AI Act

The AI Act applies to providers and deployers of AI systems established or located in a third country where the output produced by the AI system is used in the Union.

GDPR Article 22 is the pre-existing European law of automated decision-making: it did not wait for the AI Act and applies to systems the AI Act classifies as minimal risk.

Under AI Act Article 25 a distributor, importer or deployer becomes a provider — assuming the full obligation set — if it puts its name or trademark on a high-risk system, substantially modifies it, or modifies its intended purpose.

The GPAI Code of Practice supplies the operative detail behind AI Act Articles 53 and 55, and it is voluntary.

The AI Omnibus delayed the AI Act's high-risk obligations by sixteen months for Annex III systems and twelve for Annex I product-embedded systems, while leaving prohibitions, GPAI duties and transparency close to the original schedule.

The AI Omnibus, Regulation (EU) 2026/1744, entered into force on 27 July 2026, amending the AI Act.

Article 5 AI Act prohibits manipulative or deceptive techniques, exploitation of vulnerabilities due to age, disability or a social or economic situation, social scoring leading to detrimental treatment, criminal-risk prediction based solely on profiling, untargeted scraping of facial images for facial recognition databases, emotion inference in workplaces and education institutions, biometric categorisation deducing sensitive attributes, and real-time remote biometric identification in publicly accessible spaces for law enforcement, save for narrow exceptions.

Article 50 AI Act requires that people be informed when they interact with an AI system, that synthetic audio, image, video or text outputs be marked in a machine-readable format, and that deep fakes and AI-generated text published to inform the public on matters of public interest be disclosed.

Article 3(63) AI Act defines a general-purpose AI model as one that displays significant generality, is capable of competently performing a wide range of distinct tasks and can be integrated into a variety of downstream systems or applications.

Every provider of a general-purpose AI model must keep technical documentation (Annex XI), provide information to downstream providers (Annex XII), put in place a policy to comply with Union copyright law and publish a sufficiently detailed summary of training content; the documentation duties do not apply to models released under a free and open-source licence, except models with systemic risk.

Article 51(2) AI Act presumes a general-purpose AI model to have high-impact capabilities, and so systemic risk, when the cumulative compute used for its training exceeds 10^25 floating point operations.

The AI Omnibus replaced Article 4 of the AI Act: providers and deployers must now take measures to support the development of AI literacy of their staff, and the obligation does not require them to guarantee any specific level of AI literacy — where the original text required measures to ensure a sufficient level.

The AI Act does not apply to AI systems placed on the market, put into service or used exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.

The AI Act Article 5 prohibitions bind public authorities as well as firms: social scoring by government, predictive policing based solely on profiling, and emotion recognition in workplaces and schools are prohibited outright for states as well as companies.

The GPAI Code of Practice was finalised on 10 July 2025 after three drafts and a final text.

The AI Omnibus was proposed on 19 November 2025; the Council adopted its general approach on 13 March 2026 and Parliament its mandate on 26 March 2026, by 569 votes to 45; agreement was reached on 7 May 2026; Parliament approved the text on 16 June and the Council on 29 June 2026.

The Commission's July 2025 guidelines on general-purpose AI models add an indicative criterion: a model trained with more than 10^23 FLOP that can generate language, text-to-image or text-to-video output.

The AI Act does not regulate all AI: the Commission's position is that it introduces no rules for AI deemed minimal or no risk — applications such as AI-enabled video games or spam filters — and that the vast majority of AI systems currently used in the Union fall into that category.

Almost the entire EU digital rulebook rests on Article 114 TFEU (internal-market harmonisation) rather than on a speech, safety or morality competence, and that choice shapes each instrument's form.

The instruments following the GDPR reproduce the same institutional shape — a specialised vocabulary, principles, case-specific rights and a supervisory apparatus — a pattern described as act-ification and GDPR mimesis.

The recurring objection across every instrument is a capacity-ambition gap: broad obligations assigned either to a single Commission directorate with a few hundred staff or to twenty-seven national authorities of radically unequal resource.

The operative standards of the EU digital rulebook — systemic risk, high-impact capabilities, effective interoperability, genuinely equivalent alternative — are almost all open-textured, so the law's effective content is set by Commission guidelines, delegated acts, codes of practice and harmonised standards rather than by the legislature.

A single recommender system can engage the GDPR, the DSA, the AI Act and, for a gatekeeper, the DMA at once, so the rational compliance strategy is one control set mapped to several regimes.

2016-2024 was the accumulation phase of EU digital regulation and 2025-2027 is a consolidation phase, but consolidation is contested from within: simplification and expansion are happening in the same instruments.

GDPR Art. 35 DPIAs, DSA Art. 34 systemic risk assessment and AI Act Art. 27 fundamental rights impact assessment are three overlapping assessment duties; an organisation running all three separately duplicates work regulators themselves acknowledge is duplicated.

The AI Act is structurally product-safety legislation — conformity assessment, technical documentation, notified bodies, CE marking, post-market monitoring — and that choice determines both its strengths and the specific way it is failing to arrive on schedule.

The 10^25 FLOP systemic-risk presumption is an administrable proxy for an unadministrable concept: risk does not scale linearly with compute, the threshold ages downward as efficiency improves, and domain-specific risk below it escapes entirely.

The harmonised standards needed to demonstrate conformity were not ready; requiring conformity assessment against standards that do not exist is not regulation but a trap, and their non-arrival despite being commissioned years in advance is an institutional failure.

The AI Act is one instrument in a system that already regulated most of its subject matter: automated decision-making by GDPR Art. 22 since 2018, algorithmic recommender risk by DSA Arts. 34–35, product liability by the revised PLD — while the proposed AI Liability Directive was abandoned, leaving a gap in the fault-based route.

Amendments passed by the Hungarian Parliament in March 2025 extending police use of facial recognition to all infractions constitute real-time remote biometric identification in breach of AI Act Article 5 and of the Charter, according to legal analysis by EDRi, ECNL, Liberties and the Hungarian Civil Liberties Union.

This body of law restrains corporate power far more effectively than it restrains state power, and the enforcement asymmetry between corporate and state addressees is not seriously disputable.

The Commission has not opened infringement proceedings against Hungary on the basis of the biometric surveillance legislation.