EU's AI Act goes live: Landmark law hits chatbots, deepfakes & high-risk algorithms with tough rules

The era of unregulated artificial intelligence in Europe officially shifted on August 2 as the European Commission's AI Office and national authorities began enforcing the European Union’s landmark Artificial Intelligence Act. 

First proposed in 2021, provisionally agreed upon after marathon negotiations in December 2023, and formally adopted by the Council of the EU in May 2024, the legislation stands as the world’s first comprehensive horizontal framework for artificial intelligence.

Mirroring the global reach of the General Data Protection Regulation (GDPR) in data privacy, the AI Act aims to establish an international standard for safe, transparent, and ethical technology. 

Clear warnings for synthetic Media 

Under the rules now in force, developers and deployers of interactive AI systems face strict transparency obligations. Chatbots and conversational tools must explicitly inform users that they are interacting with an artificial intelligence system rather than a human.

Additionally, deepfakes — including images, audio, or video generated or edited using AI — must carry visible labels and embedded machine-readable watermarks to streamline automated detection across platforms. 

The measures are designed to curb online deception, prevent harmful manipulation, and restore public trust. Coinciding with the rollout, the Commission released an initial roster of more than 180 organizations that have signed on to the official Code of Practice on transparency for AI-generated content. 

A four-tiered pyramid of risk 

At the core of the framework is a pyramid structure that categorizes AI systems into four distinct levels based on the threat they pose to safety, fundamental rights, and society: 

1. Unacceptable Risks (Banned): Systems posing clear threats to safety or human rights are strictly prohibited. These include cognitive behavioral manipulation, social scoring, predictive policing, emotion recognition in workplaces or schools, and real-time remote biometric identification in public spaces by law enforcement, subject to narrow exceptions. 
2. High Risks (Strict Compliance): AI technologies used in critical sectors — such as medical disease diagnosis, autonomous vehicles, and criminal investigations — must undergo rigorous testing, maintain human supervision, and satisfy strict data governance requirements before accessing the EU single market. 
3. Limited Risks (Transparency Rules): Systems like chatbots and synthetic content generators are allowed but must notify users when AI is actively operating or generating content. 
4. Minimal or No Risks (Unregulated): Applications such as AI-powered video games or standard spam filters face no regulatory restrictions under the Act and can be used freely. 

Strict accountability for powerful models 

Oversight also extends to general-purpose AI (GPAI) models capable of executing a broad range of complex tasks, including autonomous AI agents. Oversight will zero in on advanced GPAI models that present systemic risks, such as large-scale threats involving chemical, biological, radiological, or nuclear incidents, cyber offenses, loss of human control, or fundamental rights violations. 

To operate in the single market, all GPAI developers must document technical details for regulators, maintain strict copyright compliance policies, and publish detailed public summaries outlining the content used to train their models.

Non-compliance carries steep consequences, with non-compliant firms facing heavy fines calculated as a percentage of their global annual turnover from the previous year, though proportional caps are maintained for small and medium-sized enterprises (SMEs) and start-ups. 

Shared enforcement & New reporting channels 

Responsibility for monitoring compliance is distributed across three key bodies: 

• The AI Office: Oversees GPAI providers, systems integrated into Very Large Online Platforms (VLOPs), and search engines designated under the Digital Services Act. 
• National Competent Authorities: Manage oversight for standard AI applications within individual EU member states. 
• European Data Protection Supervisor (EDPS): Directs compliance for AI deployments within European Union institutions. 

To support enforcement, the AI Office announced the appointment of Professor Alessandro Abate from the University of Oxford as Lead Scientific Adviser. He will work alongside a newly convened Scientific Panel of 60 independent AI experts to evaluate model risks and establish testing standards. Furthermore, the Commission launched dedicated online complaint and whistleblower tools, alongside secure channels for downstream developers to report potential violations. 

Addressing the rollout, Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, emphasised the dual mandate of protecting citizens while fostering technological development. "AI is a transformative technology that can bring extraordinary benefits to our people and businesses. But we are also seeing that harms can occur if AI is not properly designed and used and the most advanced models create risks on an entirely new scale. Europe anticipated this development. With the AI Act, we established a clear, risk-based and durable framework for trustworthy AI — one that gives innovators legal certainty while protecting the public interest. As enforcement begins, we are taking an important step towards AI that people and businesses can understand and trust, and whose benefits are shared widely across our society," she said. 

Looking ahead, the EU has outlined a phased implementation timeline for the remaining sections of the framework. Following the recent adoption of the 'Omnibus VII' simplification package, rules governing high-risk AI systems have been set to apply on December 2, 2027, while those integrated into regulated physical products will take effect on August 2, 2028. Dedicated bans targeting non-consensual sexually explicit AI content and child sexual abuse material will go into force on December 2, 2026.