#
Artificial Intelligence Act (Valid from 2024-08-01): Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.
15 instruments (15 current) · 14 obligations · 38 claims · 21 milestones
Instruments
- Artificial Intelligence Act Valid from 2024-08-01
Horizontal EU regulation setting risk-based rules for AI systems and general-purpose AI models, applying in stages from 2 February 2025 to 2 August 2028 as amended by Regulation (EU) 2026/1744.
- Danish Act supplementing the AI Regulation Valid from 2025-08-02
Danish act designating national competent authorities, giving them information and inspection powers and setting fines for Article 5 breaches.
- Digital Omnibus on AI Valid from 2026-07-27
Amends the AI Act timeline, adds Article 5 prohibitions on non-consensual intimate deepfakes and CSAM-type material, replaces Article 4 and adjusts sandbox and AI Office powers.
- Digital Services Act Valid from 2024-02-17
Platform regulation under which the Commission designates very large platforms and search engines (now including ChatGPT) and enforces systemic-risk duties covering algorithmic systems.
- Dutch draft implementation act for the AI Regulation Draft, no legal force
Draft act on national AI supervision put out for internet consultation on 20 April 2026.
- Finland: Act 1377/2025 on the supervision of certain AI systems In force since 2026-01-01
Allocates AI Act market surveillance in Finland, with a penalty payment board at Traficom and fines up to EUR 35 million or 7% of turnover.
- France: DDADUE bill (adaptation to EU law), Article 24 on AI systems Draft, no legal force
Omnibus adaptation bill whose Article 24 subjects AI systems to the AI Act; competent authorities are to be named by a later amendment.
- General Data Protection Regulation Valid from 2018-05-25
Data protection law that applies to AI training and use of personal data; Article 22 restricts solely automated decisions and Article 83 sets the fines used by national data protection authorities, including against AI providers.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026 (Ireland) Draft, no legal force
Pre-legislative draft heads of the Irish AI implementing bill, covering the national register, serious incident reporting and contravention notices.
- German AI market surveillance and innovation promotion act (KI-MIG) Valid from 2026-07-29
German act making the Bundesnetzagentur market surveillance authority, contact point and complaints body and providing for a sandbox.
- Implementing Regulation on the scientific panel of independent experts Date not recorded
Establishes the scientific panel that advises the AI Office and national authorities on general-purpose AI models with systemic risk.
- Italian Law on artificial intelligence Valid from 2025-10-10
Italian national framework law designating AgID and ACN, regulating AI in work and professions, copyright and criminal law.
- Italy: Legislative Decree 9 September 2026, n. 160 (AI Act adaptation: police use, liability) In force since 2026-09-30
Regulates police use of AI systems, adds a Criminal Code offence and corporate liability, and sets civil-procedure rules on evidence and causation for AI damage.
- Polish Act on artificial intelligence systems Valid from 2026-08-11
Polish act creating KRiBSI and implementing the AI Act, in force from 11 August 2026 with later start dates for some parts.
- Regulation of Artificial Intelligence Act 2026 (Ireland) Valid from 2026-07-31
Irish act signed on 21 July 2026 establishing the AI Office of Ireland as central coordinating authority.
Obligations
- Article 75c(1)
Where the AI Office finds an operator within Article 75(1) non-compliant, it adopts a decision establishing the non-compliance and may impose periodic penalty payments.
- § 15(1) Nr. 1 and (3)
Failing to provide, correctly, completely or in time, information or documentation under Article 21(1) of the AI Act is a national administrative offence punishable by a fine of up to EUR 50,000 (separate from Article 99 fines).
- § 2(1)
The Bundesnetzagentur is the market surveillance authority for compliance with the AI Act unless the KI-MIG provides otherwise.
- Art. 12(1)
The Polish AI Commission must issue an individual opinion within 30 days of an application, or within 60 days in particularly complex cases.
- Section 5
Natural and legal persons within Article 2(1)(a)-(f) of the AI Regulation must supply market surveillance authorities with all information necessary for their supervisory activities on request.
- Section 10(1)(1)
Infringement of Article 5(1)(a)-(g) of the AI Regulation is punishable by a fine unless a higher penalty applies under other legislation.
- Head 37(1)
The AI Office of Ireland would establish and maintain a national register of prohibited-practice cases, Annex III point 2 high-risk systems and other recordable AI cases (draft head).
- Head 55(1) and (11)
An authorised officer could serve a contravention notice on a person or entity contravening the AI Act or the Act; failure without reasonable excuse to comply would be an offence punishable by a class A fine or up to 6 months' imprisonment (draft heads).
- Article 10(2)
Experts on the scientific panel must be independent from any provider of AI systems or general-purpose AI models.
- Article 12, inserting Article 437-bis of the Criminal Code
Omitting the technical safety measures or human oversight measures required for high-risk AI systems is a crime punished with one to five years' imprisonment where danger to life or public or individual safety results.
- Article 15, inserting Article 25-vicies of Legislative Decree 231/2001
Entities face a pecuniary sanction of 600 to 1000 quotas for the Article 437-bis offence (other offences covered by the same article carry lower ranges).
- § 4
The Data Protection Ombudsman supervises, as market surveillance authority, compliance with the prohibited AI practices in Article 5 of the AI Act.
- § 5(1)
Traficom supervises, as market surveillance authority, compliance with the Article 50 transparency obligations of the AI Act.
- § 23
Penalty payments for breaches may reach EUR 35,000,000 or 7% of turnover for Article 5 breaches (§ 21), EUR 15,000,000 or 3% for other listed breaches, and EUR 7,500,000 for § 20.
Milestones
- Entry into force of the AI Act Met
- Chapters I and II (definitions, prohibitions) apply Met
- Governance, GPAI obligations and penalties apply; Member States designate authorities Met
- Danish Act 467/2025 enters into force Met
- Italian Law 132/2025 enters into force Met
- Finnish Act 1377/2025 enters into force Met
- Omnibus enters into force Met
- German KI-MIG enters into force Met
- Irish Act commences (SI 403/2026) Met
- General application; Article 50 transparency rules and enforcement start Met
- Polish AI Act enters into force Met
- Italian Legislative Decree 160/2026 enters into force Met
- Polish AI Act: Articles 8-18 and Chapters 3-5, 8 and 9 enter into force Upcoming
- Article 5(1)(ba), (bb), (1a), (1b) prohibitions begin to apply Upcoming
- Article 50(2) compliance deadline for generative AI systems placed on the market before 2 August 2026 Upcoming
- ChatGPT, as designated very large online search engine, must comply with additional Digital Services Act obligations (four months after designation) Upcoming
- Providers of GPAI models placed on the market before 2 August 2025 must comply Upcoming
- National AI regulatory sandbox operational in each Member State Moved
- Chapter III Sections 1-3 apply to Annex III high-risk systems Moved
- Chapter III Sections 1-3 apply to Annex I (product-embedded) high-risk systems Moved
- Delegated acts adding AI health and safety requirements to the Machinery Regulation apply Upcoming
Claims and evidence (38)
Derived: Probable Breach of provider, deployer, importer, distributor, transparency or GPAI obligations is subject to fines of up to EUR 15 million or 3% of turnover, whichever is higher.
Evidence and sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
Non-compliance with any of the following provisions related to operators or notified bodies, other than those laid down in Articles 5, shall be subject to administrative fines of up to EUR 15 000 000
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
Supplying incorrect, incomplete or misleading information to a notified body or national authority is subject to fines of up to EUR 7.5 million or 1% of turnover.
Evidence and sources
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
The supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities in reply to a request shall be subject to administrative fines of up to EUR 7 500 000
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal text
From 2 August 2026 the AI Office, national market surveillance authorities and the EDPS (for EU institutions) jointly enforce the AI Act.
Evidence and sources
- AI Act - Shaping Europe's digital future
From 2 August 2026, the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act.
- The enforcement framework of the AI Act
The enforcement of the AI Act is shared between the European Commission's AI Office, the European Data Protection Supervisor, and national competent authorities designated by the Member States.
- Market Surveillance Authorities under the AI Act
The European Data Protection Supervisor (EDPS) is the designated market surveillance authority for EU institutions, bodies and agencies.
- AI Act - Shaping Europe's digital future
Lucilla Sioli is the Director of the European AI Office within DG CNECT.
Evidence and sources
- Lucilla Sioli - Director of the European AI Office
Dr. Lucilla Sioli is the Director of the European AI Office within Directorate-General for Communications Networks, Content and Technology (DG Connect) of the European Commission.
- Lucilla Sioli - Director of the European AI Office
The Commission appointed a Scientific Panel and an Advisory Forum on 1 June 2026 to support AI Act enforcement.
Evidence and sources
- AI Act enforcement gets independent expert support
The European Commission has appointed a Scientific Panel and an Advisory Forum to support enforcement of the Artificial Intelligence (AI) Act.
- AI Board convenes its eighth meeting
On 11 June 2026, the AI Board met under the chairmanship of the Cypriot Presidency of the EU Council to discuss and review the current priorities for implementing the EU AI Policy.
- AI Act enforcement gets independent expert support
The AI Board met for its eighth meeting on 11 June 2026 under the Cypriot Council Presidency.
Evidence and sources
- AI Board convenes its eighth meeting
On 11 June 2026, the AI Board met under the chairmanship of the Cypriot Presidency of the EU Council to discuss and review the current priorities for implementing the EU AI Policy.
- AI Board convenes its eighth meeting
The AI Office and national authorities began enforcing the AI Act from 2 August 2026.
Evidence and sources
- Press release IP/26/1714: Commission starts enforcing AI Act rules and new transparency requirements on 2 August
Commission starts enforcing AI Act rules and new transparency requirements on 2 August Brussels, 31 July 2026 From 2 August 2026, the European Commission's AI Office, together with national authorities, will begin enforcing the Artificial Intelligence (AI) Act.
- AI Act - Shaping Europe's digital future
From 2 August 2026, the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act.
- Press release IP/26/1714: Commission starts enforcing AI Act rules and new transparency requirements on 2 August
Member States had to designate market surveillance authorities by 2 August 2025; the Commission's 7 September 2026 list still marks several designations as pending final adoption.
Evidence and sources
- Market Surveillance Authorities under the AI Act
Member States are required to designate the responsible market surveillance authorities by 2 August 2025 and notify them to the Commission.
- Market Surveillance Authorities under the AI Act
For Single Points of Contact marked with *, the national designation decision is still pending final adoption.
- Market Surveillance Authorities under the AI Act
The Commission confirmed on 1 September 2026 that the AI Office had sent its first simple requests for information under the AI Act to more than 30 AI companies, on safety/security and copyright/transparency.
Evidence and sources
- Midday press briefing from 01/09/2026: AI Act - Anthropic/OpenAI: Q&A (transcript)
So we have sent a number, and these are the first RFIs where enforcement action has started on the Commission side against more than 30 AI companies in two main areas.
- Midday press briefing from 01/09/2026: AI Act - Anthropic/OpenAI: Q&A (transcript)
Now, we will not be naming these companies for a very clear reason is that these are simple RFIs.
- The enforcement framework of the AI Act
RFIs can be issued as simple RFIs by the AI Office or, more formally, by decision of the Commission.
- The European Commission's first use of AI Act enforcement powers
29 August 2026, the AI Office issued its first formal Requests for Information ("RFIs") to providers of GPAI models under the AI Act.
- The European Commission's first use of AI Act enforcement powers
Safety and Security: The first set concerned GPAI model safety, security, independent external model evaluations, and the monitoring of GPAI models once they are available on the market.
- Midday press briefing from 01/09/2026: AI Act - Anthropic/OpenAI: Q&A (transcript)
New Article 75c empowers the AI Office to adopt non-compliance decisions against GPAI operators and to impose periodic penalty payments.
Evidence and sources
- AI Act Service Desk: Article 75c
Where the AI Office finds that an operator falling within the scope of Article 75(1) does not comply with the relevant provisions of this Regulation or with commitments made binding pursuant to Article 75b, it shall adopt a decision establishing such non-compliance.
- AI Act Service Desk: Article 75c
The AI Office may also impose periodic penalty payments to compel compliance with investigations, information requests, inspections, corrective measures, binding commitments or non-compliance decisions.
- AI Act Service Desk: Article 75c
Derived: Probable Austria's RTR AI Service Desk rests on section 20c KOG and section 194a TKG; no Austrian AI Act market surveillance designation act was found.
Evidence and sources
- KI-Servicestelle der RTR
The legal basis for the AI Service Desk is formed by section 20c KOG and section 194a TKG (Federal Law Gazette I No. 6/2024).
- KI-Servicestelle der RTR
The Omnibus inserts Article 75a giving the AI Office all powers of a market surveillance authority when supervising AI systems under Article 75(1).
Evidence and sources
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text
Article 75a Supervisory and enforcement powers of the AI Office 1.
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal text
Article 20 of Law 132/2025 designates AgID and the National Cybersecurity Agency as national AI authorities, with Banca d'Italia, CONSOB and IVASS for financial sectors.
Evidence and sources
- Gazzetta Ufficiale Serie Generale n. 223 of 25-9-2025 (Legge 132/2025 full text)
Art. 20. National authorities for artificial intelligence 1. In order to ensure the application and implementation of national and European Union legislation on artificial intelligence, the Agency for Digital Italy (AgID) and the National Cybersecurity Agency (ACN) are designated as national authorities for artificial intelligence
- Gazzetta Ufficiale Serie Generale n. 223 of 25-9-2025 (Legge 132/2025 full text)
The German KI-MIG entered into force on 29 July 2026, making the Bundesnetzagentur the market surveillance authority, contact point and complaints body.
Evidence and sources
- Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung
the 'Act on market surveillance and innovation promotion of artificial intelligence' (KI-MIG), which enters into force today.
- Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung
The Federal Network Agency thereby becomes the market surveillance authority, contact point and complaints body for the AI Regulation
- Bundesgesetzblatt 2026 I Nr. 223: Gesetz zur Durchfuehrung der Verordnung (EU) 2024/1689 (incl. KI-MIG)
The Bundesnetzagentur is the market surveillance authority responsible for compliance with Regulation (EU) 2024/1689, unless this Act provides otherwise.
- Bundesgesetzblatt 2026 I Nr. 223: Gesetz zur Durchfuehrung der Verordnung (EU) 2024/1689 (incl. KI-MIG)
This Act enters into force on the day after its promulgation.
- Bundesnetzagentur übernimmt zentrale Rolle bei der Umsetzung der KI-Verordnung
Derived: Probable KI-MIG section 15 makes failure to provide information or documentation under Article 21(1) of the AI Act a national administrative offence capped at EUR 50,000.
Evidence and sources
- Bundesgesetzblatt 2026 I Nr. 223: Gesetz zur Durchfuehrung der Verordnung (EU) 2024/1689 (incl. KI-MIG)
(1) A person commits an administrative offence who infringes Regulation (EU) 2024/1689 in the version of 13 June 2024 by intentionally or negligently: 1. contrary to Article 21(1), failing to provide, or to provide correctly, completely or in time, information or documentation referred to there,
- Bundesgesetzblatt 2026 I Nr. 223: Gesetz zur Durchfuehrung der Verordnung (EU) 2024/1689 (incl. KI-MIG)
The administrative offence may be punished with a fine of up to fifty thousand euros.
- Bundesgesetzblatt 2026 I Nr. 223: Gesetz zur Durchfuehrung der Verordnung (EU) 2024/1689 (incl. KI-MIG)
Paul Byrne was announced on 30 July 2026 as first Chief Executive Officer of the AI Office of Ireland.
Evidence and sources
- Regulation of Artificial Intelligence Act 2026 signed; Paul Byrne appointed as CEO of AI Office of Ireland
The Act establishes Oifig IS na hÉireann (AI Office of Ireland) as an independent statutory body, which will act as Ireland's central coordinating authority for the implementation of the EU Artificial Intelligence Act, Regulation (EU) 2024/1689, and is an essential element of Ireland's preparations for the supervision and enforcement of the EU AI Act.
- Regulation of Artificial Intelligence Act 2026 signed; Paul Byrne appointed as CEO of AI Office of Ireland
Article 5 of the Polish AI Act designates the Artificial Intelligence Development and Safety Commission (KRiBSI) as the market surveillance authority and single point of contact under AI Act Article 70.
Evidence and sources
- Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (text, Dz.U. 2026 poz. 1003)
Art. 5. 1. The Artificial Intelligence Development and Safety Commission is the market surveillance authority for AI systems within the meaning of Article 70(1) of Regulation 2024/1689.
- Ustawa z dnia 3 lipca 2026 r. o systemach sztucznej inteligencji (text, Dz.U. 2026 poz. 1003)
Section 2 of the Danish AI supplementing Act designates Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen as national competent authorities.
Evidence and sources
- Lov nr. 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens
Digitaliseringsstyrelsen, Datatilsynet and Domstolsstyrelsen are designated as national competent authorities, cf. Article 70(1) of the Artificial Intelligence Regulation
- Lov nr. 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens
Derived: Probable Section 10 of the Danish Act makes infringement of Article 5(1)(a)-(g) of the AI Regulation punishable by a fine, unless a higher penalty applies under other legislation.
Evidence and sources
- Lov nr. 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens
Unless a higher penalty is incurred under other legislation, a fine shall be imposed on anyone who infringes Article 5(1)(a)-(g) of the Artificial Intelligence Regulation
- Lov nr. 467 af 14/05/2025 om supplerende bestemmelser til forordningen om kunstig intelligens
Derived: Probable The General Scheme of the Regulation of Artificial Intelligence Bill 2026, published by Ireland's Department of Enterprise, sets out draft heads for a national AI register, serious-incident reporting and contravention notices.
Evidence and sources
- General Scheme of the Regulation of Artificial Intelligence Bill 2026
Head 37 - National Register and Reporting Obligations To provide that: (1) The Office shall establish and maintain a national register of: a. all instances of prohibited AI practices under Article 5; b. High-risk AI systems referred to in point 2 of Annex III.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026
Head 42 - Serious incidents To provide that: (1) Relevant Market Surveillance Authorities will receive reports of serious incidents from providers of High-Risk AI (HRAI) systems where the incident occurred.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026
Head 55 - Contravention notice To provide that: (1) An authorised officer who is of the opinion that a person or entity is contravening or has contravened any provision of this Act or the AI Act may service a notice (in this Act referred to as a 'contravention notice') on the person or entity.
- General Scheme of the Regulation of Artificial Intelligence Bill 2026
Derived: Probable The Commission may fine a provider of a very large online platform or search engine up to 6% of total worldwide annual turnover.
Evidence and sources
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
In the decision referred to in Article 73, the Commission may impose on the provider of the very large online platform or of the very large online search engine concerned fines not exceeding 6 % of its total worldwide annual turnover in the preceding financial year
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
The Commission designated ChatGPT as a very large online search engine under the Digital Services Act, with compliance with additional obligations due by around January 2027.
Evidence and sources
- Commission designates ChatGPT, Reddit, Roblox under Digital Services Act
The Commission has designated ChatGPT as a Very Large Online Search Engine (VLOSE), as well as Reddit and Roblox as Very Large Online Platforms (VLOPs), under the Digital Services Act (DSA).
- Commission designates ChatGPT, Reddit, Roblox under Digital Services Act
Following the notification of the designations, these services have four months, i.e. by January 2027, to comply with the additional DSA obligations for VLOPs and VLOSEs
- Regulation (EU) 2022/2065 (Digital Services Act), Official Journal text
The obligations set out in this Section shall apply, or cease to apply, to the very large online platforms and very large online search engines concerned from four months after the notification to the provider concerned referred to in the first subparagraph.
- Commission designates ChatGPT, Reddit, Roblox under Digital Services Act
Derived: Probable Non-compliance with CRA essential cybersecurity requirements and Articles 13-14 carries fines up to EUR 15 million or 2.5% of worldwide turnover, whichever is higher.
Evidence and sources
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text
Non-compliance with the essential cybersecurity requirements set out in Annex I and the obligations set out in Articles 13 and 14 shall be subject to administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.
- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal text
On 26 January 2026 the Commission opened a formal investigation against X under the Digital Services Act over risks from deploying Grok in the EU.
Evidence and sources
- Commission investigates Grok and X's recommender systems under the Digital Services Act (IP/26/203)
The European Commission has launched a new formal investigation against X under the Digital Services Act (DSA).
- Commission investigates Grok and X's recommender systems under the Digital Services Act (IP/26/203)
The new investigation will assess whether the company properly assessed and mitigated risks associated with the deployment of Grok's functionalities into X in the EU.
- Commission investigates Grok and X's recommender systems under the Digital Services Act (IP/26/203)
On 17 February 2026 Ireland's Data Protection Commission opened an inquiry into X Internet Unlimited Company under section 110 of the Data Protection Act 2018, covering GDPR Articles 5, 6, 25 and 35.
Evidence and sources
- Data Protection Commission opens investigation into X (XIUC)
The Data Protection Commission (DPC) has today announced that it has opened an inquiry into X Internet Unlimited Company (XIUC) under section 110 of the Data Protection Act 2018.
- Data Protection Commission opens investigation into X (XIUC)
The purpose of the inquiry is to determine whether XIUC has complied with its obligations under the GDPR, including its obligations under Article 5 (principles of processing), Article 6 (lawfulness of processing), Article 25 (Data Protection by Design and by Default) and Article 35 (requirement to carry out a Data Protection Impact Assessment)
- Data Protection Commission opens investigation into X (XIUC)
Derived: Probable The Tribunale di Roma, by judgment n. 4153/2026 published 18 March 2026, annulled the Garante's November 2024 decision fining OpenAI EUR 15 million, on the ground that the Garante lacked competence.
Evidence and sources
- COMUNICATO STAMPA - ChatGPT, il Garante privacy chiude l'istruttoria
Decision no. 755 of 2 November 2024 has been temporarily removed from the website of the Garante per la protezione dei dati personali following judgment no. 4153/2026 of the Tribunal of Rome, published on 18/03/2026, which upheld the opposition lodged against the Garante's decision
- COMUNICATO STAMPA - ChatGPT, il Garante privacy chiude l'istruttoria
OpenAI will have to run a six-month information campaign and pay a fine of EUR 15 million.
- Tribunale di Roma, sentenza 18 marzo 2026, R.G. 4785/2025 (OpenAI v Garante) (copy hosted by Sapienza University)
upholding the appeal, annuls decision no. 755 issued by the Garante per la protezione dei dati personali on 2 November 2024
- Tribunale di Roma, sentenza 18 marzo 2026, R.G. 4785/2025 (OpenAI v Garante) (copy hosted by Sapienza University)
the reasons for upholding the claim, based on the preliminary lack of competence of the respondent authority
- COMUNICATO STAMPA - ChatGPT, il Garante privacy chiude l'istruttoria
Derived: Probable The Garante fined Character Technologies Inc. EUR 158,000 by a decision of 3 July 2026, with age-verification measures to follow within 120 days.
Evidence and sources
- COMUNICATO STAMPA - Intelligenza artificiale: il Garante privacy sanziona Character.AI
The Garante per la protezione dei dati personali has fined Character Technologies Inc. EUR 158,000, a US company operating Character.AI, a generative AI service that allows users, including minors, to create and interact via chat with virtual characters.
- COMUNICATO STAMPA - Intelligenza artificiale: il Garante privacy sanziona Character.AI
age verification systems SEE ALSO: Decision of 3 July 2026
- COMUNICATO STAMPA - Intelligenza artificiale: il Garante privacy sanziona Character.AI
Commission Implementing Regulation (EU) 2025/454 establishes the scientific panel of independent experts in the field of artificial intelligence.
Evidence and sources
- Commission Implementing Regulation (EU) 2025/454 on the scientific panel of independent experts
The scientific panel of independent experts in the field of artificial intelligence (the 'scientific panel') is hereby established.
- Commission Implementing Regulation (EU) 2025/454 on the scientific panel of independent experts
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
- Commission Implementing Regulation (EU) 2025/454 on the scientific panel of independent experts
Experts on the AI Act scientific panel must be independent from any provider of AI systems or general-purpose AI models.
Evidence and sources
- Commission Implementing Regulation (EU) 2025/454 on the scientific panel of independent experts
Experts shall be independent from any provider of AI systems or general-purpose AI models within the meaning of Regulation (EU) 2024/1689...
- Commission Implementing Regulation (EU) 2025/454 on the scientific panel of independent experts
Derived: Probable Article 12 of the Italian decree inserts Article 437-bis into the Criminal Code, punishing omission of required high-risk AI safety/oversight measures with one to five years' imprisonment where danger to life or safety results.
Evidence and sources
- Decreto legislativo 9 settembre 2026, n. 160 (copy of the Gazzetta Ufficiale text hosted by FNOMCeO)
Whoever fails to adopt the required technical safety measures... is punished with imprisonment from one to five years, where such omissions give rise to danger to life or public or individual safety.
- Decreto legislativo 9 settembre 2026, n. 160 (copy of the Gazzetta Ufficiale text hosted by FNOMCeO)
Derived: Probable Article 15 adds entity liability under Legislative Decree 231/2001 of 600 to 1000 quotas for the Article 437-bis offence.
Evidence and sources
- Decreto legislativo 9 settembre 2026, n. 160 (copy of the Gazzetta Ufficiale text hosted by FNOMCeO)
In relation to the Article 437-bis offence, a pecuniary sanction of six hundred to one thousand quotas applies to the entity.
- Decreto legislativo 9 settembre 2026, n. 160 (copy of the Gazzetta Ufficiale text hosted by FNOMCeO)
Finnish Act 1377/2025 on the supervision of certain AI systems was published on 29 December 2025 and allocates AI Act market-surveillance competence in Finland.
Evidence and sources
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
This Act enters into force on 1 January 2026.
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
The Data Protection Ombudsman supervises, as market surveillance authority, compliance with the prohibited artificial intelligence practices under Article 5 of the AI Regulation.
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
The Finnish Act enters into force on 1 January 2026.
Evidence and sources
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
This Act enters into force on 1 January 2026.
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
The Data Protection Ombudsman supervises Article 5 prohibited practices and Traficom supervises Article 50 transparency obligations in Finland.
Evidence and sources
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
The Data Protection Ombudsman supervises, as market surveillance authority, compliance with the prohibited artificial intelligence practices under Article 5 of the AI Regulation.
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
The Finnish Transport and Communications Agency supervises, as market surveillance authority, compliance with the transparency obligations under Article 50 of the AI Regulation.
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
Derived: Probable Section 23 sets the maximum penalty payment at EUR 35,000,000 or 7% of turnover for Article 5 breaches, with lower ceilings for other breaches.
Evidence and sources
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
The maximum amount of the penalty payment is EUR 35,000,000 or up to 7% of annual worldwide turnover.
- Laki eräiden tekoälyjärjestelmien valvonnasta 1377/2025
The French DDADUE bill, tabled 10 November 2025, includes Article 24 subjecting AI systems to the AI Act; the Senate adopted it at first reading and the National Assembly is to examine it.
Evidence and sources
- Ddadue 2026 : synthese du rapport de la commission des affaires economiques
Article 24 specifies that artificial intelligence (AI) systems are subject to the provisions of the 2024 European regulation.
- Projet de loi DDADUE (Vie publique)
On 19 January 2026, the Senate adopted the bill at first reading, with amendments.
- Ddadue 2026 : synthese du rapport de la commission des affaires economiques
The Senate report states the bill is to be completed by a Government amendment specifying which French administrations will apply the AI Regulation.
Evidence and sources
- Ddadue 2026 : synthese du rapport de la commission des affaires economiques
It is to be supplemented during parliamentary discussions by a Government amendment specifying which administrations will apply this AI regulation in France.
- Ddadue 2026 : synthese du rapport de la commission des affaires economiques
Derived: Probable The French Senate adopted the bill at first reading in early 2026, but primary and secondary sources disagree on the exact date.
Evidence and sources
- Projet de loi DDADUE (Vie publique)
On 19 January 2026, the Senate adopted the bill at first reading, with amendments.
- Projet de loi DDADUE (Vie publique)
Examination and adoption 19 February 2026, first reading
- Projet de loi DDADUE (Vie publique)