High-level summary of the AI Act | EU Artificial Intelligence Act

Updated on 31 August 2026 in accordance with the amendments to the AI Act adopted as part of the Digital Omnibus on AI.
In this article we provide you with a high-level summary of the AI Act, selecting the parts which are most likely to be relevant to you regardless of who you are. We provide links to the original document where relevant so that you can always reference the Act text.
To explore the full text of the AI Act yourself, use our AI Act Explorer. Alternatively, if you want to know which parts of the text are most relevant to you, use our Compliance Checker.
The AI Act classifies AI systems according to their risk:
The majority of obligations fall on providers (developers) of high-risk AI systems.
Deployers are natural or legal persons, public authorities, agencies or other bodies that deploy an AI system in a professional capacity, not affected end-users.
General-purpose AI (GPAI) models:
Our goal is to build the most useful, authoritative, and comprehensive guide to the AI Act anywhere on the internet. We’ll never put this behind a paywall or use it to sell you a service. We do this because we think good AI governance matters, and that means making authoritative guidance genuinely accessible.
If you want to help us out, please consider contributing a guest post to help others understand and navigate the Act, or send your ideas and feedback for the website to me (Taylor, Design & Web Manager) at: [email protected]. To stay up-to-date, subscribe to our bi-weekly AI Act newsletter, the world’s most trusted regular AI Act publication with over 50,000+ subscribers. We’ve published over 100 updates since 2022.
This website is built and maintained by the Future of Life Institute — the world’s oldest and largest nonprofit working for the responsible development of AI.
The following types of AI system are ‘Prohibited’ according to the AI Act.
Notes on real-time remote biometric identification:
Using AI-enabled real-time RBI is only allowed to be deployed to confirm the identity of the specifically targeted individual and must account for the harm caused by not using the system, and the affected persons’ rights and freedoms.
Before deployment, police must complete a fundamental rights impact assessment and register the system in the EU database, though, in duly justified cases of urgency, deployment can commence without registration, provided that it is registered later without undue delay.
Before deployment, they also must obtain authorisation from a judicial authority or independent administrative authority[1], though, in duly justified cases of urgency, deployment can commence without authorisation, provided that authorisation is requested without undue delay and in any case within 24 hours. If authorisation is rejected, deployment must cease immediately, deleting all data, results, and outputs.
↲ [1] Independent administrative authorities may be subject to greater political influence than judicial authorities (Hacker, 2024).
Some AI systems are considered ‘high-risk’ under the AI Act. Providers of those systems will be subject to additional requirements.
High-risk AI systems are those:
High-risk AI providers must:
GPAI model means an AI model, including when trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable to competently perform a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications. This does not cover AI models that are used before placement on the market for research, development and prototyping activities.
GPAI system means an AI system which is based on a general-purpose AI model, that has the capability to serve a variety of purposes, both for direct use as well as for integration in other AI systems.
GPAI systems may be used as high-risk AI systems or integrated into them. GPAI system providers should cooperate with such high-risk AI system providers to enable the latter’s compliance.
All providers of GPAI models must:
Free and open-source licence GPAI models – whose parameters, including weights, information on model architecture and model usage are publicly available, allowing for access, usage, modification and distribution of the model – only have to comply with the latter two obligations above, unless the free and open-source licence GPAI model is a GPAI model with systemic risk.
GPAI models present systemic risks when the cumulative amount of compute used for its training is greater than 10^25 floating point operations (FLOPs). Providers must notify the Commission if their model meets this criterion without delay and in any case within 2 weeks. The provider may present arguments that, despite meeting the criteria, their model does not present systemic risks. The Commission may also decide on its own, or following a qualified alert from the scientific panel of independent experts, that a model presents a systemic risk, despite not reaching the compute threshold.
In addition to the four obligations above, providers of GPAI models with systemic risk must also:
All GPAI model providers may demonstrate compliance with their obligations if they voluntarily adhere to the General-Purpose Code of Practice until European harmonised standards are published. Providers that don’t adhere to the Code of Practice must demonstrate alternative adequate means of compliance.
The General-Purpose Code of Practice
How will the AI Act be implemented?
See our full implementation timeline for all key milestones relating to the implementation of the AI Act.
This page aims to provide an overview of AI systems, and in particular general-purpose AI (GPAI) systems, used for the purpose of therapy or emotional support under the AI Act. It explores the obligations of providers of these AI systems both on the system as well as...
The scientific panel of independent experts (the Scientific Panel) is a body established under