---
title: "AI Act"
description: "The EU sorts artificial intelligence by risk: some practices banned since February 2025, transparency duties since August 2026. What it requires, and of whom."
url: https://attentionmachine.org/en/laws/ai-act/
lang: en
updated: 2026-10-25
license: "CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/)"
---

# AI Act

The first general law on artificial intelligence anywhere[^src-european-commission]. It does not regulate AI as a subject. It sorts uses by how much risk they create, bans a short list outright, and tells everyone else when they have to say a machine was involved.

## What it is

Regulation (EU) 2024/1689[^src-regulation-2024] — the Artificial Intelligence Act — was adopted on 13 June 2024, published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. It is built like a product-safety law rather than a media law: duties attach to a system according to what it is used for, and they fall on two roles, the provider that develops a system and puts it on the market, and the deployer that uses it.

> **Provider and deployer**
>
> The AI Act's two main addressees. A _provider_ develops an AI system, or has one developed, and places it on the EU market or puts it into service under its own name. A _deployer_ uses an AI system under its own authority — a company, a school, a public body, a publisher — but not a person using one for a purely personal, non-professional activity. Almost every question about whether a duty applies to you starts here, because the Act gives the two roles different obligations: marking generated output is the provider's job, disclosing that you used it is often the deployer's.
>
> **Sources**
>
> - [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), Article 3, points (3) and (4).
> - [European Commission — transparency obligations under Article 50 of the AI Act](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act).

## The risk tiers

The Commission[^src-european-commission] describes four levels. **Unacceptable risk**: a short list of practices banned outright by Article 5. **High risk**: systems used in employment, education, credit, critical infrastructure, law enforcement and similar settings, which must meet requirements on data, documentation, accuracy and human oversight before they can be sold. **Transparency risk**: systems people interact with or that generate content, which must disclose what they are, under Article 50. **Minimal risk**: everything else, with no new obligations — and the Commission says this is where the vast majority of systems in use in the EU sit.

## The prohibitions that matter here

Article 5[^src-regulation-2024] has applied since 2 February 2025. Three of its prohibitions touch the subject of this site directly.

**Manipulative or deceptive techniques.** It is prohibited to place on the market or use an AI system that deploys "subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques[^src-regulation-2024]", with the objective or the effect of "materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision", causing them to take a decision they would not otherwise have taken, in a way that causes or is reasonably likely to cause significant harm.

**Exploitation of vulnerabilities.** The same applies to a system that exploits vulnerabilities "due to their age, disability or a specific social or economic situation" to materially distort behaviour in a way that causes or is reasonably likely to cause significant harm. Intent is not required: the recitals[^src-regulation-2024] say it is enough that the harm results from the practice.

**Emotion inference at work and at school.** It is prohibited to use AI systems "to infer emotions of a natural person in the areas of workplace and education institutions[^src-regulation-2024]", except where the system is intended for medical or safety reasons. This is the narrowest of the three and the clearest: a classroom camera that scores attention or mood is not a grey area.

Two more prohibitions were added in 2026[^src-regulation-2026] and apply from 2 December 2026: AI systems that generate or manipulate sexual imagery of an identifiable person without that person's explicit consent, and systems that generate child sexual abuse material. Breaching Article 5 carries the Act's highest penalty[^src-regulation-2024] — up to €35 million or 7% of total worldwide annual turnover, whichever is higher. Other duties, including Article 50, carry up to €15 million or 3%.

## What Article 5 does not cover

The words are broad; the thresholds are not. Each prohibition requires a material distortion of behaviour _and_ significant harm, and the Act's own recitals[^src-regulation-2024] close the obvious gap explicitly: "common and legitimate commercial practices, for example in the field of advertising, that comply with the applicable law should not, in themselves, be regarded as constituting harmful manipulative AI-enabled practices." On the face of the text, an ordinary [engagement-optimised feed](https://attentionmachine.org/en/attention-machine/how-it-works/) is not what Article 5 was written to catch. The law the EU wrote for that is the [Digital Services Act](https://attentionmachine.org/en/laws/dsa/).

## Transparency: chatbots, deepfakes and generated text

Article 50[^src-european-commission-2026] has applied since 2 August 2026, and it is the part of the Act most people will meet.

A provider must design a system "intended to interact directly with natural persons[^src-regulation-2024]" so that people are told they are dealing with an AI system, unless that is obvious to a reasonably well-informed person. A provider of a system generating synthetic audio, image, video or text must mark the output "in a machine-readable format and detectable as artificially generated or manipulated" — systems already on the market before 2 August 2026 have until 2 December 2026[^src-european-commission-2026] to comply with that one. A deployer of an emotion-recognition or biometric-categorisation system must tell the people exposed to it. And a deployer who publishes a deepfake must disclose that the content was artificially generated or manipulated.

> **Synthetic media (deepfakes)**
>
> Images, audio, or video generated or altered by AI to depict people saying or doing things they did not. The AI Act gives the word a legal edge: Article 50(4) makes the _deployer_ — whoever publishes it — responsible for disclosing that the content was artificially generated or manipulated, with a narrower duty where the work is evidently artistic, satirical or fictional. Disclosure is separate from legality: labelling does not make content lawful, and from 2 December 2026 the Act prohibits outright the AI systems that generate sexual imagery of an identifiable person without their explicit consent.
>
> **Sources**
>
> - [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), Article 50(4).
> - Chesney & Citron (2019), [_Deepfakes and the New Disinformation War_](https://www.foreignaffairs.com/articles/world/2018-12-11/deepfakes-and-new-disinformation-war), Foreign Affairs.

There is one more provision, and it is the one that reaches publishers. Under the second part of Article 50(4)[^src-regulation-2024], a deployer of a system "that generates or manipulates text which is published with the purpose of informing the public on matters of public interest" must disclose that the text was artificially generated or manipulated. The exception is written into the same paragraph: the duty does not apply "where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content". The Commission's guidance[^src-european-commission-2026] reads that strictly — deliberate examination by people competent to do it, and control actually exercised, not a formal or superficial check.

## The timeline

The Act arrives in stages[^src-european-commission]. **2 February 2025**: the definitions and the Article 5 prohibitions. **2 August 2025**: the governance provisions and the rules for general-purpose AI models. **2 August 2026**: the Regulation applies generally, including Article 50, and from that date the AI Office[^src-european-commission-b] and the Member States' authorities are responsible for implementing, supervising and enforcing it.

The high-risk rules moved. The Digital Omnibus on AI[^src-regulation-2026] — Regulation (EU) 2026/1744 of 8 July 2026, published on 24 July 2026 and in force from 27 July 2026 — postponed the obligations for high-risk systems listed in Annex III to 2 December 2027, and those for high-risk AI built into regulated products to 2 August 2028. It did not postpone the prohibitions, and it did not postpone Article 50.

## How it sits beside the DSA

The two laws are layered, not rival. The AI Act regulates the systems; the Digital Services Act[^src-regulation-2022] regulates the services that carry them. Where AI systems or models are built into a designated very large online platform or search engine, the AI Act's recitals[^src-regulation-2024] say they fall under the DSA's own risk-management framework, and the corresponding AI Act obligations "should be presumed to be fulfilled" unless significant systemic risks not covered by the DSA appear. Running the other way, the AI Act's labelling duties are described as "particularly relevant to facilitate the effective implementation of" the DSA — because a platform cannot mitigate the systemic risk of artificially generated content spreading if it cannot tell which content that is. The AI Act also leaves the DSA's rules on intermediary liability untouched.

## What it means for a site like this one

Plainly: the AI Act does not regulate websites. It regulates providers and deployers of AI systems, and a site is caught only where it plays one of those roles.

Article 50(1) is about systems people talk to; there is no chatbot here. Article 50(2), the machine-readable marking[^src-european-commission-2026] of generated output, is a duty on the provider of the generative system — the company that makes the tool — not on someone who publishes its output. The second part of Article 50(4) is the one that comes closest to this site: text published to inform the public on matters of public interest. But that duty is lifted where the content has had human review or editorial control and a person or organisation holds editorial responsibility for the publication — and this site is published by people who hold that responsibility, with the date of a page's line-by-line human review shown in its own footer where one has taken place.

So the notice in the footer of every page here — that some content was created with the assistance of AI tools and may contain errors — is not a legal requirement being satisfied. It is the site's own reading of the principle behind Article 50: that a reader is entitled to know how what they are reading was produced. A site that argues elsewhere that [provenance and correction mechanisms](https://attentionmachine.org/en/truth/journalism/) are what make a source trustworthy would look odd withholding its own. The [How We Communicate](https://attentionmachine.org/en/about/how-we-communicate/) page sets out the rest of the method, and [Corrections & Changes](https://attentionmachine.org/en/about/corrections/) records what has been fixed.

**The contested parts — what the prohibitions reach, and what the 2026 delay changed**

**Whether Article 5 reaches attention engineering is untested.** Read at full stretch, "purposefully manipulative or deceptive techniques" that materially distort behaviour and cause significant harm could describe a great deal of what the rest of this site documents. Read as the Act's own recitals[^src-regulation-2024] direct, with the carve-out for "common and legitimate commercial practices, for example in the field of advertising", it describes far less. The Commission published guidelines on the prohibited practices[^src-european-commission-2025] on 4 February 2025 to help apply them, but guidelines are not binding: the authoritative reading belongs to the Court of Justice, and no ruling of that court on Article 5 has been reported. Two further limits matter: the prohibition only bites where the practice is implemented through an AI system, and the harm threshold is "significant", which is a higher bar than the diffuse, accumulated cost the research on engagement design describes.

**The 2026 postponement is read two ways.** The Digital Omnibus on AI[^src-regulation-2026] was presented by the Commission[^src-european-commission] as simplification — the standards and national authorities the high-risk rules depend on were not ready, and applying them on the original date would have raised costs without raising protection. Digital-rights groups have read it the other way[^src-edri-2026]: as the first weakening of a law that had not yet been tried. What can be said without choosing a side is narrow and checkable: the high-risk obligations were pushed back by more than a year, to 2 December 2027 and 2 August 2028; the Article 5 prohibitions and the Article 50 transparency duties were not moved; and two new prohibitions, on non-consensual sexual imagery and on generated child sexual abuse material, were added in the same instrument.

## Sources

[^src-regulation-2024]: [_Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)_](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), OJ L, 2024/1689, 12 July 2024 — Articles 2(5), 3, 5, 50, 99 and 113, and recitals 29, 118 and 136.

[^src-regulation-2026]: [_Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 … as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)_](https://eur-lex.europa.eu/eli/reg/2026/1744/oj), OJ L, 2026/1744, 24 July 2026 — the new Article 5 prohibitions, the Article 111(4) transitional period, and the amended Article 113 dates.

[^src-edri-2026]: EDRi, Access Now, ECNL and Amnesty International (11 June 2026), [_AI Omnibus deal: EU lawmakers should reject a rollback of AI safeguards_](https://edri.org/our-work/ai-omnibus-deal-eu-lawmakers-should-reject-a-rollback-of-ai-safeguards/) — a civil-society position: the deal, "presented as technical simplification", "delays key protections, weakens transparency and creates a dangerous precedent".

[^src-regulation-2022]: [Regulation (EU) 2022/2065 (Digital Services Act)](https://eur-lex.europa.eu/eli/reg/2022/2065/oj), Articles 34 and 38 — systemic-risk assessment of algorithmic systems, and the non-profiling recommender option.

[^src-european-commission]: [European Commission — _AI Act_](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) (Shaping Europe's digital future) — the four risk levels and the timeline of application.

[^src-european-commission-2026]: [European Commission — _Transparency obligations under Article 50 of the AI Act_](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act) — who the duties fall on, the 2 August 2026 date, the grace period to 2 December 2026, and what counts as human review or editorial control.

[^src-european-commission-2025]: European Commission (4 February 2025), [_Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689_](https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act) — non-binding guidance on Article 5.

[^src-european-commission-b]: [European Commission — the European AI Office](https://digital-strategy.ec.europa.eu/en/policies/ai-office), and [the enforcement framework of the AI Act](https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act).

[Digital Services Act →](https://attentionmachine.org/en/laws/dsa/)\
[AI & The Next Layer →](https://attentionmachine.org/en/attention-machine/ai/)\
[How We Communicate →](https://attentionmachine.org/en/about/how-we-communicate/)

---

Some content on this site was created with the assistance of AI tools and may contain errors. [How we use AI →](https://attentionmachine.org/en/about/how-we-use-ai/)