The EU AI Act enters into force

The event and the narrow claim

On 1 August 2024, Regulation (EU) 2024/1689, the European Union's Artificial Intelligence Act, entered into force. The European Commission's own announcement fixed the date twenty days after publication in the Official Journal on 12 July 2024, the standard interval for EU regulations. The narrow, documented claim is precise and frequently misreported: entry into force did not make the law's substantive obligations binding. It started a clock. The Act's requirements were written to become applicable in stages over the following years, so 1 August 2024 is the legal beginning of a rollout, not the day on which compliance became mandatory across the board.

That distinction is the essence of this event, and it deserves to be held apart from any broader historical judgment. The narrow fact is administrative: a text with legal identity now exists, and its transition periods have begun to run. The broader judgment, that the AI Act is the first comprehensive, horizontal, risk-based statute governing artificial intelligence enacted by a major jurisdiction, is defensible but belongs to a different order of claim. This report keeps the two separate, because much of the commentary at the time collapsed them and described the entire regime as live on day one, which it was not.

The phased calendar the clock started

The Act carries its own timetable in its final provisions, and the Commission's regulatory-framework page sets out the sequence. Six months after entry into force, on 2 February 2025, the prohibitions on "unacceptable risk" practices and the duties on AI literacy became applicable. Twelve months in, on 2 August 2025, the rules for general-purpose AI models, the governance provisions that stand up the enforcement bodies, and the penalty regime took effect. The bulk of the Act, including most obligations for high-risk systems listed in Annex III, was scheduled for 2 August 2026, twenty-four months after entry into force. High-risk systems that are safety components of products already regulated under other EU law (Annex I) were given a longer runway, originally to 2 August 2027.

This staggering was deliberate. Prohibitions concern conduct that the legislature judged intolerable, so they arrive first and need no conformity infrastructure. High-risk obligations, by contrast, depend on standards, notified bodies, and technical documentation that did not yet exist in 2024, so they were pushed further out. It is worth stressing that the schedule has not stayed frozen: the Commission's live timeline now shows several high-risk deadlines shifted later still, into late 2027 and 2028, reflecting subsequent simplification measures. A careful reader should always consult the current consolidated text rather than the version enacted in 2024, exactly the caveat that the Act's own amendment mechanism anticipates.

The road to Regulation 2024/1689

The Act did not appear fully formed. Its lineage runs through European soft law and a long legislative negotiation. In April 2019, the Commission's High-Level Expert Group on AI published its Ethics Guidelines for Trustworthy AI, a non-binding framework built around seven requirements including human oversight, technical robustness, privacy, transparency, and accountability. Those principles supplied the vocabulary that the eventual statute would try to make enforceable. The Commission tabled its formal legislative proposal in April 2021, and the text then passed through three years of negotiation among the Commission, the Parliament, and the Council.

The negotiation's decisive moments are documented. Political agreement in the trilogue was reached in December 2023, after a marathon session that turned largely on how to treat foundation models and biometric surveillance. The Parliament then adopted the text on 13 March 2024, a vote the European Parliament records as passing by a wide margin, and the Council gave final approval in May 2024. Reading the event as the endpoint of this process, rather than as an isolated act of legislation, clarifies what "first" means here: not the first idea of regulating AI, but the first time a comprehensive, binding, cross-sector text cleared a full legislative process in a jurisdiction of the EU's size.

The constraint the Act was written to remove

The problem the AI Act set out to address was fragmentation and gaps, not the absence of any law at all. Before it, AI systems in Europe were governed by a patchwork: general product-safety law, sector rules for medical devices or vehicles, anti-discrimination law, and, crucially, the General Data Protection Regulation where personal data was involved. That patchwork left recognisable holes. A hiring-screening model or a credit-scoring system could cause serious harm through opaque, systematic decisions without triggering a single instrument designed for the specific risks of automated decision-making at scale.

The Act's structural answer was to regulate the use of AI rather than the technology as such, and to make obligations proportionate to risk. This is why the definition of an "AI system" matters so much, and why the drafters aligned it with the internationally negotiated OECD definition and AI Principles, first adopted in 2019 and updated in 2024. Choosing a shared definition was a deliberate move to reduce the classic regulatory failure in which each jurisdiction draws the boundary of "AI" differently and compliance becomes incoherent across borders. The constraint being removed, in other words, was not "no rules" but "no coherent, horizontal, risk-calibrated rules."

How the law works: a risk pyramid, not a technology rule

The Act sorts systems into tiers, and the obligations follow the tier rather than the underlying model. At the top sit "unacceptable risk" practices, which are simply banned. As the Commission's framework page describes, these include social scoring by public authorities, manipulative or subliminal techniques, exploitation of vulnerabilities, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools, and, with narrow law-enforcement exceptions, real-time remote biometric identification in public spaces.

Below the prohibitions sit high-risk systems, the tier that carries the heaviest ongoing compliance load. These are AI used in contexts such as hiring, education admissions, credit decisions, critical infrastructure, migration, and the administration of justice, plus AI acting as a safety component of regulated products. High-risk providers must operate a risk-management system, meet data-governance and technical-documentation requirements, ensure human oversight, and achieve appropriate accuracy, robustness, and cybersecurity, all subject to conformity assessment before market entry. A third tier, limited or transparency risk, imposes disclosure duties: users must be told when they are interacting with a chatbot, and AI-generated or manipulated media must be labelled. The large remainder, the "minimal risk" tier that covers spam filters and most game AI, carries no specific obligations. The architecture is a pyramid in which the intensity of regulation is meant to track the severity of plausible harm rather than the sophistication of the model.

The general-purpose AI problem and how the Act answered it

The rise of large general-purpose models between the 2021 proposal and the 2024 text forced a late redesign, and this is one of the most historically interesting features of the event. A risk framework organised around specific uses does not fit a model that can be adapted to countless downstream uses by parties the original developer never meets. The Act therefore added a distinct regime for general-purpose AI (GPAI) models, applicable from 2 August 2025, that regulates the model layer directly rather than only the application layer.

GPAI providers must supply technical documentation, publish a sufficiently detailed summary of training content, and put in place a policy to respect EU copyright law. A subset of models judged to carry "systemic risk," identified partly by a compute threshold set at training runs above 10^25 floating-point operations, face additional obligations: model evaluation, adversarial testing, serious-incident reporting, and cybersecurity protections. To operationalise these duties, the Commission facilitated a voluntary General-Purpose AI Code of Practice, whose final version was delivered on 10 July 2025 and which addresses transparency, copyright, and safety and security. The GPAI provisions show the Act adapting under pressure to a technical shift that its original design had not anticipated, which is a more honest way to read the event than treating the statute as a finished blueprint delivered whole.

Enforcement architecture and the weight of the penalties

A statute is only as consequential as its enforcement machinery, and the Act builds a two-level structure. National market-surveillance authorities in each member state supervise most systems, while a new European AI Office, established inside the Commission and staffed by well over one hundred people across specialised units, holds direct responsibility for general-purpose AI models. The AI Office can evaluate models, request documentation, demand corrective measures, and, where necessary, restrict a model's availability or propose fines. A European Artificial Intelligence Board coordinates the national authorities to keep application consistent across the single market.

The penalties are calibrated to be felt by the largest firms. Breaching the prohibitions can draw fines of up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. Most other violations of the Act's obligations can reach 15 million euros or 3 percent of turnover, and supplying incorrect or misleading information to authorities can cost up to 7.5 million euros or 1 percent. Turnover-based ceilings are the same design the EU used to give the GDPR global teeth, and they signal that the Act is meant to bind the world's largest developers, not merely European startups.

Competing governance approaches of the same era

The Act should be read against the other governance instruments that appeared in the same window, because they were not the same kind of thing. In the United States, the NIST AI Risk Management Framework, published in January 2023, is a voluntary, standards-style guide for organisations that manage AI risk, with no binding force and no penalties. In November 2023, the United Kingdom convened the AI Safety Summit that produced the Bletchley Declaration, a multilateral political statement of shared concern about frontier AI that created no obligations and no institutions.

Set beside those, the AI Act is a different instrument in kind, not merely in degree. It is hard law with defined obligations, an enforcement body, and financial penalties, where the others are soft law and diplomacy. That contrast is the clearest way to understand what was genuinely novel about the event: many jurisdictions had by 2024 articulated principles and voluntary frameworks, and the OECD Principles had provided a shared reference point since 2019, but the EU converted principles into binding, cross-sector obligations backed by sanctions. Whether hard law or soft coordination is the better tool for a fast-moving technology remains a live and legitimate debate, and the coexistence of these instruments is itself part of the historical record.

The documented downstream influence

The strongest evidence for the event's significance is what followed it rather than any rhetoric about it. Because the Act's obligations attach to any provider placing a system on the EU market, its practical reach extends to firms headquartered elsewhere, a dynamic often called the Brussels effect, in which the largest single market's rules become a de facto global compliance baseline. The GDPR is the reference case, and the AI Act reuses the same mechanisms, turnover-based fines and extraterritorial scope, that made GDPR travel.

Concrete downstream artefacts are already visible. The GPAI Code of Practice gave frontier developers a written template for documentation, copyright policy, and safety testing, and its negotiation drew direct participation from the major model providers. The build-out of the AI Office as a technical regulator with model-evaluation capacity is a second concrete consequence, creating a public body whose job is to inspect frontier models. These are documented institutional facts, not predictions, and they are the appropriate basis for judging influence: not that the Act "changed everything," but that it produced specific instruments and organisations that other actors now have to engage with.

The honest limits and open questions

Several caveats keep the judgment proportionate. The most important is the one this report opened with: entry into force is not full applicability, so on 1 August 2024 almost nothing changed for a system already on the market. The heaviest obligations, those on high-risk systems, arrive years later and depend on harmonised technical standards that were still being drafted, which means the Act's real bite is deferred and contingent on downstream standard-setting rather than settled by the enactment itself.

There are further open questions. The compute threshold used to flag systemic-risk models is a proxy that critics argue is both over- and under-inclusive, and it can be overtaken by algorithmic efficiency gains. The Act's definitions and annexes are subject to amendment, and, as noted, the implementation calendar has already been revised, which complicates any confident statement about what will be binding and when. Compliance cost and its effect on smaller European developers is a genuine and contested concern rather than a settled matter. None of these caveats negates the event, but each one argues against reading it as a finished, self-executing solution.

How to place the event in AI history

The disciplined way to situate 1 August 2024 is to keep the narrow claim and the broad judgment distinct. The narrow claim is that a specific text, Regulation (EU) 2024/1689, acquired legal force and began a multi-year, phased application schedule. That is verifiable and modest. The broad judgment is that this was the first time a major jurisdiction converted AI governance principles into a comprehensive, binding, risk-based regime with real penalties and a dedicated regulator, and that judgment is well supported by the contrast with the voluntary frameworks of the same era.

A reader tracing the timeline outward can follow three threads. What earlier instrument supplied a necessary component, as the Ethics Guidelines supplied principles and the GDPR supplied the enforcement template? What later artefact operationalised the law, as the GPAI Code of Practice and the AI Office did? And what limitation still requires resolution, as harmonised standards, the systemic-risk threshold, and the shifting calendar all do? The event matters because it marks a governance turning point, the moment binding hard law entered a field previously shaped by principles and summits, and not because it settled how AI should be governed. That question remains open, which is precisely why the rollout it began is worth watching rather than filing away as concluded.

References

• European Commission (2024). European Artificial Intelligence Act comes into force.
• European Union (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act).
• European Commission (2024). AI Act: Regulatory framework for AI.
• European Parliament (2024). EU AI Act: first regulation on artificial intelligence.
• European Commission (2025). General-Purpose AI Code of Practice.
• European Commission (2024). European AI Office.
• High-Level Expert Group on AI (2019). Ethics Guidelines for Trustworthy AI.
• OECD (2019). OECD AI Principles.
• UK Government (2023). The Bletchley Declaration by countries attending the AI Safety Summit.
• NIST (2023). AI Risk Management Framework.
• European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation).