In 2024 the European Union adopted Regulation (EU) 2024/1689, formally titled the Regulation laying down harmonised rules on artificial intelligence (the Artificial Intelligence Act). The regulation was agreed by the European Parliament and Council on 13 June 2024, published in the Official Journal of the European Union on 12 July 2024, and entered into force on 1 August 2024. It is widely described as the first comprehensive legal framework for artificial intelligence enacted by a major jurisdiction.
The law uses a risk-based structure that, in the words of the regulation, tailors “the type and content of such rules to the intensity and scope of the risks that AI systems can generate.” The European Commission describes four tiers. Systems posing what the Commission calls “a clear threat to the safety, livelihoods and rights of people” are placed in an unacceptable-risk category and prohibited. High-risk systems that “can pose serious risks to health, safety or fundamental rights” must meet obligations such as risk assessments, dataset quality standards, activity logging, and human oversight before they reach the market. A transparency tier requires disclosure when people interact with systems like chatbots and the labelling of AI-generated content. The remaining minimal-risk category, which the Commission says covers the majority of AI uses in the EU, carries no specific obligations.
The prohibited practices listed in the regulation include AI that uses subliminal or deceptive techniques to “materially distort human behaviour,” certain biometric categorisation systems inferring protected characteristics, social scoring producing discriminatory outcomes, real-time remote biometric identification in public spaces for law enforcement (subject to narrow exceptions), predictive policing based on profiling, and emotion recognition in workplace and education settings.
The regulation also establishes obligations for general-purpose AI (GPAI) models, which the Commission describes as models that “can perform a wide range of tasks.” Rather than applying all at once, the law follows a phased schedule: the prohibitions on unacceptable-risk practices applied from 2 February 2025, the GPAI governance rules from 2 August 2025, and full application is set for 2 August 2026.