The European Union’s Digital and Artificial Intelligence Governance: The AI Act and Emerging Legal Challenges

The European Union’s Digital and Artificial Intelligence Governance: The AI Act and Emerging Legal Challenges

Introduction

The regulation of artificial intelligence has become one of the most significant developments in contemporary European Union law. Digital technologies increasingly influence economic activity, public administration, healthcare, education, employment, financial services, law enforcement, political communication, and the exercise of fundamental rights. Automated systems now assist institutions in making decisions, evaluate personal characteristics, identify patterns in large datasets, generate written and visual content, and perform tasks that previously required substantial human judgement. These developments create opportunities for innovation and economic growth, but they also raise difficult legal questions concerning accountability, transparency, discrimination, privacy, safety, intellectual property, and democratic governance.

The European Union has responded by developing a comprehensive framework for digital regulation. Rather than treating artificial intelligence as an isolated technological subject, EU law approaches it as part of a wider regulatory environment encompassing data protection, cybersecurity, digital markets, online platforms, consumer protection, product safety, and fundamental rights. The objective is to create conditions in which digital technologies can develop and circulate within the internal market while remaining subject to legal safeguards.

The central legislative instrument in this field is Regulation (EU) 2024/1689, commonly known as the Artificial Intelligence Act or AI Act. It establishes harmonised rules for the development, placing on the market, putting into service, and use of artificial intelligence systems within the European Union. Its defining feature is a risk-based regulatory model. Instead of imposing identical obligations on every AI application, the Act distinguishes between prohibited practices, high-risk systems, systems subject to transparency requirements, and applications presenting lower regulatory risks.

The AI Act does not operate independently. It interacts with the General Data Protection Regulation (GDPR), the Digital Services Act, the Digital Markets Act, the Data Governance Act, the Data Act, the Cyber Resilience Act, and existing EU product-safety and consumer-protection legislation. Together, these instruments form an increasingly complex body of digital law.

This article examines the legal foundations of European digital and artificial intelligence governance, the institutional architecture of the AI Act, its risk classification system, the obligations imposed on providers and deployers, and the relationship between AI regulation and fundamental rights. It also considers generative AI, general-purpose AI models, biometric technologies, enforcement, liability, intellectual property, and the legal challenges likely to shape the next stage of European digital regulation.

1. The Legal Foundations of European Digital Governance

European digital governance is grounded in the Treaties, the Charter of Fundamental Rights of the European Union, and the Union’s competence to establish common rules for the internal market. Digital technologies frequently operate across national borders. A software provider may be established in one Member State, train or operate a model using infrastructure in another country, and supply services to users throughout the Union. Divergent national rules can therefore create barriers to trade, inconsistent levels of protection, and uncertainty for businesses and individuals.

The EU’s regulatory response is closely connected to the internal-market objective under Article 114 of the Treaty on the Functioning of the European Union (TFEU). This provision allows the Union to adopt measures approximating national laws where differences between them affect the establishment or functioning of the internal market. It has provided an important legal basis for several major digital instruments, including the AI Act.

However, the legal purpose of digital governance extends beyond market integration. Article 2 of the Treaty on European Union (TEU) identifies human dignity, freedom, democracy, equality, the rule of law, and respect for human rights as foundational values of the Union. Article 6 TEU gives the Charter of Fundamental Rights the same legal value as the Treaties. Consequently, digital regulation must be understood within a constitutional framework in which economic freedoms and technological innovation coexist with fundamental rights.

The Charter contains several provisions of particular importance to digital technologies:

• Article 7 protects respect for private and family life.
• Article 8 establishes the right to the protection of personal data.
• Article 11 protects freedom of expression and information.
• Article 16 recognises freedom to conduct a business.
• Article 21 prohibits discrimination.
• Article 47 guarantees the right to an effective remedy and a fair trial.
• Article 52 governs the conditions under which limitations on Charter rights may be justified.

These rights may come into tension when automated systems process personal information, rank individuals, evaluate behaviour, moderate online speech, or influence decisions concerning access to employment, education, credit, healthcare, or public services.

The legal challenge is therefore not simply to determine whether an AI system functions accurately. It is also necessary to examine whether its development and use comply with applicable legal requirements, whether affected individuals are adequately protected, and whether meaningful mechanisms of accountability and review exist.

The European model of digital governance is consequently based on two connected objectives: the establishment of a functioning digital internal market and the protection of the rights and interests of individuals within that market.

2. The Artificial Intelligence Act: Scope, Objectives, and Regulatory Logic

Regulation (EU) 2024/1689 was adopted on 13 June 2024 and entered into force on 1 August 2024. It establishes a directly applicable framework for artificial intelligence across the Member States. Its central purpose is to improve the functioning of the internal market by creating harmonised rules for AI systems while ensuring a high level of protection for health, safety, fundamental rights, democracy, and the rule of law.

The Act is significant because it regulates artificial intelligence according to the risks associated with particular systems and uses. It does not establish a general prohibition on automated decision-making or require every AI application to undergo the same approval procedure. Instead, it differentiates between practices considered unacceptable, applications requiring extensive safeguards, systems subject to specific transparency duties, and uses that generally remain outside the Act’s most demanding requirements.

The Regulation also has an expressly international dimension. Its obligations can apply to providers established outside the European Union where an AI system or its output is placed on the Union market or used within the Union. A company cannot necessarily avoid the legislation merely by locating its development team, servers, or corporate headquarters outside Europe. The relevant question is whether the system falls within the territorial and material scope of the Regulation.

This approach reflects a broader principle of EU digital regulation: access to the European market may be conditioned on compliance with common standards, even where the regulated undertaking is established elsewhere.

2.1 What constitutes an artificial intelligence system?

The AI Act defines an AI system by reference to a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment. It must infer, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments.

The definition is deliberately broader than traditional software. A conventional program generally executes instructions specified by its developer. An AI system, by contrast, may use machine learning, logic-based approaches, knowledge representation, or statistical techniques to infer relationships and generate outputs that are not simply predetermined in every individual case.

The definition is technologically neutral. It is intended to remain relevant as methods of developing AI evolve. At the same time, not every automated calculation, database operation, or conventional rule-based program necessarily qualifies as an AI system. Classification depends on the system’s technical characteristics and the statutory definition, rather than the commercial label used by its provider.

This distinction matters because the AI Act regulates specified categories of systems and actors. A product described as “AI-powered” in marketing material is not automatically subject to every obligation in the Regulation. Conversely, a provider cannot avoid the law merely by describing an AI system as an algorithm, decision-support tool, or automated service.

2.2 The actors regulated by the AI Act

The Regulation identifies several categories of operators whose legal responsibilities depend on their role in the AI supply chain.

A provider is generally a person or organisation that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. Providers may be manufacturers, software companies, research-based enterprises, or other organisations supplying AI systems.

A deployer is a person or organisation using an AI system under its authority, except where the system is used in the course of a purely personal, non-professional activity. A public authority using an AI system to assess applications for public benefits, for example, may act as a deployer. An employer using AI to screen job applications may also fall within this category.

Other regulated actors include importers, distributors, product manufacturers, authorised representatives, and providers of general-purpose AI models. Their responsibilities are not identical. The legal framework allocates obligations according to the degree of control and responsibility each actor exercises over the system.

This distribution is important because AI-related harm can arise at different stages. A model may be inadequately designed; a provider may fail to supply necessary instructions; an importer may place a non-compliant product on the market; or a deployer may use a system outside its intended purpose. Effective governance therefore requires a chain of responsibility rather than reliance on a single developer.

2.3 Territorial application

The AI Act applies to a range of operators, including providers placing AI systems or general-purpose AI models on the Union market, whether established inside or outside the EU. It also covers deployers established or located within the Union and certain providers and deployers established in third countries where the output produced by the AI system is used in the Union.

The Regulation therefore has an extraterritorial dimension, although its reach is defined by the statutory conditions rather than by a general claim to regulate every AI activity worldwide.

The practical consequences are substantial. A non-EU recruitment platform offering AI-based candidate assessments to European employers may fall within the Regulation. A foreign provider supplying a general-purpose model for use in European services may also have obligations under the AI Act. Depending on the operator’s role and establishment, the Regulation may require the appointment of an authorised representative in the Union.

The territorial provisions are designed to prevent regulatory avoidance and to ensure that people within the Union receive consistent protection regardless of where the technology was developed.

2.4 The relationship between innovation and precaution

The AI Act does not adopt a purely precautionary approach in which technological uncertainty automatically justifies prohibition. Nor does it treat innovation as a sufficient reason to exempt systems from legal scrutiny.

Its regulatory structure attempts to distinguish between risks that can be managed through technical and organisational safeguards and practices considered incompatible with fundamental rights or Union values. This is reflected in the combination of prohibitions, conformity-assessment procedures, documentation requirements, transparency obligations, regulatory sandboxes, and support measures for smaller enterprises.

The Regulation thus seeks to create legal predictability. Businesses should be able to identify their obligations before placing systems on the market, while individuals should be able to understand when AI is being used in legally significant contexts and which safeguards apply.

The underlying principle is that technological development is not outside the law. The more consequential an AI system’s potential effects, the more demanding the applicable regulatory requirements may become.

3. The Risk-Based Classification of Artificial Intelligence

The risk-based approach is the organising principle of the AI Act. It recognises that the legal implications of an AI system depend not only on its technical design but also on the context in which it is deployed, the people affected, and the consequences of its outputs.

The Regulation distinguishes between prohibited AI practices, high-risk AI systems, systems subject to transparency obligations, and other systems that are not subject to the same level of regulatory intervention. General-purpose AI models are also governed by a separate set of provisions.

3.1 Prohibited AI practices

Article 5 prohibits specified AI practices because their potential effects are considered incompatible with the protection of fundamental rights and the values of the Union. These prohibitions are not simply additional compliance requirements. They identify uses that cannot lawfully be placed on the market, put into service, or used, subject to the precise statutory wording and applicable exceptions.

The prohibited practices include certain forms of manipulative or deceptive AI that materially distort a person’s behaviour and cause, or are reasonably likely to cause, significant harm. The prohibition addresses systems that exploit vulnerabilities arising from age, disability, or a specific social or economic situation where the statutory conditions are satisfied.

The Regulation also prohibits specified forms of social scoring. This concerns AI systems that evaluate or classify individuals over time on the basis of their social behaviour or known, inferred, or predicted personal characteristics, where the resulting score leads to detrimental or unfavourable treatment in contexts unrelated to the circumstances in which the data was originally generated, or treatment that is unjustified or disproportionate.

Another important prohibition concerns individual criminal-risk assessments based solely on profiling or the assessment of personality traits and characteristics, subject to the limited statutory exception for AI supporting a human assessment of a person’s involvement in criminal activity where that assessment is already based on objective and verifiable facts directly linked to criminal activity.

The Act also prohibits certain forms of untargeted scraping of facial images from the internet or CCTV footage to create or expand facial-recognition databases. It restricts emotion-recognition systems in workplaces and educational institutions, subject to narrow exceptions relating to medical or safety reasons. Certain forms of biometric categorisation based on sensitive characteristics are also prohibited.

Real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes is subject to a particularly strict prohibition, with narrowly defined exceptions and procedural safeguards. These exceptions are not a general licence for unrestricted facial recognition. They are subject to conditions involving specified serious offences or threats, necessity and proportionality, and prior authorisation by a judicial authority or an independent administrative authority, as provided by the Regulation.

The legal significance of Article 5 is considerable. It establishes that some uses of AI are not made acceptable simply by improving accuracy, adding human oversight, or obtaining user consent. The underlying practice itself may be prohibited because of the nature of the interference with fundamental rights.

The prohibition of certain practices is therefore an expression of substantive limits on technological deployment, rather than merely a technical standard for safer systems.

3.2 High-risk AI systems

High-risk AI systems form the central category of applications subject to extensive regulatory requirements. The AI Act does not prohibit their use. Instead, it permits deployment subject to requirements intended to reduce risks to health, safety, and fundamental rights.

The classification depends on the criteria established in Article 6 and the relevant annexes. Two broad groups are particularly important.

The first concerns AI systems used as safety components of products, or AI systems that are themselves products, where the products are covered by specified Union harmonisation legislation and are subject to third-party conformity assessment under that legislation. The relevant product legislation includes areas such as machinery, medical devices, toys, aviation, motor vehicles, and other regulated products.

The second group consists of AI systems used in particular areas identified in Annex III. These include:

• Biometric identification and categorisation, and certain emotion-recognition applications.
• Critical infrastructure, including systems used in the management and operation of essential infrastructure.
• Education and vocational training, particularly systems affecting admission, assessment, or educational opportunities.
• Employment, worker management, and access to self-employment.
• Access to essential private and public services, including creditworthiness assessments and certain decisions concerning public benefits.
• Law enforcement, subject to the specific conditions and exceptions in the Regulation.
• Migration, asylum, and border management.
• The administration of justice and democratic processes, in the circumstances specified by the Act.

The significance of these categories lies in the consequences that automated outputs may have for individuals. An AI system that recommends a film or organises a personal music collection ordinarily presents a different legal profile from a system that ranks job applicants, assesses a student’s performance, evaluates the risk of credit default, or assists a court in researching legal materials.

However, the fact that a system operates in a listed sector does not automatically make it high-risk in every circumstance. Article 6 provides criteria and exceptions, including situations in which an AI system performs a narrow procedural task, improves the result of a previously completed human activity, detects patterns without replacing or influencing a human assessment, or performs a preparatory task for an assessment relevant to a listed use. The applicable conditions must be examined carefully, including whether the system performs profiling of natural persons. Profiling can bring an otherwise excepted system within the high-risk classification.

The classification is therefore functional rather than purely sectoral. The decisive issue is what the AI system does and how its output may affect people.

3.3 Requirements for high-risk AI systems

The AI Act establishes a series of requirements that providers of high-risk systems must satisfy. These requirements are designed to operate throughout the system’s lifecycle, from development and testing to market placement, monitoring, and corrective action.

Risk management. Providers must establish, implement, document, and maintain a risk-management system. This is not a one-time assessment performed before launch. It is an iterative process intended to identify and analyse foreseeable risks, estimate and evaluate risks arising from intended use and reasonably foreseeable misuse, and adopt measures to address them. The assessment must consider the system’s intended purpose and the conditions under which it will operate.

Data and data governance. Where high-risk systems are developed using techniques involving the training of models with data, the training, validation, and testing datasets must be subject to appropriate data-governance and management practices. The Act addresses relevance, representativeness, accuracy, completeness, and the identification of possible biases. The quality of training data is legally important because systematic errors in the data can be reproduced or amplified by the system.

Technical documentation. Providers must prepare documentation demonstrating that the system satisfies the applicable requirements. The documentation must contain sufficient information for competent authorities to assess compliance and must be kept up to date. It should explain the system’s purpose, design, development process, performance, limitations, and relevant testing.

Record-keeping and logging. High-risk systems must be designed to permit the automatic recording of events, where appropriate to their intended purpose. Logs are important for traceability, monitoring, incident investigation, and the reconstruction of relevant operations. The Regulation also imposes obligations on deployers to retain automatically generated logs under their control, subject to the applicable conditions.

Transparency and instructions. Providers must design systems so that deployers can interpret their outputs and use them appropriately. Instructions for use must explain the system’s capabilities and limitations, intended purpose, relevant performance characteristics, and circumstances in which human oversight is required.

Human oversight. High-risk systems must be designed to permit effective oversight by natural persons during use. Human oversight is intended to prevent or minimise risks to health, safety, and fundamental rights. It must be meaningful in practice: the person responsible for oversight needs sufficient competence, training, authority, and support to understand the system’s limitations and intervene where necessary.

Accuracy, robustness, and cybersecurity. High-risk systems must achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle. They should be resilient against errors, faults, inconsistencies, and attempts to manipulate their operation. These requirements are particularly relevant where systems operate in sensitive environments or influence decisions with serious consequences.

The Regulation also requires providers to operate a quality-management system, prepare a conformity assessment, maintain post-market monitoring, and take corrective action when a system does not comply with the applicable requirements.

These obligations are connected. Technical documentation without meaningful testing may provide little assurance; human oversight without access to intelligible information may become merely formal; and accurate predictions do not establish legal compliance if the system processes data unlawfully or produces discriminatory outcomes.

3.4 Obligations of deployers

The AI Act does not place responsibility exclusively on developers. Organisations using high-risk AI systems must also comply with obligations appropriate to their role.

Deployers must use systems in accordance with the instructions supplied by providers and assign human oversight to persons who possess the necessary competence, training, authority, and support. They must ensure that input data under their control is relevant and sufficiently representative for the intended purpose, to the extent required by the Regulation. They must monitor the operation of the system and inform relevant parties where serious risks or incidents arise.

In certain circumstances, deployers must inform affected individuals that they are subject to the use of a high-risk AI system. Public authorities and certain private entities providing public services also have additional registration and fundamental-rights assessment obligations, subject to the precise statutory scope.

A particularly important requirement concerns workplace deployment. Employers using high-risk AI systems must inform workers’ representatives and affected workers before putting such systems into use, in accordance with the applicable provisions. This is relevant where AI influences recruitment, task allocation, performance evaluation, promotion, or decisions affecting working conditions.

The division of responsibilities reflects a practical reality: a provider may design a technically compliant system, but a deployer can still create legal risks by using it for an unsuitable purpose, relying on inaccurate input data, ignoring warnings, or failing to provide effective human supervision.

3.5 Fundamental-rights impact assessments

Certain deployers of high-risk AI systems must carry out a fundamental-rights impact assessment before deployment. This requirement is especially important for bodies governed by public law, private entities providing public services, and deployers using specified systems to assess the creditworthiness or establish the credit score of natural persons, subject to the statutory exceptions.

The assessment must identify the relevant deployment process, the period and frequency of use, the categories of persons likely to be affected, and the specific risks of harm. It must also consider human oversight arrangements and the measures intended to address those risks.

A fundamental-rights assessment differs from a purely technical risk assessment. It asks not only whether a system is reliable, but also how its use may affect equality, dignity, privacy, access to services, procedural fairness, and other protected interests.

The distinction is important. A system may achieve high predictive accuracy while still producing unacceptable outcomes for a particular group. It may also be technically secure but used in a context where individuals have little ability to challenge an adverse decision.

The AI Act’s impact-assessment mechanism therefore connects technology governance with the wider constitutional and administrative-law obligations of public authorities and other regulated deployers.

4. General-Purpose AI Models and Generative Artificial Intelligence

The rapid development of generative AI has created regulatory questions that differ from those associated with traditional, purpose-specific systems. Generative models can produce text, images, audio, video, software code, and other outputs in response to user instructions. Some models can be adapted for many different purposes and integrated into a large number of downstream applications.

The AI Act addresses this category through its provisions on general-purpose AI (GPAI) models. These provisions recognise that a model may be developed by one organisation and subsequently incorporated into products and services supplied by many others. The original provider may not control every downstream application, but it can still be required to provide information and documentation necessary for responsible integration.

4.1 General-purpose AI models

A general-purpose AI model is a model displaying significant generality and capable of competently performing a wide range of distinct tasks, regardless of how it is placed on the market. It may be integrated into an AI system or used directly as a model.

This category includes models that can support activities such as translation, summarisation, drafting, coding, classification, question answering, image generation, and other tasks. The legal classification depends on the statutory definition and characteristics of the model, not merely on whether a company markets it as a general-purpose product.

The AI Act distinguishes between providers of general-purpose AI models and providers of AI systems that integrate those models. This distinction is necessary because the responsibilities of the original model developer differ from those of a downstream provider adapting the model for a particular application.

4.2 Obligations of providers of general-purpose AI models

Article 53 establishes several obligations for providers of general-purpose AI models. They must prepare and maintain technical documentation concerning the model, including information about its training and testing processes and the results of relevant evaluations. They must make specified information available to the AI Office and national competent authorities upon request.

Providers must also supply information and documentation to downstream AI system providers so that those organisations can understand the model’s capabilities and limitations and comply with their own obligations under the AI Act.

Two requirements are especially significant for copyright and transparency.

First, providers must establish a policy to comply with Union copyright and related-rights law. This includes identifying and respecting rights reservations expressed under Article 4(3) of Directive (EU) 2019/790, the Copyright in the Digital Single Market Directive. This provision is relevant to text and data mining, including the legal mechanisms through which rightsholders may reserve rights against certain forms of mining.

Second, providers must prepare and make publicly available a sufficiently detailed summary of the content used to train the model, following the template provided by the AI Office.

These obligations do not require the public disclosure of every item in a training dataset or the publication of commercially sensitive model parameters. The Regulation recognises the need to protect intellectual property, confidential business information, and trade secrets. The legal task is to reconcile transparency and accountability with legitimate confidentiality interests.

Certain open-source general-purpose AI models benefit from limited exemptions from specified documentation obligations where they satisfy the statutory conditions concerning licensing and public availability of parameters, architecture, and information on model usage. The exemptions do not apply in the same way to models presenting systemic risks.

4.3 General-purpose AI models with systemic risk

Some models may create risks beyond the effects of an individual application. Their capabilities, scale, computational requirements, or potential for widespread deployment may generate risks that are significant at Union level.

The AI Act therefore establishes an additional category of general-purpose AI models with systemic risk. The classification is based on criteria including high-impact capabilities and other indicators specified by the Regulation. The statutory framework also provides mechanisms through which the Commission may designate models as presenting systemic risk.

Providers of these models must comply with additional obligations. These include conducting model evaluations using standardised protocols and state-of-the-art tools, carrying out and documenting adversarial testing, assessing and mitigating systemic risks, monitoring and reporting serious incidents, and ensuring appropriate cybersecurity protections for the model and its physical infrastructure.

The significance of this framework is that the law recognises risks that cannot be understood solely by examining one transaction or one end-user interaction. A general-purpose model may be integrated into thousands of services, used by organisations across multiple sectors, and adapted in ways that its original developer did not specifically anticipate.

Systemic-risk governance therefore requires continuous evaluation, incident reporting, cooperation with supervisory authorities, and technical safeguards capable of addressing risks at scale. AI Act Service Desk+2

5. Transparency Obligations and the Regulation of AI-Generated Content

Artificial intelligence can produce outputs that are difficult to distinguish from human-created material. Generative systems can imitate voices, create realistic images, generate video, reproduce conversational styles, and produce text that appears to have been written by a person with particular expertise. These capabilities raise questions concerning deception, manipulation, the authenticity of information, and the ability of individuals to recognise when they are interacting with an automated system.

The AI Act addresses these concerns through transparency obligations, particularly Article 50. The obligations are directed at different actors and depend on the type of system and output involved.

5.1 Informing individuals when they interact with AI

Providers must design certain AI systems so that people are informed that they are interacting with an AI system, unless this is obvious from the circumstances and context of use. This requirement is particularly relevant to systems that interact directly with natural persons, including conversational assistants and automated customer-service applications.

The legal objective is to prevent individuals from being misled into believing that they are communicating with a human being when they are in fact interacting with an automated system. The obligation does not require every interface to display an intrusive warning in every interaction. The statutory test takes account of whether the artificial nature of the interaction is already apparent to a reasonably well-informed, observant, and circumspect person.

This requirement is important in commercial services, public administration, education, and other settings in which people may rely on information supplied by an AI system.

5.2 Emotion-recognition and biometric categorisation

Deployers of emotion-recognition systems and biometric categorisation systems must inform exposed individuals about the operation of such systems and process personal data in accordance with applicable data-protection law.

The distinction between biometric identification, biometric categorisation, and emotion recognition is legally important. Biometric identification seeks to establish the identity of a person through the comparison of biometric data. Categorisation may classify people according to particular physical or behavioural characteristics. Emotion-recognition systems attempt to infer emotional states or intentions from biometric data.

The AI Act treats certain uses of these technologies as prohibited, while other applications may be permitted subject to specific safeguards and transparency obligations. The Regulation’s restrictions do not replace the GDPR or the law governing law-enforcement processing. A system may therefore be subject to several independent legal assessments.

5.3 Deepfakes and synthetic content

Article 50 also addresses deepfakes and certain AI-generated or manipulated text published to inform the public on matters of public interest.

Deployers of AI systems that generate or manipulate image, audio, or video content constituting a deepfake must disclose that the content has been artificially generated or manipulated. The definition covers content that appreciably resembles existing persons, objects, places, entities, or events and would falsely appear to a person to be authentic or truthful.

The Regulation recognises that disclosure must be implemented in a way that takes account of the context in which the content is used. In particular, the law provides for adaptations where the content forms part of an evidently artistic, creative, satirical, fictional, or analogous work. In those circumstances, the transparency obligation is intended to be fulfilled in an appropriate manner that does not unnecessarily interfere with the presentation or enjoyment of the work.

The Act also addresses AI-generated or manipulated text published for the purpose of informing the public on matters of public interest, subject to exceptions where human review or editorial control has taken place and a natural or legal person holds editorial responsibility for publication.

These requirements are not a general prohibition on synthetic media, parody, artistic experimentation, or automated content creation. They seek to ensure that people are not deceived about the artificial nature of material in contexts where authenticity is important.

5.4 Technical marking and machine-readable identification

Transparency cannot depend entirely on a visible disclaimer. Labels may be removed, cropped, or separated from the material to which they relate. Article 50 therefore requires providers of systems generating synthetic audio, image, video, or text content to ensure that outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, to the extent technically feasible.

This requirement raises difficult implementation questions. Different technologies use different file formats, metadata structures, watermarking methods, and distribution systems. Content may also be modified by third-party services after generation. A marking mechanism that works for one platform may not remain effective after content is compressed, edited, or transferred to another environment.

The law therefore combines a general obligation with a feasibility qualification. The practical effectiveness of these safeguards will depend on technical standards, interoperable methods, and cooperation among developers, platforms, and other market participants.

The transparency provisions became applicable on 2 August 2026. Under the transitional arrangement introduced by the Digital Omnibus on AI, providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video, or text content and were placed on the market before 2 August 2026 must take the necessary steps to comply with Article 50(2) by 2 December 2026. EUR-Lex+2

6. The Governance and Enforcement Architecture

The AI Act establishes a system of supervision involving the European Commission, specialised EU-level bodies, national competent authorities, and market-surveillance institutions. Its effectiveness depends on cooperation between these actors, particularly because AI systems may be developed in one jurisdiction, supplied in another, and used across multiple Member States.

6.1 The European AI Office

The European Commission’s AI Office plays a central role in the implementation and enforcement of the Regulation. It is responsible for important aspects of general-purpose AI governance, including the supervision of providers of general-purpose AI models and models presenting systemic risks.

The AI Office may request technical documentation and information, conduct evaluations, investigate possible infringements, and require corrective measures within its competence. It also supports the development of codes of practice, guidelines, and other instruments intended to clarify the practical application of the Act.

Its role is particularly important in relation to general-purpose AI because the largest models may be supplied across the Union from a relatively small number of providers. A central supervisory function helps avoid inconsistent enforcement by different national authorities in relation to the same model provider.

The AI Office does not replace national authorities in every aspect of AI supervision. The Regulation allocates enforcement responsibilities according to the relevant operator, system, and legal provision.

6.2 The European Artificial Intelligence Board

The AI Board provides a mechanism for cooperation between Member States and the Commission. Its functions include supporting consistent application of the Regulation, advising on implementation, facilitating coordination among national authorities, and contributing to the development of common approaches.

The Board is important because the AI Act is directly applicable but must be enforced through national institutional structures as well as EU-level mechanisms. Differences in administrative capacity, technical expertise, and national enforcement priorities could otherwise produce uneven practical application.

The Board therefore contributes to regulatory consistency without converting every enforcement decision into a centralised Commission procedure.

6.3 Scientific and advisory structures

The Regulation also provides for a Scientific Panel of independent experts and an Advisory Forum.

The Scientific Panel assists the AI Office and other relevant institutions by providing technical expertise, particularly concerning the identification and evaluation of general-purpose AI models with systemic risks. Its role is relevant where the legal assessment depends on complex technical questions that cannot be resolved through ordinary administrative analysis alone.

The Advisory Forum provides broader input from stakeholders, including industry, civil society, academia, and other relevant groups. Its function is to support the implementation of the Regulation through practical expertise and informed discussion.

These bodies reflect the technical complexity of AI governance. Legislators can establish legal obligations, but the evaluation of model capabilities, cybersecurity vulnerabilities, training methods, and systemic risks requires specialised knowledge that changes as technology develops.

6.4 National competent authorities and market surveillance

Member States must designate competent authorities responsible for implementing and enforcing the AI Act. National authorities may include market-surveillance bodies, notifying authorities, data-protection authorities, and other institutions designated under national law.

Their responsibilities may involve investigating suspected infringements, supervising operators, examining technical documentation, coordinating with the Commission, and imposing or initiating appropriate corrective measures.

The Regulation also provides for cooperation with authorities responsible for existing EU legislation. This is essential where AI systems form part of regulated products or operate in sectors such as healthcare, finance, transport, employment, or public administration.

For example, an AI-enabled medical device may be subject to both the AI Act and the relevant medical-device legislation. A system processing personal data may also fall within the supervisory jurisdiction of a national data-protection authority. Effective governance requires coordination rather than the assumption that one regulatory instrument displaces all others.

6.5 Regulatory sandboxes and innovation support

The AI Act recognises that strict compliance obligations may be difficult to navigate for emerging companies and research organisations, particularly where technologies are still being developed. It therefore provides for AI regulatory sandboxes.

A regulatory sandbox allows eligible participants to develop, train, test, and validate AI systems under the supervision of a competent authority and within a controlled environment. The purpose is to facilitate innovation while enabling regulators to identify legal and technical issues before systems are deployed more widely.

Sandboxes do not create a general exemption from EU law. Participation does not automatically authorise conduct that would otherwise violate data-protection law, consumer law, or fundamental-rights protections. Their value lies in supervised experimentation, early regulatory engagement, and the development of practical compliance methods.

The Digital Omnibus on AI, adopted as Regulation (EU) 2026/1744, amended the timetable for national AI regulatory sandboxes. Member States must ensure that at least one national sandbox is operational by 2 August 2027. The amended framework also places particular emphasis on support for small and medium-sized enterprises, start-ups, and small mid-cap enterprises. EUR-Lex+2

7. The Digital Omnibus on AI and the Revised Implementation Timetable

The original AI Act was designed to apply progressively, allowing businesses and public authorities time to adapt. However, the implementation process raised practical concerns about the availability of harmonised standards, technical guidance, conformity-assessment mechanisms, and institutional capacity.

In response, the EU adopted Regulation (EU) 2026/1744, known as the Digital Omnibus on AI. It entered into force on 27 July 2026 and amended Regulation (EU) 2024/1689. The changes are important because the legal timetable and certain substantive provisions of the AI Act must now be read in their amended form.

The Digital Omnibus seeks to simplify implementation, reduce unnecessary duplication, clarify selected requirements, and support smaller enterprises while maintaining the Regulation’s objectives concerning safety, health, and fundamental rights.

Among its changes are measures addressing the interaction between AI requirements and existing product-safety legislation, clarification of the concept of a safety component, and the extension of certain simplified compliance measures to small mid-cap enterprises. It also adjusted the application dates for high-risk AI obligations.

The resulting timetable is as follows:

Date	Main legal development
1 August 2024	AI Act entered into force.
2 February 2025	General provisions, definitions, AI literacy requirements, and the original prohibitions on specified AI practices became applicable.
2 August 2025	Governance provisions and obligations for providers of general-purpose AI models became applicable.
27 July 2026	Digital Omnibus on AI entered into force.
2 August 2026	General application date for the majority of the AI Act’s provisions, including applicable transparency requirements and enforcement powers.
2 December 2026	New prohibitions concerning specified AI-generated non-consensual intimate material and child sexual abuse material become applicable; transitional compliance deadline for certain pre-existing synthetic-content systems under Article 50(2).
2 August 2027	National AI regulatory sandboxes must be operational.
2 December 2027	Requirements for high-risk AI systems classified under Article 6(2) and Annex III become applicable.
2 August 2028	Requirements for high-risk AI systems connected to regulated products under Article 6(1) and Annex I become applicable.

The timetable distinguishes between the application of the Regulation as a whole and the application of particular chapters or obligations. It would therefore be inaccurate to say either that the AI Act is entirely prospective or that all of its substantive requirements are already enforceable in November 2026.

The new prohibitions concerning non-consensual intimate material and child sexual abuse material are particularly noteworthy. Regulation 2026/1744 inserted these practices into Article 5, subject to the precise conditions and safeguards in the amended text. The provisions distinguish between the placing on the market or putting into service of systems designed for, or reasonably foreseeably capable of, generating such material without adequate safeguards, and the use of systems for the prohibited purpose.

The delayed application of the high-risk requirements is also legally significant. It does not mean that high-risk AI systems are unregulated until 2027 or 2028. Other EU and national rules, including data-protection, product-safety, employment, consumer-protection, and anti-discrimination law, continue to apply. The change concerns the application dates of the specific high-risk requirements in the AI Act.

The revised timetable illustrates an important feature of EU digital law: implementation is not simply a matter of adopting a regulation and waiting for its application date. It requires technical standards, administrative infrastructure, guidance, and coordination between regulatory systems. AI Act Service Desk+4

8. The Relationship Between the AI Act and Other EU Digital Legislation

The AI Act is one component of a much wider European regulatory framework. Its provisions frequently operate alongside other legislation, and compliance with one instrument does not automatically establish compliance with another. A system may satisfy the technical requirements of the AI Act while still violating data-protection law, infringing copyright, breaching consumer-protection rules, or failing to meet cybersecurity obligations.

Understanding these interactions is essential for determining the legal responsibilities of developers, businesses, public authorities, and digital platforms.

8.1 The General Data Protection Regulation

The GDPR, Regulation (EU) 2016/679, remains one of the most important legal instruments governing artificial intelligence. Many AI systems depend on the collection, analysis, storage, or use of personal data. Their development and deployment may therefore constitute processing within the meaning of the GDPR.

The GDPR applies independently of whether a system qualifies as high-risk under the AI Act. A low-risk AI application may still process personal data unlawfully. Similarly, a system that is fully compliant with the AI Act may violate the GDPR if it lacks a lawful basis for processing, fails to provide adequate information, retains data unnecessarily, or does not respect data-subject rights.

The principal GDPR requirements relevant to AI include:

• Lawfulness, fairness, and transparency: Personal data must be processed on a lawful basis and in a manner that is fair and transparent to the individual.
• Purpose limitation: Data must be collected for specified, explicit, and legitimate purposes and not used incompatibly with those purposes.
• Data minimisation: Only data adequate, relevant, and necessary for the intended purpose should be processed.
• Accuracy: Reasonable steps must be taken to ensure that personal data is accurate and kept up to date where necessary.
• Storage limitation: Personal data should not be retained longer than required for the relevant purposes.
• Integrity and confidentiality: Appropriate technical and organisational measures must protect personal data against unauthorised access, loss, or misuse.
• Accountability: Controllers must be able to demonstrate compliance with the Regulation.

These principles have direct implications for AI training and operation. A developer cannot assume that the availability of large quantities of online information automatically makes the processing lawful. Public accessibility does not remove the protections attached to personal data.

Special categories of personal data, including information concerning health, biometric data used for unique identification, political opinions, religious beliefs, and other sensitive characteristics, are subject to additional restrictions under Article 9 GDPR. Their use in training or operating AI systems requires a valid legal basis and compliance with the relevant conditions.

8.2 Automated decision-making under Article 22 GDPR

Article 22 GDPR establishes a right not to be subject to a decision based solely on automated processing, including profiling, where the decision produces legal effects concerning the individual or similarly significantly affects that person. The provision contains exceptions, including where the decision is necessary for entering into or performing a contract, authorised by Union or Member State law with appropriate safeguards, or based on the individual’s explicit consent.

Where the relevant exceptions apply, suitable safeguards must be provided. These include, at a minimum, the right to obtain human intervention, express a point of view, and contest the decision.

This provision is particularly important in automated recruitment, credit assessment, insurance, access to services, and other fields in which algorithmic outputs can affect a person’s legal or economic position.

The relationship between Article 22 GDPR and the AI Act should not be misunderstood. The AI Act regulates systems according to their characteristics and uses, while Article 22 addresses specified decisions based solely on automated processing of personal data. A high-risk system may not necessarily produce a decision falling within Article 22, and an automated decision may be subject to Article 22 even where the system is not classified as high-risk under the AI Act.

In SCHUFA Holding, Case C-634/21, the Court of Justice examined the interpretation of automated decision-making under Article 22. The judgment is particularly relevant to credit-scoring systems, demonstrating that an automated probability value may itself constitute a decision where a third party draws strongly on it in determining whether to establish, perform, or terminate a contractual relationship. The case illustrates why the legal assessment must consider the actual function of an algorithmic output rather than merely the formal allocation of the final decision to a human or another organisation. EUR-Lex+2

8.3 Data protection impact assessments

Article 35 GDPR requires a data protection impact assessment where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons. This may arise in connection with systematic and extensive evaluation of personal aspects based on automated processing, large-scale processing of sensitive data, or systematic monitoring of publicly accessible areas on a large scale.

The AI Act separately requires a fundamental-rights impact assessment for certain deployers and uses. The two assessments have related but distinct legal purposes.

A data protection impact assessment focuses on the risks arising from the processing of personal data. A fundamental-rights impact assessment under the AI Act examines the wider effects of deploying a high-risk system on protected rights and freedoms. Depending on the circumstances, an organisation may need to conduct both assessments.

The practical consequence is that AI governance cannot be reduced to a single compliance document. Organisations must identify the legal frameworks applicable to their activities and coordinate assessments so that risks are not overlooked or addressed only superficially.

8.4 The Digital Services Act

Regulation (EU) 2022/2065, the Digital Services Act (DSA), establishes rules for intermediary services and online platforms. It addresses issues including illegal content, transparency, online advertising, recommender systems, user protection, and systemic risks arising from the operation of very large online platforms and very large online search engines.

The DSA is particularly relevant to AI because digital platforms frequently use algorithmic systems to recommend content, rank information, moderate material, personalise advertising, and influence what users encounter online.

The DSA imposes additional obligations on very large online platforms and search engines, including the assessment and mitigation of systemic risks. These risks may concern the dissemination of illegal content, fundamental rights, public security, electoral processes, civic discourse, public health, and the protection of minors.

The relationship between the DSA and the AI Act is complementary. The AI Act regulates specified AI systems and models, while the DSA regulates the responsibilities of intermediary services and platforms. An AI-powered recommender system may therefore be relevant under both instruments, but for different legal reasons.

For example, a platform may use an AI system to personalise political content. The AI Act may impose obligations if the system falls within a regulated category or engages a transparency requirement. The DSA may separately require the platform to assess and mitigate systemic risks associated with its recommender systems and the operation of the service as a whole.

The DSA also provides mechanisms for algorithmic transparency, including information about recommender systems and, for very large platforms and search engines, access to certain data for eligible researchers. These provisions are important for examining the effects of algorithmic systems on the information environment. European Commission+2

8.5 The Digital Markets Act

Regulation (EU) 2022/1925, the Digital Markets Act (DMA), addresses the economic power of large digital platforms designated as gatekeepers. It seeks to ensure contestable and fair digital markets by imposing specific obligations and prohibitions on undertakings that control important platform services.

The DMA is not an AI-specific regulation. Nevertheless, it affects the commercial environment in which AI systems are developed, distributed, and used. Gatekeepers may control app stores, search engines, social networks, operating systems, cloud services, and other infrastructure essential to the distribution of AI products.

The DMA’s rules concerning data combination, interoperability, self-preferencing, access to business-user data, and restrictions on certain forms of platform conduct may influence the ability of competing AI providers to reach customers and access essential digital infrastructure.

The AI Act and DMA therefore address different dimensions of digital power. The AI Act focuses on the risks and responsibilities associated with AI systems and models. The DMA focuses on the structure and competitive conditions of digital markets.

8.6 The Data Act and the Data Governance Act

Regulation (EU) 2023/2854, the Data Act, has applied since 12 September 2025. It establishes rules concerning access to and use of data generated by connected products and related services, as well as certain data-sharing and cloud-switching arrangements.

Its relevance to artificial intelligence is substantial. AI development depends on access to data, and connected devices generate information that may be valuable for training, testing, and operating intelligent systems. The Data Act seeks to improve access to certain categories of such data while establishing safeguards for personal data, trade secrets, and legitimate commercial interests.

The Data Governance Act, Regulation (EU) 2022/868, provides a framework for data-sharing arrangements, including the re-use of certain protected public-sector data, data intermediation services, and data altruism organisations. It is intended to increase trust in data-sharing mechanisms and support the development of a European data economy.

Neither instrument creates an unrestricted right to use all available data for AI training. Data access must still comply with applicable rules on intellectual property, confidentiality, personal data, and contractual rights.

Together, the Data Act and Data Governance Act form part of the infrastructure necessary for responsible data use. Their relationship with the AI Act is important because AI regulation cannot be effective without addressing the legal conditions under which the underlying data is accessed and processed. EUR-Lex+1

8.7 The Cyber Resilience Act and cybersecurity regulation

Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), establishes horizontal cybersecurity requirements for products with digital elements. It addresses vulnerabilities, security updates, product design, incident reporting, and obligations throughout the product lifecycle.

AI systems may form part of software products, connected devices, industrial systems, or other digital products covered by the CRA. The AI Act’s requirements concerning robustness and cybersecurity therefore interact with the broader product-security framework.

The CRA entered into force in December 2024. Its reporting obligations began to apply on 11 September 2026, while its main obligations are scheduled to apply from 11 December 2027. Manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements, subject to the applicable statutory requirements.

The interaction between the two Regulations is particularly important for AI-enabled products. A system may require an assessment of AI-specific risks under the AI Act while its software components are also subject to cybersecurity obligations under the CRA. Shaping Europe’s digital future+2

9. Artificial Intelligence, Copyright, and Intellectual Property

One of the most difficult legal questions surrounding generative AI concerns the use of protected works during model training and the legal status of generated outputs.

Generative models may be trained on very large collections of text, photographs, illustrations, music, software code, and other materials. Some of these materials are protected by copyright or related rights. Their use may involve reproduction, extraction, or other acts falling within the scope of intellectual-property legislation.

9.1 Text and data mining under EU copyright law

Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market establishes rules concerning text and data mining.

Article 3 provides an exception for text and data mining carried out by research organisations and cultural heritage institutions for scientific research purposes, where they have lawful access to the relevant works or other subject matter. Article 4 establishes a broader exception or limitation for text and data mining, subject to conditions, including lawful access and the absence of an appropriate reservation of rights by the rightsholder.

For publicly available online content, a reservation may be expressed through machine-readable means. This is particularly relevant to commercial AI training because providers must consider whether the materials used for training were lawfully accessed and whether rightsholders have reserved the relevant rights.

The AI Act’s requirement that general-purpose AI providers maintain a policy to comply with Union copyright law does not replace the substantive rules of copyright. Nor does the publication of a training-data summary automatically establish that every training use was lawful.

9.2 Training data and transparency

The obligation to publish a sufficiently detailed summary of training content is intended to improve transparency and enable rightsholders and other interested parties to understand the broad sources used in developing a model.

However, it does not necessarily resolve disputes concerning whether particular works were copied, whether a text-and-data-mining exception applies, whether a rights reservation was effective, or whether a model output reproduces protected expression.

The distinction between information about training sources and proof of legal compliance is important. A summary may assist in assessing a provider’s practices, but individual copyright claims may still require examination of the works involved, the manner of access, the applicable exceptions, and the nature of the output.

9.3 Copyright protection of AI-generated works

A separate question concerns whether AI-generated material can qualify for copyright protection.

EU copyright law generally requires an original work reflecting the author’s own intellectual creation. The legal framework is based on human authorship and originality, rather than on the mere production of a commercially valuable or aesthetically sophisticated result.

The use of AI as an assisting tool does not necessarily prevent copyright protection. A human creator may make original contributions through selection, arrangement, editing, modification, or other creative decisions. The assessment depends on the extent to which the resulting expression reflects the author’s own intellectual creation.

By contrast, material generated autonomously by a system without sufficient human creative contribution raises a different question. The fact that a person entered a prompt or initiated a generation process does not, by itself, conclusively establish authorship under EU copyright principles.

The AI Act does not harmonise all questions of copyright ownership in AI-generated outputs. These issues remain connected to the broader EU copyright framework and the interpretation of originality and authorship under applicable law.

9.4 Other intellectual-property interests

AI governance also affects patents, trade secrets, database rights, trademarks, and confidential business information.

AI-assisted inventions raise questions about inventorship and the role of human contribution. Training datasets may contain information protected by database rights or contractual restrictions. Models may process confidential business information or reproduce distinctive commercial identifiers in ways that create trademark or unfair-competition issues.

The AI Act recognises the importance of protecting trade secrets and confidential business information when technical documentation and model information are supplied to authorities or downstream providers. However, confidentiality does not remove the obligation to comply with the Regulation.

The broader legal challenge is to establish workable boundaries between innovation, access to information, intellectual-property protection, and the rights of creators and other rightsholders.

10. Liability, Consumer Protection, and Remedies

The AI Act establishes regulatory obligations, but it is not a complete system of civil liability. A breach of the Regulation may trigger administrative enforcement, yet an injured individual seeking compensation must also consider the applicable rules on product liability, contractual liability, tort or non-contractual liability, and data protection.

This distinction is essential. Regulatory compliance and civil liability answer different legal questions. The first asks whether an operator has fulfilled its statutory obligations. The second asks whether a person has suffered legally recognised damage for which another party is responsible under the relevant liability regime.

10.1 The revised Product Liability Directive

Directive (EU) 2024/2853 modernises the EU’s product-liability framework. It expressly addresses software and certain digital products, recognising that defective software can cause damage in ways that were not adequately reflected in older product-liability rules.

The Directive is scheduled to apply to products placed on the market or put into service after 9 December 2026. Member States must transpose it by that date.

Its significance for AI is considerable. Software may constitute a product, and the Directive addresses issues such as defects, evidential difficulties, disclosure of evidence, and the allocation of responsibility across complex product supply chains. It also recognises that products may remain under the control of manufacturers after being placed on the market, including through software updates and related digital services.

The revised framework may therefore become relevant where an AI-enabled product is defective and causes damage. However, it does not mean that every inaccurate AI output automatically gives rise to product liability. The claimant must establish the relevant legal elements under the Directive and national implementing law.

10.2 Contractual and non-contractual liability

AI-related disputes may arise from contractual relationships between developers, business customers, platform operators, and end-users. Questions may concern defective services, failure to meet contractual specifications, inaccurate representations, inadequate security, or misuse of confidential information.

Non-contractual liability may arise where negligent development, deployment, supervision, or use causes legally recognised harm. The applicable rules depend on the national legal system and the relevant harmonised EU provisions.

The allocation of responsibility can be complicated where multiple actors contribute to the operation of an AI system. A developer may design the model, a provider may integrate it into a commercial product, a platform may distribute it, and an employer or public authority may use it to make consequential decisions.

The AI Act helps identify regulatory responsibilities among these actors, but the determination of civil liability requires a separate legal analysis.

10.3 Consumer protection and unfair commercial practices

AI systems can influence consumer behaviour through personalised advertising, recommendation systems, automated pricing, chatbots, and targeted marketing. These practices may be subject to EU consumer-protection legislation, including rules against misleading and aggressive commercial practices.

A business cannot avoid consumer-protection obligations merely because a marketing decision was generated by an algorithm. If an AI system creates misleading claims, conceals material information, exploits consumer vulnerabilities, or uses manipulative design in a legally prohibited manner, the organisation deploying the system may face liability under the applicable rules.

The relationship between the AI Act and consumer law is therefore practical as well as doctrinal. The AI Act may impose transparency or risk-management duties, while consumer law addresses the fairness and legality of the commercial conduct itself.

10.4 The right to challenge consequential decisions

Individuals affected by AI-supported decisions may have several routes to challenge the relevant conduct.

Depending on the circumstances, they may invoke rights under the GDPR, submit complaints to a data-protection authority, challenge an administrative decision through national procedures, pursue consumer remedies, or bring civil proceedings.

The availability and scope of these remedies depend on the legal basis of the decision, the identity of the responsible organisation, the nature of the harm, and the applicable procedural rules.

An important distinction must be maintained between the right to receive information about an AI system and the right to challenge a decision made using it. Transparency is valuable, but it does not automatically provide an effective remedy. A person may need access to relevant records, an explanation of the decision-making process, meaningful human review, or judicial scrutiny.

The AI Act’s fundamental-rights orientation must therefore be understood alongside the wider European principles of effective judicial protection and access to remedies.

11. Enforcement, Administrative Fines, and Regulatory Accountability

The AI Act establishes a graduated enforcement regime intended to ensure that its obligations are effective in practice. The severity of the potential sanctions reflects the seriousness of the infringement and the importance of the protected interests.

11.1 Administrative fines

Article 99 provides for administrative fines imposed by Member States for infringements of the Regulation. The principal maximum levels include:

• Prohibited AI practices: up to €35 million or, where the offender is an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher.
• Certain other infringements by operators or notified bodies: up to €15 million or 3% of worldwide annual turnover, whichever is higher.
• Supply of incorrect, incomplete, or misleading information to authorities: up to €7.5 million or 1% of worldwide annual turnover, whichever is higher.

The Regulation provides for different treatment of small and medium-sized enterprises, including start-ups, in the calculation of certain fines. Regulation (EU) 2026/1744 also introduced provisions concerning small mid-cap enterprises, including a limitation under which the relevant fine for such enterprises is capped at the lower of the applicable percentage or monetary amount.

Article 101 establishes a separate enforcement mechanism for providers of general-purpose AI models. The Commission may impose fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, for specified infringements of the obligations applicable to those providers.

The fine structure reflects the EU’s broader approach to digital regulation, under which financial penalties are intended to be sufficiently significant to discourage non-compliance, particularly where the undertaking operates across multiple jurisdictions.

The maximum figures are statutory ceilings, not automatic penalties. Authorities must apply the relevant legal criteria and procedural safeguards when determining whether a fine is justified and proportionate. EUR-Lex+3

11.2 Market surveillance and corrective measures

Financial penalties are only one element of enforcement. Authorities may also require operators to take corrective action, withdraw or recall non-compliant systems, restrict their availability, or bring their activities into conformity with the Regulation.

This is particularly important because an AI system may present an ongoing risk even before a final administrative penalty is imposed. Where a system is used in employment, healthcare, education, public administration, or another sensitive context, delayed intervention may allow harmful effects to continue.

The AI Act therefore relies on a combination of preventive supervision, documentation, conformity assessment, incident reporting, investigation, and corrective action.

11.3 Fundamental-rights protection and effective remedies

The enforcement framework must be interpreted consistently with the Charter of Fundamental Rights. Administrative authorities must respect procedural guarantees, including the right to be heard, access to an effective remedy, and the requirements of proportionality.

The Regulation also provides mechanisms through which individuals and other interested parties may submit complaints to relevant market-surveillance authorities where they consider that the AI Act has been infringed.

The practical effectiveness of these mechanisms will depend on the accessibility of complaint procedures, the technical expertise of supervisory bodies, and the ability of authorities to investigate systems whose operation may be difficult to understand from outside the organisation deploying them.

The existence of a formal complaint mechanism is not sufficient if individuals cannot identify the responsible organisation, obtain relevant information, or understand which authority has jurisdiction. Institutional coordination and public awareness are therefore essential components of enforcement.

12. Emerging Legal Challenges in European AI Governance

The AI Act creates an important regulatory foundation, but it does not eliminate the legal uncertainty surrounding rapidly evolving technologies. Several issues are likely to remain central to the development of European digital law.

12.1 The problem of meaningful human oversight

One of the most difficult questions is how to distinguish meaningful human oversight from merely formal human involvement.

An organisation may claim that a human being makes the final decision, even where that person routinely accepts automated recommendations without independently examining the underlying information. This phenomenon is sometimes described as automation bias.

A human reviewer may lack the time, technical knowledge, authority, or organisational independence necessary to challenge the system. In such circumstances, human involvement may exist formally but fail to provide an effective safeguard.

The legal question is therefore not simply whether a person participates in the process. It is whether that person can understand the relevant limitations, identify errors, disregard inappropriate recommendations, and intervene effectively.

The same problem arises in public administration. An authority cannot necessarily avoid responsibility for an unlawful decision by explaining that an automated system generated the recommendation. Public bodies remain subject to applicable administrative-law principles, including legality, equality, procedural fairness, and the duty to give legally sufficient reasons where required.

12.2 Algorithmic discrimination and indirect bias

AI systems may reproduce inequalities present in the data used to develop them. Historical employment records, lending decisions, policing information, and educational assessments may reflect social and institutional patterns that are themselves discriminatory.

Even where sensitive characteristics are not expressly included, other variables may operate as proxies. Geographic location, educational history, purchasing patterns, language, or employment gaps may correlate with characteristics protected by anti-discrimination law.

The difficulty is that an algorithm may appear neutral while producing systematically unequal effects. A provider may also be unable to identify the source of the problem without examining the underlying data, model design, and deployment environment.

The AI Act addresses aspects of this problem through data-governance, risk-management, monitoring, and fundamental-rights requirements. However, it does not replace the wider body of EU and national equality law.

Future enforcement will need to examine not only the technical performance of AI systems but also the social consequences of their deployment.

12.3 Explainability and the right to understand decisions

Some advanced AI models are difficult to interpret, even for their developers. Complex neural networks may generate outputs through relationships that cannot readily be translated into a simple explanation.

This creates a legal challenge where an AI system influences a consequential decision. A person who is refused employment, denied credit, or excluded from a public service may need to understand the factors that contributed to the decision and whether those factors were lawful.

However, transparency does not always require disclosure of source code or every technical detail of a model. The appropriate level of explanation depends on the applicable legal provision, the nature of the decision, the rights affected, and the need to protect legitimate confidentiality interests.

The challenge is to provide information that is sufficiently meaningful for individuals and supervisory authorities without necessarily requiring the disclosure of trade secrets or commercially sensitive technical information.

12.4 Generative AI and misinformation

Generative systems can produce large quantities of realistic synthetic content. This creates risks involving impersonation, fraud, fabricated evidence, misleading political material, and the manipulation of public debate.

The AI Act’s transparency requirements address certain aspects of this problem, but labelling alone cannot resolve the wider challenges of information integrity. A labelled deepfake may still be widely distributed, while an unlabelled synthetic image may circulate after its original metadata has been removed.

The DSA provides a complementary framework for addressing systemic risks arising from online platforms. Nevertheless, questions remain concerning the relationship between content moderation, freedom of expression, platform responsibility, and the role of AI in amplifying information.

A further problem is the speed at which synthetic material can be generated and disseminated. Legal procedures and administrative investigations may move considerably more slowly than the circulation of harmful content.

12.5 The concentration of AI infrastructure

The development of advanced AI models requires significant computational resources, specialised expertise, access to data, and investment in infrastructure. These requirements may favour a relatively small number of large technology providers.

Concentration can create several legal and economic concerns. Smaller companies may depend on a limited number of model providers or cloud infrastructure operators. Public authorities may become dependent on commercial systems for essential administrative functions. Businesses may also face difficulties changing providers or obtaining sufficient information about the models on which their services depend.

The AI Act addresses some of these concerns through transparency and documentation requirements, while the DMA and Data Act address related issues involving competition, data access, and digital infrastructure.

However, the question of technological dependence is broader than the regulation of individual AI systems. It involves competition policy, public procurement, industrial policy, cybersecurity, and the strategic capacity of the European economy.

12.6 Open-source development and regulatory proportionality

Open-source AI development can support research, competition, transparency, and independent scrutiny. It may also allow smaller organisations to adapt existing models rather than develop expensive systems from the beginning.

However, openness does not automatically eliminate risks. A model may be publicly available and still be capable of misuse. Its weights may be distributed without effective control over downstream applications, while the original developer may have limited knowledge of how others deploy it.

The AI Act recognises this distinction by providing limited exemptions for certain open-source general-purpose AI models while retaining additional obligations for models presenting systemic risks.

The legal challenge is to maintain proportionality. Excessively burdensome requirements may make independent development difficult, while broad exemptions may leave significant risks insufficiently addressed.

12.7 Cross-border enforcement and international cooperation

AI systems do not operate within national borders. A provider may be established in a third country, use computing infrastructure in several jurisdictions, and supply a model to organisations across the European Union.

This creates questions concerning jurisdiction, evidence gathering, regulatory cooperation, and the practical enforcement of decisions against operators without a substantial presence in the Union.

The AI Act’s territorial provisions and authorised-representative mechanisms help address these issues, but international cooperation remains necessary. Authorities may need access to technical information, assistance from foreign regulators, and mechanisms for dealing with providers that do not voluntarily cooperate.

The development of international standards and regulatory dialogue will therefore influence the practical reach of European AI law.

12.8 Environmental sustainability

The environmental impact of artificial intelligence is becoming an increasingly important legal and policy issue. Training and operating large models can require substantial computing resources, electricity, cooling infrastructure, and specialised hardware.

The AI Act includes provisions relating to the evaluation and monitoring of general-purpose AI models and their environmental impact, while broader EU environmental and energy legislation continues to apply.

However, there is no single comprehensive EU environmental-liability regime specifically for all AI systems. Questions remain about how environmental performance should be measured, what information providers should disclose, and whether efficiency standards should become more demanding as models grow in scale.

Environmental sustainability is therefore likely to become an increasingly relevant dimension of AI governance.

12.9 The boundary between AI regulation and other legal regimes

A final challenge concerns the growing complexity of the digital regulatory framework itself.

A single AI product may be subject to the AI Act, GDPR, DSA, DMA, Data Act, Cyber Resilience Act, consumer-protection law, intellectual-property legislation, and sector-specific requirements. The same organisation may have obligations as a provider, deployer, controller, processor, importer, or manufacturer, depending on its activities.

This creates risks of duplicated assessments, inconsistent terminology, and uncertainty about which authority is responsible for a particular issue.

The Digital Omnibus on AI responds to some of these difficulties by seeking to simplify implementation and reduce unnecessary duplication. However, simplification must not become a reason to weaken substantive protection or create gaps between regulatory regimes.

The long-term challenge is to make the European digital rulebook coherent enough to be applied consistently while remaining sufficiently flexible to address new technological developments.

13. The Constitutional Significance of European AI Governance

The AI Act is more than a technical regulation governing software. It represents an important development in the relationship between technological power, economic freedom, and fundamental rights.

The increasing use of automated systems raises questions traditionally associated with constitutional and administrative law. Who may exercise decision-making power? What limits apply to the use of information about individuals? How can public authorities demonstrate that their decisions are lawful? What remedies should be available where automated systems cause harm?

These questions are not entirely new. European law has long addressed privacy, equality, consumer protection, product safety, and administrative accountability. What has changed is the scale, speed, and technical complexity with which digital systems can influence people’s lives.

The AI Act attempts to translate established legal principles into a regulatory structure adapted to these developments. It does not create a general right to reject all automated processes, nor does it establish that every decision involving AI must be made exclusively by a human being. Instead, it creates specific prohibitions, safeguards, documentation duties, transparency requirements, and accountability mechanisms.

The constitutional significance of the framework lies in its recognition that technological capability does not itself establish legal authority. An organisation’s ability to predict, classify, rank, or influence individuals does not automatically mean that it is legally entitled to do so.

At the same time, the Regulation must operate within the principles of proportionality, legal certainty, and freedom to conduct a business. The protection of fundamental rights must be balanced with legitimate economic activity, scientific research, and technological development.

The European approach is therefore not based on the proposition that artificial intelligence should be excluded from sensitive areas of human activity. It seeks to establish the legal conditions under which particular uses may be permitted, restricted, or prohibited.

14. Key Takeaways

1. The Artificial Intelligence Act, Regulation (EU) 2024/1689, establishes a harmonised legal framework for AI systems and general-purpose AI models across the European Union.

2. The Act is based on a risk-based regulatory model, distinguishing between prohibited practices, high-risk systems, systems subject to transparency requirements, and other applications.

3. The Regulation has an extraterritorial dimension and may apply to providers established outside the EU where the relevant statutory conditions concerning the Union market or use of outputs are satisfied.

4. Article 5 prohibits specified AI practices, including certain manipulative systems, social scoring, specified forms of biometric surveillance, and certain emotion-recognition applications.

5. High-risk AI systems are subject to requirements concerning risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, and cybersecurity.

6. The classification of a system depends on its intended purpose, technical characteristics, and actual function, not simply on the sector in which it is marketed.

7. Providers and deployers have distinct obligations. Organisations using AI cannot transfer all legal responsibility to the company that developed the technology.

8. General-purpose AI providers must maintain technical documentation, provide information to downstream providers, establish copyright-compliance policies, and publish summaries of training content.

9. Providers of general-purpose AI models presenting systemic risks have additional duties concerning model evaluation, adversarial testing, systemic-risk mitigation, serious-incident reporting, and cybersecurity.

10. Article 50 requires transparency in specified interactions with AI and addresses deepfakes and certain AI-generated or manipulated content.

11. The AI Act operates alongside the GDPR. Compliance with one Regulation does not automatically establish compliance with the other.

12. Article 22 GDPR restricts certain decisions based solely on automated processing where they produce legal effects or similarly significantly affect individuals, subject to specified exceptions and safeguards.

13. The Digital Services Act and Digital Markets Act address related but different aspects of digital governance, including platform responsibilities, systemic risks, and competition.

14. The Data Act and Data Governance Act establish important rules concerning data access, sharing, and governance, which influence the development of AI systems.

15. Copyright law remains relevant to AI training. The AI Act’s training-data transparency requirements do not replace the substantive rules of Directive (EU) 2019/790.

16. The Digital Omnibus on AI, Regulation (EU) 2026/1744, amended the AI Act and revised several implementation dates and compliance provisions.

17. As of November 2026, the new Article 5 prohibitions concerning specified non-consensual intimate material and child sexual abuse material are scheduled to apply from 2 December 2026.

18. The revised high-risk AI requirements are scheduled to apply from 2 December 2027 for Annex III systems and 2 August 2028 for relevant Annex I systems.

19. The AI Act establishes substantial administrative fines, including maximum penalties of €35 million or 7% of worldwide annual turnover for prohibited practices.

20. The long-term effectiveness of European AI governance will depend on meaningful human oversight, consistent enforcement, technical standards, effective remedies, and coordination across the wider digital regulatory framework.

15. Frequently Asked Questions

1. What is the European Union Artificial Intelligence Act?

The AI Act is Regulation (EU) 2024/1689, a directly applicable EU Regulation establishing harmonised rules for the development, placement on the market, putting into service, and use of artificial intelligence systems. It introduces a risk-based framework intended to protect health, safety, and fundamental rights while supporting innovation and the internal market.

2. Does the AI Act apply in all EU Member States?

Yes. As an EU Regulation, it is directly applicable in all Member States. National authorities are nevertheless responsible for designating competent institutions, establishing enforcement arrangements, and applying national provisions where the Regulation requires them.

3. Does the AI Act apply to companies outside the European Union?

It can. Providers established outside the EU may fall within its scope when they place AI systems or general-purpose AI models on the Union market. The Regulation can also apply where the output produced by an AI system is used in the Union, subject to its territorial provisions.

4. What is a high-risk AI system?

A high-risk AI system is an AI system falling within the categories established by Article 6 and the relevant annexes. These include specified uses in employment, education, essential services, critical infrastructure, migration, law enforcement, biometric identification, and the administration of justice. Certain AI systems incorporated into regulated products also qualify.

5. Are high-risk AI systems prohibited?

No. High-risk classification does not automatically prohibit an AI system. It means that the system must comply with the applicable regulatory requirements, including risk management, documentation, human oversight, data governance, and conformity assessment.

6. Which AI practices are prohibited under Article 5?

Article 5 prohibits specified practices, including certain manipulative or deceptive systems that cause significant harm, social scoring under defined conditions, certain biometric categorisation practices, specified emotion-recognition applications in workplaces and educational institutions, and certain forms of biometric surveillance and predictive policing. The precise scope of each prohibition must be assessed under the statutory wording and applicable exceptions.

7. Does the AI Act regulate ChatGPT and other generative AI systems?

The Act can apply to generative AI systems and their underlying general-purpose AI models. Providers may have obligations concerning technical documentation, information for downstream providers, copyright policies, training-data summaries, transparency, and systemic-risk management, depending on the model and its classification.

8. What are general-purpose AI models?

They are AI models displaying significant generality and capable of performing a wide range of distinct tasks. They may be integrated into different AI systems or used directly. The AI Act establishes specific obligations for their providers because these models can support many downstream applications.

9. What is a general-purpose AI model with systemic risk?

It is a general-purpose AI model designated under the AI Act as presenting systemic risks at Union level, taking account of the statutory criteria and applicable procedures. Its provider must comply with additional requirements, including evaluations, adversarial testing, systemic-risk mitigation, incident reporting, and cybersecurity protections.

10. Does the AI Act require companies to disclose all their AI training data?

No. General-purpose AI providers must publish a sufficiently detailed summary of training content following the AI Office’s template. They must also maintain technical documentation and comply with relevant information duties. These requirements do not necessarily require publication of every training item, model parameter, or commercially sensitive document.

11. How does the AI Act relate to the GDPR?

The two instruments operate independently but complement each other. The AI Act regulates specified AI systems and models, while the GDPR governs the processing of personal data. An AI application may comply with the AI Act but still violate the GDPR if it processes personal data unlawfully or fails to respect data-subject rights.

12. Can an employer use AI to select job applicants?

AI-assisted recruitment is not automatically prohibited. However, AI systems used for recruitment and selection may fall within the high-risk category under Annex III. Their providers and deployers must comply with the relevant obligations when those requirements become applicable. Other legislation, including GDPR and anti-discrimination law, may also apply.

13. Must people be informed when they interact with an AI chatbot?

Under Article 50, providers of certain AI systems intended to interact directly with natural persons must ensure that individuals are informed that they are interacting with an AI system, unless this is obvious from the circumstances and context of use.

14. Are deepfakes illegal under the AI Act?

Not all deepfakes are illegal. Article 50 establishes disclosure requirements for specified deepfake content. Certain AI practices involving non-consensual intimate material and child sexual abuse material are also addressed by the amended Article 5. Other laws, including criminal, privacy, data-protection, personality-rights, and copyright rules, may independently apply.

15. Does the AI Act protect authors and copyright holders?

It contains provisions relevant to copyright, particularly the obligation of general-purpose AI providers to establish policies for compliance with Union copyright law and publish sufficiently detailed summaries of training content. However, the substantive rights of authors and other rightsholders continue to be governed by copyright legislation, including Directive (EU) 2019/790.

16. Who supervises compliance with the AI Act?

Supervision is shared between the European Commission, the AI Office, EU-level advisory and scientific bodies, and national competent authorities. The Commission has particular responsibilities for general-purpose AI models, while national authorities supervise other matters within their designated competences.

17. What are the penalties for violating the AI Act?

The maximum administrative fine for prohibited AI practices is €35 million or 7% of worldwide annual turnover, whichever is higher. Other infringements may attract fines of up to €15 million or 3% of worldwide annual turnover, and certain failures to provide accurate information may attract fines of up to €7.5 million or 1%, subject to the applicable provisions and rules for smaller enterprises.

18. What did the Digital Omnibus on AI change?

Regulation (EU) 2026/1744 amended the AI Act to simplify implementation, clarify selected requirements, provide additional support for smaller businesses, and adjust certain application dates. Among other changes, it postponed the application of specified high-risk AI requirements and introduced additional prohibitions concerning certain AI-generated intimate material and child sexual abuse material.

19. When do the high-risk AI requirements become applicable?

Under the amended timetable, the requirements for AI systems classified as high-risk under Article 6(2) and Annex III become applicable on 2 December 2027. The corresponding requirements for relevant systems under Article 6(1) and Annex I become applicable on 2 August 2028.

20. Does the AI Act give individuals a right to human review of every AI decision?

No. The Regulation establishes human-oversight requirements for specified categories of systems and additional safeguards in particular contexts. The GDPR separately provides protections concerning certain decisions based solely on automated processing. There is no universal right under the AI Act to require human review of every decision in which AI has played any role.

16. Conclusion

The European Union’s approach to artificial intelligence represents a major development in the legal regulation of technological innovation. Through Regulation (EU) 2024/1689, the Union has established a common framework that seeks to reconcile the development of AI with the protection of health, safety, fundamental rights, and the integrity of the internal market.

The AI Act’s risk-based structure is central to this approach. It distinguishes between prohibited practices, high-risk applications, systems subject to transparency requirements, and general-purpose models that may create risks across multiple sectors. It also distributes responsibilities among providers, deployers, importers, distributors, and other operators rather than treating artificial intelligence as the responsibility of developers alone.

Its practical operation depends on its relationship with the wider body of EU law. The GDPR governs personal-data processing; copyright legislation regulates the use of protected works; the DSA addresses the responsibilities of online platforms; the DMA addresses digital-market competition; and the Data Act and Cyber Resilience Act contribute to the legal infrastructure governing data and digital products. Product-liability and consumer-protection rules provide further mechanisms for addressing harm.

The adoption of the Digital Omnibus on AI in 2026 demonstrates that the European regulatory framework is still developing. The revised implementation timetable and additional provisions reflect the difficulty of translating broad legal objectives into workable obligations for rapidly changing technologies. The effectiveness of the framework will depend not only on the wording of the legislation but also on the quality of technical standards, the capacity of supervisory authorities, and the practical ability of individuals and organisations to exercise their rights.

Ultimately, European AI governance raises a question that extends beyond the regulation of software: how should legal systems preserve human dignity, equality, accountability, and freedom in an environment increasingly shaped by automated decisions and machine-generated information?

The AI Act does not provide a final answer to every aspect of that question. It establishes a legal structure within which those questions can be addressed, contested, and progressively resolved. Its significance will therefore be measured not simply by the number of systems brought within its scope or the penalties imposed for non-compliance, but by whether it succeeds in making technological power compatible with the principles of a democratic legal order.

Principal Legal Sources and Further Reading

The following sources provide the principal legislative and institutional foundations for this article.

Artificial Intelligence Act and its implementation

• Regulation (EU) 2024/1689 – Artificial Intelligence Act
• Regulation (EU) 2026/1744 – Digital Omnibus on AI
• European Commission – AI Act
• European Commission – AI Act Service Desk
• European Commission – AI Act implementation timeline
• European Commission – AI Act enforcement framework

Data protection and fundamental rights

• Regulation (EU) 2016/679 – General Data Protection Regulation
• European Commission – Information for individuals under the GDPR
• Charter of Fundamental Rights of the European Union

Digital markets, platforms, and data governance

• Regulation (EU) 2022/2065 – Digital Services Act
• Regulation (EU) 2022/1925 – Digital Markets Act
• Regulation (EU) 2023/2854 – Data Act
• Regulation (EU) 2022/868 – Data Governance Act

Copyright, cybersecurity, and liability

• Directive (EU) 2019/790 – Copyright in the Digital Single Market
• Regulation (EU) 2024/2847 – Cyber Resilience Act
• Directive (EU) 2024/2853 – Product Liability Directive
• Court of Justice of the European Union – Case C-634/21, SCHUFA Holding

Legal position checked against the EU legislation and institutional material available on 3 November 2026. The application dates and obligations described above reflect the amendments introduced by Regulation (EU) 2026/1744.