folketing on Thursday, 8 October 2026, with the minister hoping it will take effect at the start of 2027.

    Confidence: Probable · As of 8 Oct 2026 · evidenced
    Evidence and sources
  • Under the notified Danish draft, unauthorised publication of realistic AI-generated imitations of a person would be illegal and could be reported to online sharing platforms as illegal content, subject to satire and parody exceptions.

    Confidence: Confirmed · As of 1 Jun 2026 · evidenced
    Evidence and sources
    • Denmark's proposed copyright rules on deepfakes T1 · retrieved · retrieved 8 Oct 2026 · BodyAs set out in the TRIS notification, such unauthorised publication would be illegal under Danish law, and the content could be reported to online sharing platforms as illegal content.

#

Copyright in the Digital Single Market Directive (Date not recorded): Article 4 allows text and data mining unless rights are reserved, and Article 15 press publishers' right is at issue in Case C-250/25.

6 instruments · 3 obligations · 15 claims · Next: (Danish minister's hoped-for start of the deepfake copyright amendment)

6 instruments (6 current) · 3 obligations · 15 claims · 2 milestones

Instruments

  • Copyright in the Digital Single Market Directive Date not recorded

    Article 4 allows text and data mining unless rights are reserved, and Article 15 press publishers' right is at issue in Case C-250/25.

    Legal force not established · Verified · Official text
  • Denmark: draft Copyright Act amendment on realistic digital imitations (deepfakes) Draft, no legal force

    Draft Danish copyright amendment protecting people's likeness and voice against realistic AI imitations, with satire and parody carve-outs.

    Verified · Official text
  • Digital Omnibus on data (GDPR, ePrivacy and data acquis amendments) Draft, no legal force

    Commission proposal that would let controllers rely on legitimate interest for AI training and operation.

    Verified
  • EDPB Opinion 28/2024 on data protection aspects of AI models Valid from 2024-12-17

    European Data Protection Board opinion on anonymity of AI models, legitimate interest and the consequences of unlawfully processed training data.

    Non-binding · Verified · Official text
  • European Parliament report on copyright and generative AI (A10-0019/2026) Date not recorded

    Parliament own-initiative report on copyright and generative AI (procedure 2025/2058(INI)), adopted text P10_TA(2026)0066.

    Non-binding · Verified · Official text
  • Italian Law on artificial intelligence Valid from 2025-10-10

    Italian national framework law designating AgID and ACN, regulating AI in work and professions, copyright and criminal law.

    Binding · Authority: National Cybersecurity Agency (ACN), Agenzia per l'Italia digitale (AgID) · Verified · Official text

Obligations

  • Article 53(1)(c)

    Providers of general-purpose AI models must put in place a policy to comply with Union copyright law, including identifying and complying with rights reservations under Article 4(3) of Directive (EU) 2019/790.

    other · Applies to: provider · Artificial Intelligence Act
  • Article 4(3)

    The text and data mining exception for lawful access applies only where rightholders have not expressly reserved their rights in an appropriate manner, such as machine-readable means for online content.

    other · Applies to: other · Copyright in the Digital Single Market Directive
  • Art. 25(1)(b), inserting Art. 70-septies of Law 633/1941

    Reproductions and extractions from lawfully accessible works for text and data mining by AI systems are permitted in line with Articles 70-ter and 70-quater.

    other · Applies to: other · Italian Law on artificial intelligence

Milestones

  • Italian Law 132/2025 enters into force Met
    Italian Law on artificial intelligence
  • (month)Danish minister's hoped-for start of the deepfake copyright amendment Upcoming
    Denmark: draft Copyright Act amendment on realistic digital imitations (deepfakes)
Claims and evidence (15)
  • GPAI providers must keep technical documentation, inform downstream providers, maintain a copyright-compliance policy and publish a training-content summary.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • The CJEU held its first hearing on generative AI and copyright in Like Company v Google (C-250/25) on 24 April 2026; the status of any Advocate General opinion is unconfirmed.

    Confidence: Uncertain · As of 24 Apr 2026 · evidenced
    Evidence and sources
  • The Article 4 text and data mining exception applies only where rightholders have not expressly reserved their rights in an appropriate manner, such as machine-readable means for online content.

    Confidence: Probable · evidenced
    Evidence and sources
    • Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market T1 · retrieved · retrieved 8 Oct 2026 · Article 4(3)The exception or limitation provided for in paragraph 1 shall apply on condition that the use of works and other subject matter referred to in that paragraph has not been expressly reserved by their rightholders in an appropriate manner, such as machine-readable means in the case of content made publicly available online.
  • On 29 September 2026 the Commission announced it is gathering feedback on options for future measures on technology, including AI, and effective copyright protection.

    Confidence: Probable · As of 29 Sep 2026 · evidenced
    Evidence and sources
    • EU copyright law T1 · retrieved · retrieved 8 Oct 2026 · Latest news, 29 September 2026The European Commission is gathering feedback on challenges and options for potential future measures to support the impact of technology, including artificial intelligence, on the effective copyright protection amid market and technology developments of creative works and innovations.
  • Case C-250/25 Like Company v Google Ireland, a preliminary reference lodged 3 April 2025 concerning chatbot outputs reproducing press publisher content, held its first oral hearing on 10 March 2026.

    Confidence: Confirmed · As of 10 Mar 2026 · evidenced
    Evidence and sources
  • Derived: Probable GEMA reports that the Munich Regional Court ruled on 11 November 2025 that OpenAI needed rights to song lyrics for training and operating ChatGPT.

    Confidence: Uncertain · As of 11 Nov 2025 · evidenced
    Evidence and sources
  • Derived: Probable GEMA reports a Munich Regional Court decision against SUNO announced 31 July 2026 in a case filed 21 January 2025.

    Confidence: Uncertain · As of 31 Jul 2026 · evidenced
    Evidence and sources
  • Derived: Probable Heise reports that the Higher Regional Court Hamburg dismissed the photographer's appeal against LAION and allowed a further appeal on points of law.

    Confidence: Uncertain · As of 10 Dec 2025 · evidenced
    Evidence and sources
  • The European Parliament report A10-0019/2026 on copyright and generative AI lists adopted text P10_TA(2026)0066.

    Confidence: Probable · evidenced
    Evidence and sources
    • Report A10-0019/2026 on copyright and generative artificial intelligence T1 · retrieved · retrieved 8 Oct 2026 · Report titlecopyright and generative artificial intelligence – opportunities and challenges 25.2.2026 - (2025/2058(INI)) Committee on Legal Affairs Rapporteur: Axel Voss PR_INI Procedure : 2025/2058(INI) Document stages in plenary Document selected : A10-0019/2026 Texts tabled : A10-0019/2026 Debates : Votes : Texts adopted :
    • Report A10-0019/2026 on copyright and generative artificial intelligence T1 · retrieved · retrieved 8 Oct 2026 · Procedure boxTexts adopted : P10_TA(2026)0066 - MOTION FOR A EUROPEAN PARLIAMENT RESOLUTION - EXPLANATORY STATEMENT - ANNEX: DECLARATION OF INPUT - INFORMATION ON ADOPTION IN COMMITTEE RESPONSIBLE - FINAL VOTE BY
  • Article 25 of Law 132/2025 inserts Article 70-septies into Law 633/1941, permitting TDM reproductions and extractions by AI systems in line with Articles 70-ter and 70-quater.

    Confidence: Probable · As of 10 Oct 2025 · evidenced
    Evidence and sources
    • Gazzetta Ufficiale Serie Generale n. 223 of 25-9-2025 (Legge 132/2025 full text) T1 · retrieved · retrieved 8 Oct 2026 · Art. 25(1)(b), inserting Art. 70-septies l. 633/1941reproductions and extractions from works or other materials contained in the network or in databases to which one has lawful access, for the purposes of text and data mining through artificial intelligence models and systems, including generative ones, are permitted in accordance with the provisions of Articles 70-ter and 70-quater
  • The European Data Protection Board adopted Opinion 28/2024 on data protection aspects of the processing of personal data in the context of AI models on 17 December 2024.

    Confidence: Confirmed · As of 17 Dec 2024 · evidenced
    Evidence and sources
  • The Digital Omnibus on data (COM(2025) 837) was tabled by the Commission on 19 November 2025 and is at the Tabled status.

    Confidence: Probable · As of 19 Nov 2025 · evidenced
    Evidence and sources
  • The proposal would let companies rely on the GDPR legitimate-interest basis to use personal data for training or operating AI systems, subject to conditions.

    Confidence: Probable · As of 19 Nov 2025 · evidenced
    Evidence and sources
  • Denmark has notified to the European Commission, under TRIS procedure 2025/0654/DK, a draft act amending its Copyright Act to address realistic AI-generated digital imitations (deepfakes).

    Confidence: Confirmed · As of 1 Jun 2026 · evidenced
    Evidence and sources
    • Denmark's proposed copyright rules on deepfakes T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphDenmark has notified a draft act amending its Copyright Act to address realistic digitally generated imitations, commonly known as 'deepfakes'.
  • Under the notified Danish draft, unauthorised publication of realistic AI-generated imitations of a person would be illegal and could be reported to online sharing platforms as illegal content, subject to satire and parody exceptions.

    Confidence: Confirmed · As of 1 Jun 2026 · evidenced
    Evidence and sources
    • Denmark's proposed copyright rules on deepfakes T1 · retrieved · retrieved 8 Oct 2026 · BodyAs set out in the TRIS notification, such unauthorised publication would be illegal under Danish law, and the content could be reported to online sharing platforms as illegal content.

#

CCW GGE on LAWS - rolling text (18 December 2025 version) (Draft, no legal force): Draft rolling text under negotiation in the UN CCW Group of Governmental Experts on lethal autonomous weapons systems.

11 instruments · 10 obligations · 24 claims · Next: (Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply)

11 instruments (11 current) · 10 obligations · 24 claims · 13 milestones

Instruments

  • CCW GGE on LAWS - rolling text (18 December 2025 version) Draft, no legal force

    Draft rolling text under negotiation in the UN CCW Group of Governmental Experts on lethal autonomous weapons systems.

    Verified · Official text
  • Data Act Valid from 2025-09-12

    Data access and cloud-switching rules that affect AI data supply and cloud-hosted AI services.

    Binding · Verified · Official text
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • Digital Services Act Valid from 2024-02-17

    Platform regulation under which the Commission designates very large platforms and search engines (now including ChatGPT) and enforces systemic-risk duties covering algorithmic systems.

    Binding · Authority: European Commission (DG CNECT), Digital Services Act enforcement · Verified · Official text
  • ESAs statement on ICT risks from frontier AI models Valid from 2026-07-31

    Joint EBA, EIOPA and ESMA statement calling for consistent risk-based supervision of ICT risks from frontier AI models.

    Non-binding · Verified · Official text
  • EU KIDS Act proposal Draft, no legal force

    Commission proposal to protect children online that would require AI companions and chatbots off by default.

    Verified
  • Italian Law on artificial intelligence Valid from 2025-10-10

    Italian national framework law designating AgID and ACN, regulating AI in work and professions, copyright and criminal law.

    Binding · Authority: National Cybersecurity Agency (ACN), Agenzia per l'Italia digitale (AgID) · Verified · Official text
  • Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability) In force since 2026-09-30

    Regulates police use of AI systems, adds a Criminal Code offence and corporate liability, and sets civil-procedure rules on evidence and causation for AI damage.

    Binding · Verified · Official text
  • Machinery Regulation (EU) 2023/1230 Valid from 2027-01-20

    Product-safety regulation that adds essential requirements for machinery with self-evolving behaviour and requires third-party assessment for self-evolving machine-learning safety components.

    Binding · Verified · Official text
  • MDCG 2025-6 FAQ on the interplay between MDR/IVDR and the AI Act Valid from 2025-06-01

    Commission-hosted MDCG FAQ dated June 2025 on how the AI Act interacts with the medical device regulations.

    Non-binding · Verified · Official text
  • Platform Work Directive Date not recorded

    Gives platform workers transparency about, and limits on, automated monitoring and decision-making systems.

    Legal force not established · Verified · Official text

Obligations

  • Article 3(1) (new third and following paragraphs of Article 8 of Regulation 2023/1230)

    The Commission must adopt delegated acts amending Annex III of the Machinery Regulation to add health and safety requirements for high-risk AI systems that are machinery safety components or machinery, and those acts must apply by 2 August 2028.

    other · Applies to: other · Digital Omnibus on AI
  • Art. 11(2)

    The employer or principal must inform the worker of the use of artificial intelligence in the cases and manner of Article 1-bis of Legislative Decree 152/1997.

    transparency disclosure · Applies to: deployer · Italian Law on artificial intelligence
  • Article 6(1), Article 25(2) and Annex I Part A points 5-6

    Manufacturers of safety components with fully or partially self-evolving machine-learning behaviour, and of machinery embedding such systems, must use a third-party conformity assessment procedure (EU type-examination, full quality assurance or unit verification).

    conformity assessment · Applies to: product manufacturer · Machinery Regulation (EU) 2023/1230
  • Annex III Part B point 1

    Manufacturers must include in their risk assessment hazards that may arise over the lifecycle from the intended evolution of self-evolving behaviour or logic in machinery designed to operate with varying levels of autonomy.

    risk management · Applies to: product manufacturer · Machinery Regulation (EU) 2023/1230
  • Article 34(1)

    Providers of very large online platforms and search engines must diligently identify, analyse and assess systemic risks from the design or functioning of their service, including algorithmic systems.

    risk management · Applies to: other · Digital Services Act
  • Article 23

    Providers of data processing services must take the measures in Articles 25 to 30 to enable customers to switch between services.

    other · Applies to: other · Data Act
  • Article 9(1)

    Digital labour platforms must inform platform workers, their representatives and on request authorities of the use of automated monitoring or decision-making systems.

    transparency disclosure · Applies to: other · Platform Work Directive
  • Article 7(1)(a)

    Digital labour platforms may not use automated monitoring or decision-making systems to process personal data on the emotional or psychological state of a person performing platform work.

    prohibition · Applies to: other · Platform Work Directive
  • Pillar on safety by design (press release summary)

    AI companions and chatbots would have to be turned off by default for children and could not simulate interpersonal relationships that create emotional dependency.

    other · Applies to: provider · EU KIDS Act proposal
  • Article 18(1)

    In damages actions, where damage results from breach of one or more AI Act obligations, the causal link and the damage are presumed unless the contrary is proved.

    other · Applies to: other · Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)

Milestones

  • Data Act applies Met
    Data Act
  • Italian Law 132/2025 enters into force Met
    Italian Law on artificial intelligence
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • Italian Legislative Decree 160/2026 enters into force Met
    Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • Platform Work Directive transposition deadline Upcoming
    Platform Work Directive
  • (month)ChatGPT, as designated very large online search engine, must comply with additional Digital Services Act obligations (four months after designation) Upcoming
    Digital Services Act
  • Machinery Regulation applies and Directive 2006/42/EC is repealed Upcoming
    Machinery Regulation (EU) 2023/1230
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (24)
  • The ESAs (EBA, EIOPA, ESMA) published a joint statement on 31 July 2026 calling for consistent cross-sectoral supervision of ICT risk from frontier AI models in finance.

    Confidence: Probable · As of 31 Jul 2026 · evidenced
    Evidence and sources
  • The Medical Device Coordination Group published FAQ MDCG 2025-6 (June 2025) on the interplay between the MDR/IVDR and the AI Act.

    Confidence: Probable · As of 1 Jun 2025 · evidenced
    Evidence and sources
    • MDCG endorsed documents and other guidance T1 · retrieved · retrieved 8 Oct 2026 · Guidance tableMDCG 2025-6|FAQ on Interplay between the Medical Devices Regulation (MDR) & In vitro Diagnostic Medical Devices Regulation (IVDR) and the Artificial Intelligence Act (AIA)|June 2025
  • Regulation (EU) 2026/1744 amends the Machinery Regulation, adding a duty on the Commission to adopt delegated acts by 2 August 2028 on health and safety requirements for high-risk AI systems that are safety components of or constitute machinery, and a presumption of conformity route through AI Act standards.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 3(1) (new Article 8 paragraphs)The Commission shall adopt delegated acts in accordance with Article 47 of this Regulation to amend Annex III to this Regulation by adding health and safety requirements in respect of Artificial Intelligence (AI) systems that are classified as high-risk pursuant to Article 6(1) of Regulation (EU) 2024/1689
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 3(1) (new Article 8 paragraphs)Those delegated acts shall apply by 2 August 2028.
    • Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 3(2) (new Article 20(10))10. Until harmonised standards or common specifications are referenced or adopted pursuant to this Article as regards high-risk AI systems, high-risk AI systems within the scope of this Regulation which comply with the relevant harmonised standards referenced, or common specifications adopted pursuant to Articles 40 and, respectively, 41 of Regulation (EU) 2024/1689 shall be presumed to be in conformity with the essential health and safety requirements set out in Annex III to this Regulation as regards high-risk AI systems.
  • The EBA, EIOPA and ESMA published a joint statement on 31 July 2026 calling for consistent supervision of ICT risks from frontier AI models in EU financial services.

    Confidence: Probable · As of 31 Jul 2026 · evidenced
    Evidence and sources
  • MDCG 2025-6 is a Commission-hosted FAQ, dated June 2025, on the interplay between the MDR/IVDR and the AI Act.

    Confidence: Probable · As of 1 Jun 2025 · evidenced
    Evidence and sources
    • MDCG endorsed documents and other guidance T1 · retrieved · retrieved 8 Oct 2026 · Guidance tableMDCG 2025-6|FAQ on Interplay between the Medical Devices Regulation (MDR) & In vitro Diagnostic Medical Devices Regulation (IVDR) and the Artificial Intelligence Act (AIA)|June 2025
  • The UN CCW Group of Governmental Experts on lethal autonomous weapons systems is mandated to meet for 10 days in 2026 (2-6 March and 31 August-4 September), working from a rolling text dated 18 December 2025.

    Confidence: Probable · As of 18 Dec 2025 · evidenced
    Evidence and sources
  • Regulation (EU) 2023/1230 on machinery sets categories of machinery, including safety components with fully or partially self-evolving machine-learning behaviour, that require third-party conformity assessment.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Regulation (EU) 2023/1230 on machinery (Official Journal text) T1 · retrieved · retrieved 8 Oct 2026 · Article 6(1)Machinery and related products that fall within the categories listed in Annex I, Part A, shall be subject to the specific conformity assessment procedures referred to in Article 25(2), and machinery and related products that fall within the categories listed in Annex I, Part B shall be subject to the specific conformity assessment procedures referred to in Article 25(3).
    • Regulation (EU) 2023/1230 on machinery (Official Journal text) T1 · retrieved · retrieved 8 Oct 2026 · Annex I, Part A, points 5 and 6Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions. Machinery that has embedded systems with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions that have not been placed independently on the market, in respect only of those systems.
  • Derived: Probable The Machinery Regulation repeals Directive 2006/42/EC with effect from 20 January 2027.

    Confidence: Probable · As of 20 Jan 2027 · evidenced
    Evidence and sources
  • Annex I Part A of the Machinery Regulation lists safety components with fully or partially self-evolving machine-learning behaviour as categories subject to third-party conformity assessment.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Regulation (EU) 2023/1230 on machinery (Official Journal text) T1 · retrieved · retrieved 8 Oct 2026 · Article 6(1)Machinery and related products that fall within the categories listed in Annex I, Part A, shall be subject to the specific conformity assessment procedures referred to in Article 25(2), and machinery and related products that fall within the categories listed in Annex I, Part B shall be subject to the specific conformity assessment procedures referred to in Article 25(3).
    • Regulation (EU) 2023/1230 on machinery (Official Journal text) T1 · retrieved · retrieved 8 Oct 2026 · Annex I, Part A, points 5 and 6Safety components with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions. Machinery that has embedded systems with fully or partially self-evolving behaviour using machine learning approaches ensuring safety functions that have not been placed independently on the market, in respect only of those systems.
  • Regulation (EU) 2022/2065 (Digital Services Act) applies from 17 February 2024; Commission and national enforcement against AI-related services runs through it.

    Confidence: Confirmed · As of 17 Feb 2024 · evidenced
    Evidence and sources
  • Providers of very large online platforms and search engines must assess systemic risks stemming from the design or functioning of their service, including algorithmic systems.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 34(1)Providers of very large online platforms and of very large online search engines shall diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services.
  • Derived: Probable The Commission may fine a provider of a very large online platform or search engine up to 6% of total worldwide annual turnover.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 74(1)In the decision referred to in Article 73, the Commission may impose on the provider of the very large online platform or of the very large online search engine concerned fines not exceeding 6 % of its total worldwide annual turnover in the preceding financial year
  • The Commission designated ChatGPT as a very large online search engine under the Digital Services Act, with compliance with additional obligations due by around January 2027.

    Confidence: Confirmed · As of 31 Aug 2026 · evidenced
    Evidence and sources
  • Regulation (EU) 2024/2847 (Cyber Resilience Act) sets cybersecurity requirements for products with digital elements, including AI-enabled products, with staged application dates.

    Confidence: Confirmed · evidenced
    Evidence and sources
  • The Data Act applies from 12 September 2025.

    Confidence: Confirmed · As of 12 Sep 2025 · evidenced
    Evidence and sources
  • Providers of data processing services, including cloud services used for AI, must enable customer switching under Articles 25 to 30 of the Data Act.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Regulation (EU) 2023/2854 (Data Act), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 23Providers of data processing services shall take the measures provided for in Articles 25, 26, 27, 29 and 30 to enable customers to switch to a data processing service, covering the same service type, which is provided by a different provider of data processing services, or to on-premises ICT infrastructure, or, where relevant, to use several providers of data processing services at the same time.
  • Member States must transpose the Platform Work Directive by 2 December 2026.

    Confidence: Confirmed · As of 2 Dec 2026 · evidenced
    Evidence and sources
  • Digital labour platforms must inform platform workers, their representatives and, on request, authorities of the use of automated monitoring or decision-making systems.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Directive (EU) 2024/2831 (Platform Work Directive), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 9(1)Member States shall require digital labour platforms to inform persons performing platform work, platform workers' representatives and, upon request, national competent authorities, of the use of automated monitoring systems or automated decision-making systems.
  • Digital labour platforms may not use automated monitoring or decision-making systems to process personal data on a worker's emotional or psychological state.

    Confidence: Confirmed · evidenced
    Evidence and sources
  • The Commission adopted the EU KIDS Act proposal (COM(2026) 681) on 17 September 2026.

    Confidence: Confirmed · As of 17 Sep 2026 · evidenced
    Evidence and sources
  • The proposal would require AI companions and chatbots to be off by default and bar simulation of interpersonal relationships creating emotional dependency.

    Confidence: Confirmed · As of 17 Sep 2026 · evidenced
    Evidence and sources
  • Derived: Probable Italian Legislative Decree 9 September 2026, n. 160 was published in the Gazzetta Ufficiale and adapts national law to the AI Act for police use and liability.

    Confidence: Confirmed · As of 30 Sep 2026 · evidenced
    Evidence and sources
  • Derived: Probable The Italian decree enters into force on 30 September 2026.

    Confidence: Confirmed · As of 30 Sep 2026 · evidenced
    Evidence and sources
  • Derived: Probable Article 18 presumes the causal link where damage results from breach of one or more AI Act obligations, unless the contrary is proved.

    Confidence: Probable · As of 30 Sep 2026 · evidenced
    Evidence and sources

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

4 instruments · 3 obligations · 3 claims · Next: (Providers of GPAI models placed on the market before 2 August 2025 must comply)

4 instruments (4 current) · 3 obligations · 3 claims · 8 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Cyber Resilience Act Valid from 2024-12-10

    Cybersecurity requirements for products with digital elements; the AI Act treats compliance with the CRA's essential requirements as supporting Article 15 cybersecurity compliance for high-risk AI.

    Binding · Verified · Official text
  • Draft guidance and reporting template on serious AI incidents Draft, no legal force

    Draft Commission guidance and template for Article 73 serious incident reporting.

    Verified · Official text
  • General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland) Draft, no legal force

    Pre-legislative draft heads of the Irish AI implementing bill, covering the national register, serious incident reporting and contravention notices.

    Verified · Official text

Obligations

  • Article 73(1)-(2)

    Providers of high-risk AI systems must report serious incidents to the market surveillance authorities of the Member State where it occurred, immediately and in any event within 15 days of awareness.

    incident reporting · Applies to: provider · Artificial Intelligence Act
  • Head 42(1)

    Providers of high-risk AI systems would report serious incidents to the relevant Irish market surveillance authority (draft head).

    incident reporting · Applies to: provider · General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland)
  • Article 14(1)

    Manufacturers must notify actively exploited vulnerabilities in products with digital elements to the designated CSIRT and ENISA.

    incident reporting · Applies to: product manufacturer · Cyber Resilience Act

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Cyber Resilience Act Chapter IV (conformity assessment bodies) applies Met
    Cyber Resilience Act
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Cyber Resilience Act Article 14 reporting of actively exploited vulnerabilities applies Met
    Cyber Resilience Act
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • Cyber Resilience Act applies generally Upcoming
    Cyber Resilience Act
Claims and evidence (3)
  • High-risk AI providers must meet Article 16 duties and report serious incidents under Article 73, and deployers must meet Article 26 duties, from 2 December 2027 for Annex III systems.

    Confidence: Probable · As of 2 Dec 2027 · evidenced
    Evidence and sources
  • The Commission issued draft guidance and a reporting template on serious AI incidents on 26 September 2025 with feedback closing on 7 November 2025.

    Confidence: Probable · As of 26 Sep 2025 · evidenced
    Evidence and sources
  • Derived: Probable The General Scheme of the Regulation of Artificial Intelligence Bill 2026, published by Ireland's Department of Enterprise, sets out draft heads for a national AI register, serious-incident reporting and contravention notices.

    Confidence: Probable · As of 4 Feb 2026 · evidenced
    Evidence and sources
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 37(1)Head 37 - National Register and Reporting Obligations To provide that: (1) The Office shall establish and maintain a national register of: a. all instances of prohibited AI practices under Article 5; b. High-risk AI systems referred to in point 2 of Annex III.
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 42(1)Head 42 - Serious incidents To provide that: (1) Relevant Market Surveillance Authorities will receive reports of serious incidents from providers of High-Risk AI (HRAI) systems where the incident occurred.
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 55(1)Head 55 - Contravention notice To provide that: (1) An authorised officer who is of the opinion that a person or entity is contravening or has contravened any provision of this Act or the AI Act may service a notice (in this Act referred to as a 'contravention notice') on the person or entity.

#

Commission standardisation request C(2025) 129 for machinery and related products (Valid from 2025-01-20): Request for new and revised harmonised standards supporting the Machinery Regulation.

6 instruments · 3 obligations · 9 claims · Next: (CEN and CENELEC target for availability of JTC 21 standards)

6 instruments (5 current) · 3 obligations · 9 claims · 6 milestones

Instruments

  • Commission standardisation request C(2025) 129 for machinery and related products Valid from 2025-01-20

    Request for new and revised harmonised standards supporting the Machinery Regulation.

    Conditionally binding · Verified · Official text
  • Commission standardisation request C(2025) 3871 for high-risk AI systems (M/613) Valid from 2025-06-23

    Revised request to CEN and Cenelec for harmonised standards supporting the AI Act, repealing the 2023 request; deadline 31 August 2025 with the decision expiring on 28 February 2027.

    Conditionally binding · Verified · Official text
  • Cyber Resilience Act Valid from 2024-12-10

    Cybersecurity requirements for products with digital elements; the AI Act treats compliance with the CRA's essential requirements as supporting Article 15 cybersecurity compliance for high-risk AI.

    Binding · Verified · Official text
  • EN 18286 Artificial Intelligence - Quality Management System for EU AI Act Regulatory Purposes Date not recorded

    CEN-CENELEC standard supporting Article 17 quality management; approved June 2026, Official Journal citation expected later in 2026.

    Non-binding · Verified · Official text
  • EN ISO/IEC 42001:2026 Artificial intelligence management system Valid from 2026-03-31

    European adoption of the AI management system standard ISO/IEC 42001 with no technical changes.

    Non-binding · Verified · Official text
  • Commission standardisation request C(2023) 3215 on artificial intelligence (M/593) Superseded Not current

    First AI standardisation request to CEN and CENELEC with a 30 April 2025 deadline, repealed and replaced in June 2025.

    Conditionally binding · Verified · Official text

Obligations

  • Article 1(1)

    CEN and Cenelec are requested to draft the harmonised standards and European standardisation deliverables listed in Annex I in support of the AI Act by 31 August 2025.

    other · Applies to: other · Commission standardisation request C(2025) 3871 for high-risk AI systems (M/613)
  • Article 3(1)

    CEN and Cenelec must report to the Commission every three months on progress in executing the request.

    other · Applies to: other · Commission standardisation request C(2025) 3871 for high-risk AI systems (M/613)
  • Article 1(1)

    CEN and CENELEC are requested to draft new harmonised standards and amend or revise existing ones in support of the Machinery Regulation by the Annex I deadlines.

    other · Applies to: other · Commission standardisation request C(2025) 129 for machinery and related products

Milestones

  • Deadline for CEN and Cenelec to draft AI Act harmonised standards under the request Moved
    Commission standardisation request C(2025) 3871 for high-risk AI systems (M/613)
  • Cyber Resilience Act Chapter IV (conformity assessment bodies) applies Met
    Cyber Resilience Act
  • Cyber Resilience Act Article 14 reporting of actively exploited vulnerabilities applies Met
    Cyber Resilience Act
  • (quarter)CEN and CENELEC target for availability of JTC 21 standards Upcoming
    Commission standardisation request C(2025) 3871 for high-risk AI systems (M/613)
  • Standardisation request C(2025) 3871 expires Upcoming
    Commission standardisation request C(2025) 3871 for high-risk AI systems (M/613)
  • Cyber Resilience Act applies generally Upcoming
    Cyber Resilience Act
Claims and evidence (9)
  • Derived: Probable EN 18286, approved by CEN-CENELEC in June 2026, is the first AI Act harmonised standard, covering the Article 17 quality management system; its Official Journal citation is pending.

    Confidence: Probable · As of 29 Jul 2026 · evidenced
    Evidence and sources
    • AI Act standardisation T1 · retrieved · retrieved 8 Oct 2026 · Standards18286: Artificial Intelligence - Quality Management System for EU AI Act Regulatory Purposes became the first harmonised standard for AI to enter public enquiry, allowing for national standardisation bodies to provide comments on the draft before its final publication.
    • CEN-CENELEC newsletter: ANEC contribution to EN 18286 T1 · retrieved · retrieved 8 Oct 2026 · Newsletter itemIn June, CEN and CENELEC approved EN 18286 'Artificial Intelligence: Quality Management System for EU AI Act Regulatory Purposes', the first European standard developed to support the implementation of the EU AI Act.
  • CEN and CENELEC approved EN 18286 in June 2026 and the Commission is expected to publish its reference in the Official Journal later in 2026, so no presumption of conformity yet follows.

    Confidence: Probable · evidenced
    Evidence and sources
    • CEN-CENELEC newsletter: ANEC contribution to EN 18286 T1 · retrieved · retrieved 8 Oct 2026 · Newsletter itemIn June, CEN and CENELEC approved EN 18286 'Artificial Intelligence: Quality Management System for EU AI Act Regulatory Purposes', the first European standard developed to support the implementation of the EU AI Act.
    • AI Act standardisation T1 · retrieved · retrieved 8 Oct 2026 · Standards18286: Artificial Intelligence - Quality Management System for EU AI Act Regulatory Purposes became the first harmonised standard for AI to enter public enquiry, allowing for national standardisation bodies to provide comments on the draft before its final publication.
  • BSI lists BS EN ISO/IEC 42001:2026 as the European and UK adoption of ISO/IEC 42001, published 31 March 2026.

    Confidence: Uncertain · As of 31 Mar 2026 · evidenced
    Evidence and sources
    • BS EN ISO/IEC 42001:2026 product page T3 · retrieved · retrieved 8 Oct 2026 · Product pageBS EN ISO/IEC 42001:2026 | 31 Mar 2026 | BSI Knowledge Standard # BS EN ISO/IEC 42001:2026 ## Information technology.
  • Commission Implementing Decision C(2025) 3871 of 23 June 2025 requests CEN and Cenelec to draft harmonised standards for high-risk AI systems under the AI Act, repeals Implementing Decision C(2023) 3215, and expires on 28 February 2027.

    Confidence: Confirmed · As of 23 Jun 2025 · evidenced
    Evidence and sources
  • CEN and Cenelec reported significant delays in AI Act standardisation work in their September 2024 joint semestrial report, prompting the Commission to set a new standards deadline of 31 August 2025.

    Confidence: Confirmed · As of 23 Jun 2025 · evidenced
    Evidence and sources
  • On 14-16 October 2025 the CEN and CENELEC Technical Boards adopted exceptional measures, including direct publication after a positive Enquiry vote, to make JTC 21 AI Act standards available by Q4 2026.

    Confidence: Probable · As of 23 Oct 2025 · evidenced
    Evidence and sources
  • Commission Implementing Decision C(2023) 3215, which set a 30 April 2025 AI standardisation deadline, was repealed by Implementing Decision C(2025) 3871 on 23 June 2025.

    Confidence: Confirmed · As of 23 Jun 2025 · evidenced
    Evidence and sources
  • Commission Implementing Decision C(2025) 129 of 20 January 2025 requests CEN and CENELEC to draft and revise harmonised standards supporting the Machinery Regulation (EU) 2023/1230, which covers machinery with AI-enabled self-evolving behaviour.

    Confidence: Confirmed · As of 20 Jan 2025 · evidenced
    Evidence and sources
  • CEN and CENELEC approved EN 18286, the first European standard developed to support implementation of the AI Act, in June 2026.

    Confidence: Confirmed · As of 1 Jun 2026 · evidenced
    Evidence and sources
    • CEN-CENELEC newsletter: ANEC contribution to EN 18286 T1 · retrieved · retrieved 8 Oct 2026 · Newsletter itemIn June, CEN and CENELEC approved EN 18286 'Artificial Intelligence: Quality Management System for EU AI Act Regulatory Purposes', the first European standard developed to support the implementation of the EU AI Act.

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

15 instruments · 14 obligations · 38 claims · Next: (Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force)

15 instruments (15 current) · 14 obligations · 38 claims · 21 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Danish Act supplementing the AI Regulation Valid from 2025-08-02

    Danish act designating national competent authorities, giving them information and inspection powers and setting fines for Article 5 breaches.

    Binding · Authority: Agency for Digital Government, Datatilsynet, Domstolsstyrelsen · Verified · Official text
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • Digital Services Act Valid from 2024-02-17

    Platform regulation under which the Commission designates very large platforms and search engines (now including ChatGPT) and enforces systemic-risk duties covering algorithmic systems.

    Binding · Authority: European Commission (DG CNECT), Digital Services Act enforcement · Verified · Official text
  • Dutch draft implementation act for the AI Regulation Draft, no legal force

    Draft act on national AI supervision put out for internet consultation on 20 April 2026.

    Verified · Official text
  • Finland: Act 1377/2025 on the supervision of certain AI systems In force since 2026-01-01

    Allocates AI Act market surveillance in Finland, with a penalty payment board at Traficom and fines up to EUR 35 million or 7% of turnover.

    Binding · Authority: Finnish Transport and Communications Agency (Traficom), Data Protection Ombudsman (Finland) · Verified · Official text
  • France: DDADUE bill (adaptation to EU law), Article 24 on AI systems Draft, no legal force

    Omnibus adaptation bill whose Article 24 subjects AI systems to the AI Act; competent authorities are to be named by a later amendment.

    Verified · Official text
  • General Data Protection Regulation Valid from 2018-05-25

    Data protection law that applies to AI training and use of personal data; Article 22 restricts solely automated decisions and Article 83 sets the fines used by national data protection authorities, including against AI providers.

    Binding · Verified · Official text
  • General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland) Draft, no legal force

    Pre-legislative draft heads of the Irish AI implementing bill, covering the national register, serious incident reporting and contravention notices.

    Verified · Official text
  • German AI market surveillance and innovation promotion act (KI-MIG) Valid from 2026-07-29

    German act making the Bundesnetzagentur market surveillance authority, contact point and complaints body and providing for a sandbox.

    Binding · Authority: Federal Network Agency (Bundesnetzagentur) · Verified · Official text
  • Implementing Regulation on the scientific panel of independent experts Date not recorded

    Establishes the scientific panel that advises the AI Office and national authorities on general-purpose AI models with systemic risk.

    Binding · Authority: Scientific Panel of independent experts under the AI Act · Verified · Official text
  • Italian Law on artificial intelligence Valid from 2025-10-10

    Italian national framework law designating AgID and ACN, regulating AI in work and professions, copyright and criminal law.

    Binding · Authority: National Cybersecurity Agency (ACN), Agenzia per l'Italia digitale (AgID) · Verified · Official text
  • Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability) In force since 2026-09-30

    Regulates police use of AI systems, adds a Criminal Code offence and corporate liability, and sets civil-procedure rules on evidence and causation for AI damage.

    Binding · Verified · Official text
  • Polish Act on artificial intelligence systems Valid from 2026-08-11

    Polish act creating KRiBSI and implementing the AI Act, in force from 11 August 2026 with later start dates for some parts.

    Binding · Authority: Commission for the Development and Security of Artificial Intelligence (KRiBSI) · Verified · Official text
  • Regulation of Artificial Intelligence Act 2026 (Ireland) Valid from 2026-07-31

    Irish act signed on 21 July 2026 establishing the AI Office of Ireland as central coordinating authority.

    Binding · Authority: AI Office of Ireland · Verified · Official text

Obligations

  • Article 75c(1)

    Where the AI Office finds an operator within Article 75(1) non-compliant, it adopts a decision establishing the non-compliance and may impose periodic penalty payments.

    other · Applies to: other · Artificial Intelligence Act
  • § 15(1) Nr. 1 and (3)

    Failing to provide, correctly, completely or in time, information or documentation under Article 21(1) of the AI Act is a national administrative offence punishable by a fine of up to EUR 50,000 (separate from Article 99 fines).

    other · Applies to: other · German AI market surveillance and innovation promotion act (KI-MIG)
  • § 2(1)

    The Bundesnetzagentur is the market surveillance authority for compliance with the AI Act unless the KI-MIG provides otherwise.

    other · Applies to: other · German AI market surveillance and innovation promotion act (KI-MIG)
  • Art. 12(1)

    The Polish AI Commission must issue an individual opinion within 30 days of an application, or within 60 days in particularly complex cases.

    other · Applies to: other · Polish Act on artificial intelligence systems
  • Section 5

    Natural and legal persons within Article 2(1)(a)-(f) of the AI Regulation must supply market surveillance authorities with all information necessary for their supervisory activities on request.

    record keeping · Applies to: other · Danish Act supplementing the AI Regulation
  • Section 10(1)(1)

    Infringement of Article 5(1)(a)-(g) of the AI Regulation is punishable by a fine unless a higher penalty applies under other legislation.

    prohibition · Applies to: other · Danish Act supplementing the AI Regulation
  • Head 37(1)

    The AI Office of Ireland would establish and maintain a national register of prohibited-practice cases, Annex III point 2 high-risk systems and other recordable AI cases (draft head).

    registration · Applies to: other · General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland)
  • Head 55(1) and (11)

    An authorised officer could serve a contravention notice on a person or entity contravening the AI Act or the Act; failure without reasonable excuse to comply would be an offence punishable by a class A fine or up to 6 months' imprisonment (draft heads).

    other · Applies to: other · General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland)
  • Article 10(2)

    Experts on the scientific panel must be independent from any provider of AI systems or general-purpose AI models.

    other · Applies to: other · Implementing Regulation on the scientific panel of independent experts
  • Article 12, inserting Article 437-bis of the Criminal Code

    Omitting the technical safety measures or human oversight measures required for high-risk AI systems is a crime punished with one to five years' imprisonment where danger to life or public or individual safety results.

    prohibition · Applies to: provider · Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)
  • Article 15, inserting Article 25-vicies of Legislative Decree 231/2001

    Entities face a pecuniary sanction of 600 to 1000 quotas for the Article 437-bis offence (other offences covered by the same article carry lower ranges).

    other · Applies to: other · Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)
  • § 4

    The Data Protection Ombudsman supervises, as market surveillance authority, compliance with the prohibited AI practices in Article 5 of the AI Act.

    other · Applies to: other · Finland: Act 1377/2025 on the supervision of certain AI systems
  • § 5(1)

    Traficom supervises, as market surveillance authority, compliance with the Article 50 transparency obligations of the AI Act.

    transparency disclosure · Applies to: other · Finland: Act 1377/2025 on the supervision of certain AI systems
  • § 23

    Penalty payments for breaches may reach EUR 35,000,000 or 7% of turnover for Article 5 breaches (§ 21), EUR 15,000,000 or 3% for other listed breaches, and EUR 7,500,000 for § 20.

    other · Applies to: other · Finland: Act 1377/2025 on the supervision of certain AI systems

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Danish Act 467/2025 enters into force Met
    Danish Act supplementing the AI Regulation
  • Italian Law 132/2025 enters into force Met
    Italian Law on artificial intelligence
  • Finnish Act 1377/2025 enters into force Met
    Finland: Act 1377/2025 on the supervision of certain AI systems
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • German KI-MIG enters into force Met
    German AI market surveillance and innovation promotion act (KI-MIG)
  • Irish Act commences (SI 403/2026) Met
    Regulation of Artificial Intelligence Act 2026 (Ireland)
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Polish AI Act enters into force Met
    Polish Act on artificial intelligence systems
  • Italian Legislative Decree 160/2026 enters into force Met
    Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability)
  • Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force Upcoming
    Polish Act on artificial intelligence systems
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • (month)ChatGPT, as designated very large online search engine, must comply with additional Digital Services Act obligations (four months after designation) Upcoming
    Digital Services Act
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (38)
  • Derived: Probable Breach of provider, deployer, importer, distributor, transparency or GPAI obligations is subject to fines of up to EUR 15 million or 3% of turnover, whichever is higher.

    Confidence: Confirmed · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Supplying incorrect, incomplete or misleading information to a notified body or national authority is subject to fines of up to EUR 7.5 million or 1% of turnover.

    Confidence: Confirmed · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • From 2 August 2026 the AI Office, national market surveillance authorities and the EDPS (for EU institutions) jointly enforce the AI Act.

    Confidence: Confirmed · As of 2 Aug 2026 · evidenced
    Evidence and sources
    • AI Act - Shaping Europe's digital future T1 · retrieved · retrieved 8 Oct 2026 · Governance and enforcementFrom 2 August 2026, the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act.
    • The enforcement framework of the AI Act T1 · retrieved · retrieved 8 Oct 2026 · OverviewThe enforcement of the AI Act is shared between the European Commission's AI Office, the European Data Protection Supervisor, and national competent authorities designated by the Member States.
    • Market Surveillance Authorities under the AI Act T1 · retrieved · retrieved 8 Oct 2026 · EDPSThe European Data Protection Supervisor (EDPS) is the designated market surveillance authority for EU institutions, bodies and agencies.
  • Lucilla Sioli is the Director of the European AI Office within DG CNECT.

    Confidence: Probable · As of 27 Aug 2026 · evidenced
    Evidence and sources
    • Lucilla Sioli - Director of the European AI Office T1 · retrieved · retrieved 8 Oct 2026 · BiographyDr. Lucilla Sioli is the Director of the European AI Office within Directorate-General for Communications Networks, Content and Technology (DG Connect) of the European Commission.
  • The Commission appointed a Scientific Panel and an Advisory Forum on 1 June 2026 to support AI Act enforcement.

    Confidence: Confirmed · As of 1 Jun 2026 · evidenced
    Evidence and sources
    • AI Act enforcement gets independent expert support T1 · retrieved · retrieved 8 Oct 2026 · LeadThe European Commission has appointed a Scientific Panel and an Advisory Forum to support enforcement of the Artificial Intelligence (AI) Act.
    • AI Board convenes its eighth meeting T1 · retrieved · retrieved 8 Oct 2026 · MeetingOn 11 June 2026, the AI Board met under the chairmanship of the Cypriot Presidency of the EU Council to discuss and review the current priorities for implementing the EU AI Policy.
  • The AI Board met for its eighth meeting on 11 June 2026 under the Cypriot Council Presidency.

    Confidence: Probable · As of 11 Jun 2026 · evidenced
    Evidence and sources
    • AI Board convenes its eighth meeting T1 · retrieved · retrieved 8 Oct 2026 · MeetingOn 11 June 2026, the AI Board met under the chairmanship of the Cypriot Presidency of the EU Council to discuss and review the current priorities for implementing the EU AI Policy.
  • The AI Office and national authorities began enforcing the AI Act from 2 August 2026.

    Confidence: Confirmed · As of 2 Aug 2026 · evidenced
    Evidence and sources
  • Member States had to designate market surveillance authorities by 2 August 2025; the Commission's 7 September 2026 list still marks several designations as pending final adoption.

    Confidence: Confirmed · As of 7 Sep 2026 · evidenced
    Evidence and sources
  • The Commission confirmed on 1 September 2026 that the AI Office had sent its first simple requests for information under the AI Act to more than 30 AI companies, on safety/security and copyright/transparency.

    Confidence: Probable · As of 1 Sep 2026 · evidenced
    Evidence and sources
  • New Article 75c empowers the AI Office to adopt non-compliance decisions against GPAI operators and to impose periodic penalty payments.

    Confidence: Confirmed · As of 27 Jul 2026 · evidenced
    Evidence and sources
    • AI Act Service Desk: Article 75c T1 · retrieved · retrieved 8 Oct 2026 · Article 75c(1)Where the AI Office finds that an operator falling within the scope of Article 75(1) does not comply with the relevant provisions of this Regulation or with commitments made binding pursuant to Article 75b, it shall adopt a decision establishing such non-compliance.
    • AI Act Service Desk: Article 75c T1 · retrieved · retrieved 8 Oct 2026 · Article 75c (summary text)The AI Office may also impose periodic penalty payments to compel compliance with investigations, information requests, inspections, corrective measures, binding commitments or non-compliance decisions.
  • Derived: Probable Austria's RTR AI Service Desk rests on section 20c KOG and section 194a TKG; no Austrian AI Act market surveillance designation act was found.

    Confidence: Probable · evidenced
    Evidence and sources
    • KI-Servicestelle der RTR T1 · retrieved · retrieved 8 Oct 2026 · Page bodyThe legal basis for the AI Service Desk is formed by section 20c KOG and section 194a TKG (Federal Law Gazette I No. 6/2024).
  • The Omnibus inserts Article 75a giving the AI Office all powers of a market surveillance authority when supervising AI systems under Article 75(1).

    Confidence: Probable · As of 27 Jul 2026 · evidenced
    Evidence and sources
  • Article 20 of Law 132/2025 designates AgID and the National Cybersecurity Agency as national AI authorities, with Banca d'Italia, CONSOB and IVASS for financial sectors.

    Confidence: Probable · As of 10 Oct 2025 · evidenced
    Evidence and sources
    • Gazzetta Ufficiale Serie Generale n. 223 of 25-9-2025 (Legge 132/2025 full text) T1 · retrieved · retrieved 8 Oct 2026 · Art. 20(1)Art. 20. National authorities for artificial intelligence 1. In order to ensure the application and implementation of national and European Union legislation on artificial intelligence, the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) are designated as national authorities for artificial intelligence
  • The German KI-MIG entered into force on 29 July 2026, making the Bundesnetzagentur the market surveillance authority, contact point and complaints body.

    Confidence: Confirmed · As of 29 Jul 2026 · evidenced
    Evidence and sources
  • Derived: Probable KI-MIG section 15 makes failure to provide information or documentation under Article 21(1) of the AI Act a national administrative offence capped at EUR 50,000.

    Confidence: Confirmed · As of 29 Jul 2026 · evidenced
    Evidence and sources
  • Paul Byrne was announced on 30 July 2026 as first Chief Executive Officer of the AI Office of Ireland.

    Confidence: Probable · As of 30 Jul 2026 · evidenced
    Evidence and sources
  • Article 5 of the Polish AI Act designates the Artificial Intelligence Development and Safety Commission (KRiBSI) as the market surveillance authority and single point of contact under AI Act Article 70.

    Confidence: Confirmed · As of 11 Aug 2026 · evidenced
    Evidence and sources
  • Section 2 of the Danish AI supplementing Act designates Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen as national competent authorities.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Derived: Probable Section 10 of the Danish Act makes infringement of Article 5(1)(a)-(g) of the AI Regulation punishable by a fine, unless a higher penalty applies under other legislation.

    Confidence: Probable · As of 2 Aug 2025 · evidenced
    Evidence and sources
  • Derived: Probable The General Scheme of the Regulation of Artificial Intelligence Bill 2026, published by Ireland's Department of Enterprise, sets out draft heads for a national AI register, serious-incident reporting and contravention notices.

    Confidence: Probable · As of 4 Feb 2026 · evidenced
    Evidence and sources
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 37(1)Head 37 - National Register and Reporting Obligations To provide that: (1) The Office shall establish and maintain a national register of: a. all instances of prohibited AI practices under Article 5; b. High-risk AI systems referred to in point 2 of Annex III.
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 42(1)Head 42 - Serious incidents To provide that: (1) Relevant Market Surveillance Authorities will receive reports of serious incidents from providers of High-Risk AI (HRAI) systems where the incident occurred.
    • General Scheme of the Regulation of Artificial Intelligence Bill 2026 T1 · retrieved · retrieved 8 Oct 2026 · Head 55(1)Head 55 - Contravention notice To provide that: (1) An authorised officer who is of the opinion that a person or entity is contravening or has contravened any provision of this Act or the AI Act may service a notice (in this Act referred to as a 'contravention notice') on the person or entity.
  • Derived: Probable The Commission may fine a provider of a very large online platform or search engine up to 6% of total worldwide annual turnover.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 74(1)In the decision referred to in Article 73, the Commission may impose on the provider of the very large online platform or of the very large online search engine concerned fines not exceeding 6 % of its total worldwide annual turnover in the preceding financial year
  • The Commission designated ChatGPT as a very large online search engine under the Digital Services Act, with compliance with additional obligations due by around January 2027.

    Confidence: Confirmed · As of 31 Aug 2026 · evidenced
    Evidence and sources
  • Derived: Probable Non-compliance with CRA essential cybersecurity requirements and Articles 13-14 carries fines up to EUR 15 million or 2.5% of worldwide turnover, whichever is higher.

    Confidence: Confirmed · evidenced
    Evidence and sources
    • Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text T1 · retrieved · retrieved 8 Oct 2026 · Article 64(2)Non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.
  • On 26 January 2026 the Commission opened a formal investigation against X under the Digital Services Act over risks from deploying Grok in the EU.

    Confidence: Confirmed · As of 26 Jan 2026 · evidenced
    Evidence and sources
  • On 17 February 2026 Ireland's Data Protection Commission opened an inquiry into X Internet Unlimited Company under section 110 of the Data Protection Act 2018, covering GDPR Articles 5, 6, 25 and 35.

    Confidence: Confirmed · As of 17 Feb 2026 · evidenced
    Evidence and sources
    • Data Protection Commission opens investigation into X (XIUC) T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphThe Data Protection Commission (DPC) has today announced that it has opened an inquiry into X Internet Unlimited Company (XIUC) under section 110 of the Data Protection Act 2018.
    • Data Protection Commission opens investigation into X (XIUC) T1 · retrieved · retrieved 8 Oct 2026 · Second paragraphThe purpose of the inquiry is to determine whether XIUC has complied with its obligations under the GDPR, including its obligations under Article 5 (principles of processing), Article 6 (lawfulness of processing), Article 25 (Data Protection by Design and by Default) and Article 35 (requirement to carry out a Data Protection Impact Assessment)
  • Derived: Probable The Tribunale di Roma, by judgment n. 4153/2026 published 18 March 2026, annulled the Garante's November 2024 decision fining OpenAI EUR 15 million, on the ground that the Garante lacked competence.

    Confidence: Probable · As of 18 Mar 2026 · evidenced
    Evidence and sources
  • Derived: Probable The Garante fined Character Technologies Inc. EUR 158,000 by a decision of 3 July 2026, with age-verification measures to follow within 120 days.

    Confidence: Confirmed · As of 3 Jul 2026 · evidenced
    Evidence and sources
  • Commission Implementing Regulation (EU) 2025/454 establishes the scientific panel of independent experts in the field of artificial intelligence.

    Confidence: Confirmed · As of 7 Mar 2025 · evidenced
    Evidence and sources
  • Experts on the AI Act scientific panel must be independent from any provider of AI systems or general-purpose AI models.

    Confidence: Confirmed · As of 7 Mar 2025 · evidenced
    Evidence and sources
  • Derived: Probable Article 12 of the Italian decree inserts Article 437-bis into the Criminal Code, punishing omission of required high-risk AI safety/oversight measures with one to five years' imprisonment where danger to life or safety results.

    Confidence: Probable · As of 30 Sep 2026 · evidenced
    Evidence and sources
  • Derived: Probable Article 15 adds entity liability under Legislative Decree 231/2001 of 600 to 1000 quotas for the Article 437-bis offence.

    Confidence: Probable · As of 30 Sep 2026 · evidenced
    Evidence and sources
  • Finnish Act 1377/2025 on the supervision of certain AI systems was published on 29 December 2025 and allocates AI Act market-surveillance competence in Finland.

    Confidence: Confirmed · As of 1 Jan 2026 · evidenced
    Evidence and sources
  • The Finnish Act enters into force on 1 January 2026.

    Confidence: Confirmed · As of 1 Jan 2026 · evidenced
    Evidence and sources
  • The Data Protection Ombudsman supervises Article 5 prohibited practices and Traficom supervises Article 50 transparency obligations in Finland.

    Confidence: Confirmed · As of 1 Jan 2026 · evidenced
    Evidence and sources
  • Derived: Probable Section 23 sets the maximum penalty payment at EUR 35,000,000 or 7% of turnover for Article 5 breaches, with lower ceilings for other breaches.

    Confidence: Confirmed · As of 1 Jan 2026 · evidenced
    Evidence and sources
  • The French DDADUE bill, tabled 10 November 2025, includes Article 24 subjecting AI systems to the AI Act; the Senate adopted it at first reading and the National Assembly is to examine it.

    Confidence: Probable · As of 10 Nov 2025 · evidenced
    Evidence and sources
  • The Senate report states the bill is to be completed by a Government amendment specifying which French administrations will apply the AI Regulation.

    Confidence: Confirmed · evidenced
    Evidence and sources
  • Derived: Probable The French Senate adopted the bill at first reading in early 2026, but primary and secondary sources disagree on the exact date.

    Confidence: Disputed · evidenced
    Evidence and sources

#

Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

5 instruments · 2 obligations · 4 claims · Next: (Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply)

5 instruments (5 current) · 2 obligations · 4 claims · 13 milestones

Instruments

  • Artificial Intelligence Act Valid from 2024-08-01

    Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.

    Binding · Authority: European AI Office (European Commission), European Data Protection Supervisor · Verified · Official text
  • Digital Omnibus on AI Valid from 2026-07-27

    Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.

    Binding · Authority: European AI Office (European Commission) · Verified · Official text
  • European Innovation Act proposal Draft, no legal force

    Commission proposal presented with a planned separate proposal on regulatory sandboxes.

    Verified
  • German AI market surveillance and innovation promotion act (KI-MIG) Valid from 2026-07-29

    German act making the Bundesnetzagentur market surveillance authority, contact point and complaints body and providing for a sandbox.

    Binding · Authority: Federal Network Agency (Bundesnetzagentur) · Verified · Official text
  • Spanish draft Organic Law for the proper use and governance of AI Draft, no legal force

    Bill approved by the Council of Ministers on 26 May 2026 and before the Congress with amendments due by 30 June 2026.

    Verified · Official text

Obligations

  • Article 57(1) as originally worded

    Member States had to ensure their competent authorities establish at least one national AI regulatory sandbox operational by 2 August 2026; the Omnibus moved this to 2 August 2027.

    other · Applies to: other · Artificial Intelligence Act
  • Article 1(22)(a), amending Article 57(1)

    Member States must ensure their competent authorities establish at least one national AI regulatory sandbox, operational by 2 August 2027, possibly jointly with other Member States.

    other · Applies to: other · Digital Omnibus on AI

Milestones

  • Entry into force of the AI Act Met
    Artificial Intelligence Act
  • Chapters I and II (definitions, prohibitions) apply Met
    Artificial Intelligence Act
  • Governance, GPAI obligations and penalties apply; Member States designate authorities Met
    Artificial Intelligence Act
  • Omnibus enters into force Met
    Digital Omnibus on AI
  • German KI-MIG enters into force Met
    German AI market surveillance and innovation promotion act (KI-MIG)
  • General application; Article 50 transparency rules and enforcement start Met
    Artificial Intelligence Act
  • Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
    Digital Omnibus on AI
  • Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
    Digital Omnibus on AI
  • Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
    Artificial Intelligence Act
  • National AI regulatory sandbox operational in each Member State Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
    Digital Omnibus on AI
  • Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
    Digital Omnibus on AI
  • Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
    Digital Omnibus on AI
Claims and evidence (4)
  • Member States must ensure at least one national AI regulatory sandbox is operational by 2 August 2027, replacing the earlier date of 2 August 2026.

    Confidence: Confirmed · As of 2 Aug 2027 · evidenced
    Evidence and sources
  • The KI-MIG provides for an AI regulatory sandbox (Reallabor) at the Bundesnetzagentur.

    Confidence: Probable · As of 29 Jul 2026 · evidenced
    Evidence and sources
    • Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung T1 · retrieved · retrieved 8 Oct 2026 · Innovationsförderung und KI-ReallaboreThe core element is the establishment of an AI regulatory sandbox (Reallabor) at the Bundesnetzagentur, which enables, in a controlled environment, the development, training, testing and validation of innovative AI systems, in particular for small and medium-sized enterprises (SMEs).
    • Innovation and AI regulatory sandboxes T1 · retrieved · retrieved 8 Oct 2026 · IntroductionThis means that each Member State must ensure that at least one AI regulatory sandbox at national level has been established by 2 August 2027.
  • Spain held the closing event of its first AI regulatory sandbox on 12 June 2026, with 11 systems completing the pilot.

    Confidence: Probable · As of 12 Jun 2026 · evidenced
    Evidence and sources
  • The Commission proposed a European Innovation Act on 9 September 2026 and announced a separate proposal on regulatory sandboxes.

    Confidence: Confirmed · As of 9 Sep 2026 · evidenced
    Evidence and sources
    • Commission proposes new European Innovation Act (IP/26/1810) T1 · retrieved · retrieved 8 Oct 2026 · Opening paragraphToday, the Commission proposed a new European Innovation Act to help Europe's most innovative ideas be developed, financed and scaled up in Europe.
    • Commission proposes new European Innovation Act (IP/26/1810) T1 · retrieved · retrieved 8 Oct 2026 · Section: innovation-friendly regulatory frameworkIn parallel with the European Innovation Act, the Commission will help innovators accelerate the transformation of innovative ideas into market solutions through a specific proposal on regulatory sandboxes.

#

Nothing recorded for this module in the research of 2026-10-08.

0 instruments · 0 obligations · 0 claims

Nothing recorded for this module in the research of 2026-10-08.

No modules match.

Filters combine as OR inside a group and AND across groups.

Authorities

AuthorityType
European AI Office (European Commission)ai office
European Artificial Intelligence Boardother
Scientific Panel of independent experts under the AI Actother
AI Act Advisory Forumother
European Data Protection Supervisormarket surveillance
EBA, EIOPA and ESMA (European Supervisory Authorities)regulator
RTR KI-Servicestelle (Austria)other
CEN and CENELECstandards body
European Commission (DG CNECT), Digital Services Act enforcementregulator
Garante per la protezione dei dati personalidata protection authority
Data Protection Commission (Ireland)data protection authority
Finnish Transport and Communications Agency (Traficom)market surveillance
Data Protection Ombudsman (Finland)data protection authority
Commissioner of Communicationsmarket surveillance
Czech Telecommunication Officemarket surveillance
Agency for Digital Governmentmarket surveillance
Consumer Protection and Technical Regulatory Authoritymarket surveillance
Transport and Communications Agency (Traficom)market surveillance
Directorate General for Competition Policy, Consumer Affairs and Fraud Control (DGCCRF)market surveillance
Federal Network Agency (Bundesnetzagentur)market surveillance
Hellenic Data Protection Authoritymarket surveillance
AI Office of Irelandmarket surveillance
National Cybersecurity Agency (ACN)market surveillance
Consumer Rights Protection Centremarket surveillance
Communications Regulatory Authority of the Republic of Lithuaniamarket surveillance
National Commission for Data Protection (CNPD)market surveillance
Malta Digital Innovation Authority (MDIA)market surveillance
Dutch Authority for Digital Infrastructure (RDI)market surveillance
Commission for the Development and Security of Artificial Intelligence (KRiBSI)market surveillance
National Regulatory Authority for Communications (ANACOM)market surveillance
National Authority for Management and Regulation in Communications of Romania (ANCOM)market surveillance
Agency for Communication Networks and Services of the Republic of Slovenia (AKOS)market surveillance
Spanish Artificial Intelligence Surveillance Agency (AESIA)market surveillance
Swedish Post and Telecom Authority (PTS)market surveillance
Agenzia per l'Italia digitale (AgID)other
Datatilsynetdata protection authority
Domstolsstyrelsenother
Nasjonal kommunikasjonsmyndighet (Nkom)regulator

Enforcement actions

DateRespondentActionAuthorityInstrumentAmount
More than 30 AI companies (names not published by the Commission)probeEuropean AI Office (European Commission)Artificial Intelligence Act
X Internet Unlimited CompanyprobeData Protection Commission (Ireland)General Data Protection Regulation
OpenAI (ChatGPT)fineGarante per la protezione dei dati personaliGeneral Data Protection RegulationEUR 15000000
Character Technologies Inc. (Character.AI)fineGarante per la protezione dei dati personaliGeneral Data Protection RegulationEUR 158000
X (platform operated by X Corp. / X Internet Unlimited Company)probeEuropean Commission (DG CNECT), Digital Services Act enforcementDigital Services Act

Cases

CaseCourtStageIssue
Like Company v Google Ireland LimitedCourt of Justice of the European UnionhearingWhether a chatbot's display of text partially identical to press publisher content engages Article 15 of Directive 2019/790 and Article 3 of Directive 2001/29.
GEMA v OpenAILandgericht München IjudgmentTraining and operation of ChatGPT using protected song lyrics.
GEMA v SUNOLandgericht München IjudgmentTraining on and reproduction of GEMA repertoire by an AI audio generator.
Kneschke v LAIONHanseatisches Oberlandesgericht HamburgappealText and data mining exception and natural-language rights reservation for AI training datasets.

Consultations

ConsultationAuthorityStatusOpenedCloses
Draft guidelines on classification of high-risk AI systemsEuropean AI Office (European Commission)closed
Draft guidance and reporting template on serious AI incidentsEuropean AI Office (European Commission)closed
Commission feedback call on the effect of technology on copyrightopen
Internetconsultatie uitvoeringswet AI-verordening
Horing - utkast til ny lov om kunstig intelligens (KI-loven)closed
Technical provenance

Provenance

Record schema artificial-intelligence-record-v2.8, research run aic-baseline-EEA-2026-10-08. Regulator line from the research seed. Built by render_jid_aic_v13 from page model module-card-page-v1.

What this record does not yet establish is set out on the transparency register; its dated events are on the regulatory calendar.

Think something on this page is wrong? Report an error.