EU AI Act Entering Into Force1 Aug 2024

The EU AI Act enters into force on 1 August 2024, 20 days after its publication in the Official Journal of the EU. Entering into force is an administrative milestone which does not create any immediate legal obligations for providers or deployers of AI systems. The first legal obligations under the Act will come into effect on 2 February 2025 (6 months from entering into force) – the effect of this will be to ban AI systems with an unacceptable risk.

For more information on who the EU AI Act applies to, see our article here. For assistance with AI system risk categorisation, or to discuss our approach to compliance, download our guide or reach out to a member of the team.

The latest EU AI Act legal requirements came into effect2 February 2025

AI Literacy Rules

Providers and deployers of AI systems must now implement measures to ensure that personnel and other persons dealing with the operation and use of AI systems possess adequate AI literacy in order to do so in an informed way. The threshold for AI literacy should take into account the context the AI systems are to be used in and the groups of people on whom the systems are to be used.

We offer AI literacy training, designed for businesses of all shapes and sizes, providing you and your colleagues with the skills and knowledge to use AI tools responsibly and confidently. For more information, click here.

Unacceptable Risk Ban

The Act enforces a prohibition on AI systems identified as posing an "unacceptable risk" in accordance with Article 5. The Act prohibits systems which have the consequence of undermining fundamental human rights. AI systems prohibited since 2 February 2025 include those which have the following functions or characteristics:

• Engage in deception, manipulation, or use subliminal techniques;
• Use social scoring for public or private purposes;
• Exploit biometric data in real-time or for categorisation purposes (i.e. to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs or sexual orientation);
• Scrape internet or CCTV for facial images to build-up or expand databases;
• Recognise emotions in the workplace and education institutions;
• Conduct certain types of predictive risk profiling; and
• Exploit vulnerable persons;

The maximum penalty for breaches in respect of prohibited AI systems is the higher of: (a) EUR 35 million, or (b) up to 7% of worldwide annual turnover.

The EU Commission has published Guidelines on prohibited AI practices, as defined by the AI Act.

AI Office Codes of Practice required to be ready by 2 May 2025

The final draft of the General-Purpose AI Code of Practice (the Code) was due to be presented for approval on 2 May 2025. The Code, which has undergone an iterative drafting process involving nearly 1000 stakeholders and three previous drafts, is intended to facilitate the proper application of the EU AI Act's rules for general-purpose AI models, including transparency and copyright-related rules, risk assessment, and mitigation measures. The final version was, in the end, presented for approval in July 2025.

Details of the Code

The Code will be an important tool for General-Purpose AI providers to demonstrate their compliance with the AI Act (whilst not providing a presumption of conformity). However, not all GPAI providers are prepared to confirm that they will sign the Code. Given the evolving state of AI, the drafting of the Code aims to strike a balance between clear commitments and the flexibility to adapt as AI technology evolves, but its passage to date has been controversial. Article 56 EU AI Act outlines the key issues addressed in the Code. These include:

• the means to ensure that information is kept up to date in light of market and technological developments (transparency);
• the adequate level of detail for the summary about the content used for training (copyright);
• the identification or the type and nature of the systemic risks, including, where appropriate, their sources (risk assessment); and
• the measures, procedures and modalities for the assessment and management of the systemic risks identified above (mitigation measures).

We have analysed the final version of the Code here.

Full EU AI Act applies to AI systems (including Annex III High Risk AI Systems)
2 August 2026

Beatae eum odio nulla ullam? Tempore debitis fugiat expedita harum aperiam magnam inventore id, molestiae animi neque quae ad quam quo tenetur architecto, quasi necessitatibus aliquam adipisci. Aut, aperiam quidem?

Rules on Annex I AI systems apply (e.g. where AI is a safety component in anything governed by the EU Machinery Regulations, Medical Devices Regulations, etc.)
2 August 2027

Eligendi possimus quis similique iste harum, corporis impedit vitae quo asperiores aut, ut officia optio dolorum veritatis quae sint labore iusto distinctio excepturi quasi cum cupiditate ducimus ea ab? Vero.