Framework
EU AI Act — Regulation (EU) 2024/1689
The European Union's comprehensive regulatory framework for artificial intelligence, establishing a risk-based classification system with escalating obligations for providers and deployers of AI systems.
The EU AI Act (Regulation (EU) 2024/1689) is the European Union’s comprehensive AI regulation. It classifies AI systems into four risk tiers and imposes graduated obligations on providers, deployers, importers and distributors. It entered into force in August 2024, but it applies in phases rather than on a single date, and those dates are the operative part for planning.
Regulatory status and applicability
- The regulation entered into force on 1 August 2024.
- Prohibitions and AI literacy obligations were designed to apply from 2 February 2025.
- Obligations for general-purpose AI (GPAI) models and governance provisions were designed to apply from 2 August 2025.
- Most high-risk system obligations were designed to apply from 2 August 2026.
- Certain obligations for high-risk systems that are components of regulated products were designed to apply from 2 August 2027.
Timelines and guidance continue to evolve, and compliance work is staged. Treat the dates above as the staged plan and verify the current state against the European Commission’s AI Act material before relying on them.
Risk categories and obligations
| Tier | Definition | Examples | Key obligations |
|---|---|---|---|
| Unacceptable risk | AI practices deemed incompatible with EU values and fundamental rights | Social scoring, real-time biometric identification in public spaces, manipulative AI | Prohibited outright |
| High risk | AI systems that pose significant risks to health, safety or fundamental rights | AI in critical infrastructure, education, employment, law enforcement, migration, justice | Conformity assessment, risk management, data governance, transparency, human oversight, accuracy, robustness |
| Limited risk | AI systems with specific transparency obligations | Chatbots, emotion recognition, deepfake generators | Transparency: users must be informed they are interacting with AI or viewing AI-generated content |
| Minimal risk | All other AI systems not covered by the above | AI-enabled video games, spam filters | No mandatory obligations; voluntary codes of conduct encouraged |
ATLAS connection
The EU AI Act’s high-risk obligations map to ATLAS controls: data governance requires classification before AI use, human oversight maps to human approval for high-impact actions, and transparency requirements connect to logging and monitoring controls. The obligation to maintain an inventory of AI systems reinforces the core ATLAS principle that governance begins with knowing what AI is in production.
Official source: EU