The EU AI Act in plain words: what it covers and what changes for you

The EU AI Act is Regulation (EU) 2024/1689, the world’s first broad law regulating artificial intelligence, in force since 1 August 2024 and applying in stages ever since. This guide explains, from the regulation’s own text and the European Commission’s own pages, what the law covers, when each part starts to bite, and what a person who uses AI tools should expect to notice.

Two terms recur throughout the law. A provider is whoever develops an AI system or model and puts it on the EU market, so OpenAI, Google, Anthropic, Meta and Microsoft are providers. A deployer is whoever uses an AI system in a professional capacity: the bank running a credit scoring model, the employer running a hiring tool.

What the law actually covers

The Act applies to AI placed on the EU market or affecting people in the EU, wherever the company sits, which is why an American model maker follows it. It explicitly does not apply to natural persons using AI in a purely personal, non professional activity, nor to systems used solely for military purposes or for scientific research and development.

Everything else is sorted onto a risk ladder, which the Commission’s framework page describes in plain terms. Unacceptable risk is banned outright: social scoring, which the regulation’s recitals describe as the scoring of natural persons by public or private actors alike, not by governments only, untargeted scraping of the internet or CCTV material to build facial recognition databases, emotion recognition in workplaces and education, manipulative techniques that cause significant harm, and, with narrow law enforcement exceptions, real time remote biometric identification in public spaces. High risk covers AI used in domains where a wrong output damages a life: hiring, credit, education, medical devices, critical infrastructure, border control, justice. These systems stay legal but must carry risk management, quality training data, logging, human oversight and CE style conformity checks. Limited risk carries transparency duties: a chatbot must be recognisable as a machine, and AI generated or manipulated media must be disclosed. Minimal risk, which is most AI, from spam filters to game opponents, carries no new duties at all.

The timeline, date by date

The regulation entered into force on 1 August 2024, and its obligations switched on in stages. The bans on unacceptable practices, together with the AI literacy duty on staff who run these systems, entered into application on 2 February 2025. The governance rules and the obligations for general purpose AI models, the chapter aimed at the model makers themselves, became applicable on 2 August 2025. The Act itself became applicable on 2 August 2026, and that is the date the transparency duties attach to.

The high risk regime is the part still arriving, and its dates have moved. The Commission’s own framework page now states that the rules for high risk use cases in the sensitive areas of Annex III have been extended to 2 December 2027, and that the rules for high risk AI embedded into regulated products, the Annex I list of goods that already carry their own EU safety law, have an extended transition period until 2 August 2028. Between 2 August 2026 and 2 December 2027, therefore, a reader in Europe lives with the bans, the model maker duties and the transparency rules, and not yet with most of the high risk regime. Anyone told the Act is fully in force is being sold a simpler story than the Commission prints.

Enforcement is shared. Each member state names its national authorities, while the Commission’s AI Office supervises the general purpose model duties directly. Fines reach 35 million euros or 7 percent of worldwide annual turnover, whichever is higher, for a banned practice, with lower ceilings for lesser breaches.

Where the big model makers fit

The Act was drafted before chatbots went mainstream, then amended to catch them. The result is the general purpose AI chapter: rules for models trained broadly enough to serve many tasks, which is exactly the kind this site tracks on its pricing and plans pages. Providers of such models must publish technical documentation, give downstream developers the information needed to comply in turn, respect EU copyright law including creators’ opt outs, and publish a summary of the content used for training.

A model judged to carry systemic risk owes more. The Commission’s fact page on general purpose AI obligations lists the additions plainly: notify the Commission, assess and mitigate the risk, report incidents, and put cybersecurity protections in place. Which models those are is a compute test rather than a verdict on fame. The Commission’s own questions and answers name 10^25 floating point operations of training compute as the level at which systemic risk is presumed, and say that much training currently costs tens of millions of euros.

Open weights buy a partial exemption, not a general one. The same questions and answers state that the duties to draw up documentation and provide it to the AI Office, national competent authorities and downstream providers do not apply where a model is released under a free and open source licence with its weights, architecture and usage information made publicly available, and that the exemption does not reach a model with systemic risk. None of this bans a model; it obliges paperwork, testing and disclosure.

What it means for you

If you live in Europe, the visible changes are mostly protections arriving quietly. Chatbots must identify themselves as machines where it is not obvious. AI generated images, audio and video must be disclosed, and deepfakes labelled. Emotion recognition pointed at you in the workplace or the classroom is already banned outright. Where an employer, a bank or a school uses AI on you in an Annex III sensitive area, the human oversight and complaint duties that come with that use are the part still arriving, on the extended 2 December 2027 date.

If you live elsewhere, you still feel the ripples. Global vendors tend to build one compliant version rather than several, so training data summaries, content labels and model documentation written for Brussels reach everyone. The other ripple is timing: EU availability of a new model sometimes lags its home launch while the paperwork catches up, as our guide to reading a model announcement notes. The Act does not change what you owe anyone: using these tools at home remains, in the regulation’s own words, outside its scope.