Establishes harmonised rules for placing on the market, putting into service, and using AI systems in the Union; prohibits specific AI practices; sets requirements for high-risk systems; and lays down transparency and governance rules.

Applies to providers placing AI systems or GPAI models on the EU market, deployers located in the EU, and third-country operators where system outputs are used in the EU. Excludes military, defense, and pure research activities.

Defines core statutory concepts including 'AI system', 'provider', 'deployer', 'general-purpose AI model', 'systemic risk', 'biometric identification', and 'critical infrastructure'.

Requires providers and deployers to take measures ensuring their staff and affected persons attain an adequate level of AI literacy regarding their rights, obligations, and risks.

Bans subliminal manipulation, social scoring, untargeted scraping of facial images, emotion recognition in workplaces/schools, biometric categorization for sensitive traits, and real-time remote biometric identification in public spaces for law enforcement (subject to narrow exceptions).

Classifies AI systems as high-risk if used as safety components of regulated products under Annex I or listed in Annex III (biometrics, infrastructure, education, employment, essential public/private services, law enforcement, migration, justice).

Grants powers to the Commission to update the list of high-risk use cases in Annex III based on evolving evidence of risk to health, safety, or fundamental rights.

Mandates that high-risk AI systems comply with all requirements in Section 2, considering their intended purpose and state of the art.

Requires a continuous, iterative risk management system to identify, estimate, and mitigate known and foreseeable risks throughout the AI system's entire lifecycle.

Sets strict quality criteria for training, validation, and testing datasets, requiring them to be relevant, representative, free of errors, and checked for bias.

Requires technical documentation demonstrating compliance to be drawn up before the system is placed on the market and kept updated (as detailed in Annex IV).

High-risk AI systems must technically enable automatic logging of events ('logs') to track operation, detect risks, and facilitate post-market monitoring.

Mandates that systems be designed to operate transparently, accompanied by clear instructions for use so deployers can interpret outputs and use the system appropriately.

Requires built-in operational tools allowing natural persons to oversee systems, prevent automation bias, override outputs, or interrupt operation via a 'stop' button.

High-risk systems must achieve adequate levels of accuracy, resilience against errors or feedback loops, and robust cybersecurity against data poisoning or adversarial attacks.

Outlines primary obligations for providers, including implementing QMS, keeping technical documentation, conducting conformity assessments, and taking corrective actions.

Providers must maintain a documented Quality Management System (QMS) ensuring systematic compliance across strategy, design, post-market monitoring, and resource management.

Providers must keep documentation, certificates, and declarations of conformity for 10 years after the system is placed on the market.

Providers must keep automatically generated logs under their control for at least 6 months, unless specified otherwise by law.

Requires providers to take immediate corrective actions (withdrawal/recall) if a system is non-compliant and inform competent authorities and distributors.

Providers must supply national competent authorities with all necessary documentation and access to demonstrate compliance upon reasoned request.

Non-EU providers must appoint an EU-based authorised representative before placing high-risk AI systems on the EU market.

Importers must verify that the provider completed conformity assessments and holds documentation before placing a system on the market.

Distributors must verify CE marking, required documentation, and provider compliance prior to making systems available on the market.

Distributors, importers, or deployers become subject to provider obligations if they place a high-risk system under their brand name or substantially modify it.

Deployers must use systems according to instructions, assign competent human overseers, monitor operation, log auto-generated data, and inform affected persons.

Bodies governed by public law or deployers providing public services must conduct an assessment of impacts on fundamental rights prior to deploying high-risk systems.

Member States must designate notifying authorities responsible for assessing, designating, and monitoring conformity assessment bodies.

Establishes independence, competence, impartiality, and operational obligations for notified bodies performing third-party conformity assessments.

Systems conforming to European harmonised standards published in the Official Journal benefit from a presumption of conformity with core requirements.

Allows the Commission to adopt common specifications where harmonised standards do not exist or are deemed insufficient.

Mandates internal control procedures or third-party assessment by a notified body prior to placing a high-risk AI system on the market.

Providers must draw up an EU declaration of conformity stating that the system meets all requirements and keep it updated.

CE marking must be affixed visibly, legibly, and indelibly to high-risk AI systems or their packaging before commercial distribution.

Providers or deployers must register themselves and their high-risk AI systems in the official EU database before placing them on the market or in service.

Requires clear disclosure when interacting with AI (chatbots), machine-readable watermarking for AI-generated text/media, and labelling of deepfakes and public interest synthetic content.

Classifies GPAI models as presenting systemic risk if they have high-impact capabilities (cumulative FLOPs > 10^25) or are designated by the Commission.

Requires technical documentation, training data summaries, compliance with EU copyright law, and cooperation with downstream integrators. Exemption applies to open-source models with non-systemic risk.

Providers of systemic GPAI models must conduct model evaluation, adversarial testing (red-teaming), assess systemic risks, report serious incidents, and ensure cybersecurity.

Encourages the development of Codes of Practice at the Union level to guide proper application and compliance for GPAI providers prior to formal harmonised standards.

Requires Member States to establish at least one operational AI regulatory sandbox to foster innovation and controlled testing before market launch.

Establishes legal frameworks and safeguards for testing high-risk AI systems in real-world conditions outside of sandbox environments.

Provides priority access to sandboxes, lowered administrative fees, and targeted support measures for SMEs and start-ups.

Establishes the European AI Office within the Commission to monitor and enforce rules on GPAI models and coordinate Union-level governance.

Establishes the European Artificial Intelligence Board, composed of representatives from Member States, to advise and assist the Commission.

Establishes a scientific panel to advise the AI Office on systemic risks, model classifications, and technical safety aspects.

Requires each Member State to designate at least one market surveillance authority and one notifying authority responsible for national enforcement.

Mandates the Commission, in collaboration with Member States, to set up and maintain a publicly accessible EU database listing registered high-risk AI systems.

Providers must maintain a post-market monitoring system to systematically collect and analyze performance data throughout the system's lifetime.

Providers must report any serious incident (death, severe harm to health, critical infrastructure disruption) to market surveillance authorities within 15 days.

Grants natural or legal persons the right to submit complaints regarding non-compliance to their local market surveillance authority.

Affected persons subject to decisions based on high-risk AI outputs have the right to obtain clear, meaningful explanations regarding the AI system's role.

Sets administrative fines up to €35M or 7% of total global annual turnover for prohibited practices; up to €15M or 3% for non-compliance with requirements; and up to €7.5M or 1.5% for supplying incorrect information.

The Commission may impose fines on general-purpose AI model providers up to €15M or 3% of total global annual turnover for non-compliance.

In force from 1 August 2024. Applies fully from 2 August 2026, with staged applicability: Prohibited practices (6 months), GPAI rules (12 months), and High-risk Annex I systems (36 months).