EU Artificial Intelligence Act (Regulation (EU) 2024/1689), as amended

Context and history

Regulation (EU) 2024/1689 is the EU's horizontal law on artificial intelligence, applying across sectors. Its stated aim is to improve the internal market and promote human-centric, trustworthy AI, while protecting health, safety and fundamental rights and supporting innovation. It was published on 12 July 2024 and entered into force on 1 August 2024, with obligations phased in.

The original Article 113 set the main application date as 2 August 2026, with Chapters I and II from 2 February 2025, and governance, general-purpose AI and penalties from 2 August 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744, later changed some dates, so check the dated events on this page. This profile was read from the 2024 text, not the amended version.

Who and what it applies to

It applies to providers placing AI systems or general-purpose AI models on the EU market, wherever they are based, and to deployers in the EU. It also covers providers and deployers outside the EU where the output is used in the EU, plus importers, distributors, product manufacturers, authorised representatives and affected persons.

A deployer is an organisation using an AI system under its authority, so a pharmaceutical company using AI can be in scope even if it did not build the system.

What it contains

Chapter I: General provisions

Subject matter, scope, definitions and AI literacy. Article 4 requires a sufficient level of AI literacy among staff.

Chapter II: Prohibited AI practices

Practices that are banned outright.

Chapter III: High-risk AI systems

Classification, requirements, and obligations for providers and deployers. Article 6 and Annex III set what counts as high-risk.

Chapter IV: Transparency

Obligations for providers and deployers of certain AI systems.

Chapter V: General-purpose AI models

Duties for providers of those models.

Chapter VI: Measures in support of innovation

Including regulatory sandboxes.

Chapters VII to IX: Governance and oversight

Governance, the EU database for high-risk systems, post-market monitoring and market surveillance.

Chapters X to XIII: Other provisions

Codes of conduct, delegated powers, penalties and final provisions.

Annexes I to XIII

Includes the Union legislation list (I), high-risk uses (III), technical documentation (IV) and conformity assessment (VI and VII).

Key points

• It is horizontal law, not specific to GMP.
• Duties depend on your role, such as provider or deployer, and on the system's risk class.
• It reaches outside the EU where AI output is used in the EU.
• AI literacy applies to providers and deployers of AI systems.
• Dates have changed through the Omnibus, so check the dated events.

In practice

General reading, not advice. This is drafted with AI and may not fit your situation. It does not replace the official text, your own quality system or qualified advice, and an inspector may take a different view.

• Identify whether you are a provider or a deployer for each AI system, because duties differ.
• Keep an inventory of AI systems and their intended purpose.
• Check AI literacy training for staff who use these systems.
• Seek legal advice for classification decisions.

Read from the source document on 2 Nov 2026. This is our own description, not the official text. Check the full dated history in the change log below.