Short answer

The EU AI Act is the European Union's law regulating AI by risk level. It bans some practices, requires chatbots and deepfakes to be disclosed, and puts strict rules on high-risk systems such as hiring and credit scoring. Most of it applies from 2 August 2026, with some high-risk rules delayed to 2027 and 2028.

Key takeaways

  • The Act sorts AI into four levels: banned, high risk, transparency risk and minimal risk.
  • Banned practices and AI literacy duties have applied since February 2025.
  • You should be told when you are talking to a chatbot and when content is an AI-made deepfake.
  • High-risk rules, such as for CV screening and credit scoring, are scheduled for December 2027 and August 2028 after the AI Omnibus changes.
  • The Act does not stop scammers, who ignore laws. Your own checks still matter.

What the EU AI Act is

The EU AI Act (Regulation 2024/1689) is the EU’s broad law regulating artificial intelligence. It entered into force on 1 August 2024. Instead of regulating all AI the same way, it sorts systems by the risk they pose and sets rules to match.

If you live in the EU, it affects what companies can sell you. If you live elsewhere, it still matters because large AI providers often build one product for many countries.

The four risk levels

According to the European Commission, the Act has four levels:

  • Unacceptable risk: banned. Examples include social scoring and emotion recognition in workplaces and schools.
  • High risk. Systems that can seriously affect health, safety or rights, such as exam scoring, credit scoring or CV-sorting tools. These face strict requirements before they reach the market.
  • Transparency risk. Chatbots must disclose that they are AI, and deepfakes and certain AI-generated text on matters of public interest must be labelled.
  • Minimal risk. No specific rules. This covers most AI today, such as spam filters and video game AI.

What this means in daily life

Chatbots. If you are speaking to an AI, the provider must make that clear. That helps against bots posing as human customer service staff.

Deepfakes and AI content. Realistic synthetic images, audio and video should be labelled. Do not read too much into this. A label helps on a legitimate platform. A scam call using a cloned voice will never come with a disclaimer. Our guide on AI voice clone scams covers how to check.

Decisions about you. Hiring tools, credit scoring and exam assessment fall under the high-risk category. When those rules apply, providers must meet requirements on matters such as risk management, data quality, documentation and human oversight.

AI literacy. The Act’s AI literacy obligations began to apply in February 2025, alongside the bans.

The timeline

Based on the European Commission’s page:

  • 1 August 2024: the Act entered into force.
  • 2 February 2025: banned practices and AI literacy obligations began to apply.
  • 2 August 2025: governance rules and obligations for general-purpose AI models began to apply.
  • 2 August 2026: the Act became generally applicable, and the AI Office and national authorities took over supervision and enforcement. Transparency rules also fall in this period.
  • December 2026: a further ban on non-consensual intimate content and child sexual abuse material, including nudification apps.
  • 2 December 2027: high-risk rules for areas such as biometrics, education, employment and migration.
  • 2 August 2028: high-risk rules for AI built into regulated products.

The last two dates were pushed back by the AI Omnibus, which the Commission says entered into force on 27 July 2026 after publication in the Official Journal. Law firm summaries say systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with the marking of AI-generated content, so exact obligations vary by product. Always check the Commission page for the current position.

What it will not do

The Act regulates providers and deployers who follow the law. It will not stop fraud gangs. Voice cloning, fake celebrity videos and AI-written phishing will continue to circulate, and the habits in our phishing messages guide still apply. If your data is exposed in an incident, what to do after a data breach explains the steps.

Think of the Act as raising the floor for legitimate companies. Your best protection against the rest remains verification: check the source, use official apps and never pay under pressure.

What you can do

  1. 01When a service says it is an AI, or labels content as AI-generated, note it. Absence of a label does not prove content is real.
  2. 02If an automated system makes a decision about you, ask the company how it works and whether a person can review it.
  3. 03Do not trust a deepfake just because it lacks a label. Scammers will not follow labelling rules.
  4. 04Report suspected breaches of the Act to your national market surveillance authority or consumer protection body.
  5. 05Check the European Commission's AI Act page for current dates before relying on any deadline.

Related reading: AI voice clone scams and the data breach tracker.

Frequently asked questions

Does the EU AI Act apply to me if I live outside the EU?

Mostly it applies to AI systems placed on the EU market or used in the EU, including by companies based elsewhere. If you are outside the EU, you may still benefit when global companies apply its rules to all users, but that is a company choice.

Will the Act stop deepfake scams?

No. It requires certain AI-generated content to be labelled, but criminals do not follow labelling rules. Treat labels as a useful signal on legitimate platforms, not as proof that unlabelled content is real. See our guide on AI voice clone scams.

What is banned under the Act?

Prohibited practices include social scoring and emotion recognition in workplaces and schools, according to the European Commission. A further ban on non-consensual intimate content and child abuse material, including nudification apps, is listed as taking effect in December 2026.

Have the dates changed?

Yes. According to the European Commission, the AI Omnibus, now in force, pushed high-risk rules for Annex III areas to 2 December 2027 and for products to 2 August 2028. Dates can shift again, so check the Commission page.

Sources

  1. AI Act: regulatory framework for artificial intelligence, European Commission
  2. Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex, Official Journal of the European Union, 2024-07-12
  3. The Digital Omnibus on AI enters into force today, Lewis Silkin, 2026-07-27

This article reflects public information as of 2026-11-05. AI tools and rules change quickly; we update articles when new facts are published. Spot an error? See our editorial and corrections policy.