Stay informed on European AI regulation. Track official developments, understand compliance implications, and turn regulatory requirements into practical governance actions.
Official records, titles and legal texts are shown in their original English version.
EU Publications Office (Cellar) — Unavailable — showing last verified data Last attempted: 13 November 2026, 12:50 UTC · Last successful retrieval: 13 November 2026, 12:18 UTC Last error: timeout: The read operation timed out SPARQL (public, no credentials) · endpoint (opens official source in a new tab)
European Commission — Shaping Europe's digital future — Available Last attempted: 13 November 2026, 12:50 UTC · Last successful retrieval: 13 November 2026, 12:50 UTC Official RSS feed, filtered for AI Act relevance · endpoint (opens official source in a new tab)
AI Act Service Desk — Available Last attempted: 13 November 2026, 12:50 UTC · Last successful retrieval: 13 November 2026, 12:50 UTC Official RSS feed · endpoint (opens official source in a new tab)
75 official records26 binding legislation3 legislative process14 guidance0 consultations32 other developments
AI Act implementation timeline
When obligations apply
Application dates (Art. 113) and transitional deadlines (Art. 111) of Regulation (EU) 2024/1689 as amended — each checked against the Official Journal text of the act that set it, not the original 2024 schedule.
What’s next
Today12 December 202622 August 202732 December 2027
◂ Transitional period · 2 August 2026 – 2 December 2026
◂ Transitional period · 2 August 2025 – 2 August 2027
Transitional period · 2 August 2027 – 31 December 2030 ▸
● Today · 13 November 2026
Transitional period · 2 August 2026 – 2 December 2026 Legacy generative AI systems: marking AI-generated content (Art. 50(2)) (Art. 111(4))
Transitional period · 2 August 2025 – 2 August 2027 Legacy general-purpose AI models (Art. 111(3))
Transitional period · 2 August 2027 – 31 December 2030 Legacy AI systems in large-scale EU IT systems (Annex X) (Art. 111(1))
1Binding — adopted law
Additional prohibited AI practices (Art. 5)
Ensure no AI system you place on the market, put into service or use falls under the new prohibitions in Art. 5(1)(ba)–(bb) and 5(1a)–(1b).
Who is affected, exceptions and legal source
Affected
All operators: providers, deployers, importers, distributors
Provision
Article 113, third paragraph, point (a) (exception) of Regulation (EU) 2024/1689
Scope and exceptions
Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b)
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Legacy generative AI systems: marking AI-generated content (Art. 50(2))
Providers of generative AI systems already on the market before 2 August 2026 must apply Art. 50(2) marking of AI-generated content by 2 December 2026.
Who is affected, exceptions and legal source
Affected
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026
Provision
Article 111(4) of Regulation (EU) 2024/1689
Transitional period
2 August 2026 – 2 December 2026: Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026
Scope and exceptions
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Shaded = statutory transitional period (Art. 111) for systems or models already on the market.
Dashed line = time until the obligation applies — preparation time, not a legal grace period.
All statutory transitional periods
2 August 2026 – 2 December 2026 · Legacy generative AI systems: marking AI-generated content (Art. 50(2)) Qualifies: Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 (Art. 111(4))
2 August 2025 – 2 August 2027 · Legacy general-purpose AI models Qualifies: Providers of general-purpose AI models that have been placed on the market before 2 August 2025 (Art. 111(3))
2 August 2027 – 31 December 2030 · Legacy AI systems in large-scale EU IT systems (Annex X) Qualifies: AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X that have been placed on the market or put into service before 2 August 2027 (Art. 111(1))
All milestones
In force
Entry into force of the AI Act
Affected: All operators (no obligations apply until the application dates below)
Legal basis, articles and official wording
Applicable provision
Article 113, first paragraph of Regulation (EU) 2024/1689 (Art. 113(1))
Scope
Entry into force
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
Verification: verified 13 November 2026, 13:06 UTC — Entry-into-force date from EU Publications Office metadata; rule (20th day after publication) confirmed in the Official Journal text.
Applies since this date
General provisions (incl. AI literacy, Art. 4); Prohibited AI practices (Art. 5)
Affected: All operators: providers, deployers, importers, distributors
Legal basis, articles and official wording
Applicable provision
Article 113, third paragraph, point (a) of Regulation (EU) 2024/1689 (Art. 113(3)(a))
Scope
Chapters I and II
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Set by
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ, 24.7.2026)
Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;
Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
Applies since this date
Notifying authorities and notified bodies (Ch. III, Sect. 4); General-purpose AI models; Governance (AI Office, AI Board, national authorities); Penalties; Confidentiality (Art. 78)
Affected: Notifying authorities; notified bodies; Providers of general-purpose AI models; Member State authorities; AI Office; AI Board; All operators (penalties regime)
Legal basis, articles and official wording
Applicable provision
Article 113, third paragraph, point (b) of Regulation (EU) 2024/1689 (Art. 113(3)(b))
Scope
Chapter III Section 4, Chapter V, Chapter VII and Chapter XII and Article 78 (except Article 101)
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689
Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026;
Chapters I and II shall apply from 2 February 2025, with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
Affected: Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026
Legal basis, articles and official wording
Applicable provision
Article 111(4) of Regulation (EU) 2024/1689 (Art. 111(4))
Scope
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Set by
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ, 24.7.2026)
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026.’;
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, that have been placed on the market before 2 August 2026 shall take the necessary steps in order to comply with Article 50(2) by 2 December 2026
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
Upcoming
Legacy general-purpose AI models Transitional deadline
Affected: Providers of general-purpose AI models that have been placed on the market before 2 August 2025
Legal basis, articles and official wording
Applicable provision
Article 111(3) of Regulation (EU) 2024/1689 (Art. 111(3))
Scope
Providers of general-purpose AI models that have been placed on the market before 2 August 2025
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689
Providers of general-purpose AI models that have been placed on the market before 2 August 2025 shall take the necessary steps in order to comply with the obligations laid down in this Regulation by 2 August 2027. Article 112 Evaluation and review 1. The Commission shall assess the need for amendment of the list set out in Annex III and of the list of prohibited AI practices laid down in Article 5, once a year following the entry into force of this Regulation, and until the end of the period of the delegation of power laid down in Article 97. The Commission shall submit the findings of that assessment to the European Parliament and the Council. 2. By 2 August 2028 and every four years therea
Providers of general-purpose AI models that have been placed on the market before 2 August 2025 shall take the necessary steps in order to comply with the obligations laid down in this Regulation by 2 August 2027
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
Upcoming
High-risk AI system obligations — Annex III use cases
Affected: Providers and deployers of high-risk AI systems listed in Annex III; importers; distributors
Legal basis, articles and official wording
Applicable provision
Article 113, third paragraph, point (c)(i) of Regulation (EU) 2024/1689 (Art. 113(3)(c)(i))
Scope
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5) — AI systems classified as high-risk pursuant to Article 6(2) and Annex III
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Set by
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ, 24.7.2026)
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III;
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
Upcoming
High-risk AI system obligations — products under Annex I legislation
Affected: Providers of AI systems that are safety components of products under Annex I legislation; deployers; importers; distributors
Legal basis, articles and official wording
Applicable provision
Article 113, third paragraph, point (c)(ii) of Regulation (EU) 2024/1689 (Art. 113(3)(c)(ii))
Scope
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5) — AI systems classified as high-risk pursuant to Article 6(1) and Annex I
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Set by
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ, 24.7.2026)
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (i) 2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III; and (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I;
Chapter III, Sections 1, 2, and 3, with the exception of Article 6(5), shall apply from: (ii) 2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
Upcoming
Legacy high-risk AI systems used by public authorities Transitional deadline
Affected: The providers and deployers of high-risk AI systems intended to be used by public authorities
Legal basis, articles and official wording
Applicable provision
Article 111(2) of Regulation (EU) 2024/1689 (Art. 111(2))
Scope
the providers and deployers of high-risk AI systems intended to be used by public authorities
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
Set by
Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ, 24.7.2026)
In any case, the providers and deployers of high-risk AI systems intended to be used by public authorities shall take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030.’;
Without prejudice to the application of Article 5 as referred to in Article 113, third paragraph, point (a), this Regulation shall apply to operators of high-risk AI systems, other than the systems referred to in paragraph 1 of this Article, that have been placed on the market or put into service before the date of application of Chapter III referred to in Article 113, only if, as from that date, those systems are subject to significant changes in their designs. In any case, the providers and deployers of high-risk AI systems intended to be used by public authorities shall take the necessary steps to comply with the requirements and obligations laid down in this Regulation by 2 August 2030
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
Upcoming
Legacy AI systems in large-scale EU IT systems (Annex X) Transitional deadline
Affected: AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X that have been placed on the market or put into service before 2 August 2027
Legal basis, articles and official wording
Applicable provision
Article 111(1) of Regulation (EU) 2024/1689 (Art. 111(1))
Scope
AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X that have been placed on the market or put into service before 2 August 2027
Legal status
Binding — date set by Article 113 of Regulation (EU) 2024/1689
AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X that have been placed on the market or put into service before 2 August 2027 shall be brought into compliance with this Regulation by 31 December 2030. The requirements laid down in this Regulation shall be taken into account in the evaluation of each large-scale IT system established by the legal acts listed in Annex X to be undertaken as provided for in those legal acts and where those legal acts are replaced or amended. 2. Without prejudice to the application of Article 5 as referred to in Article 113(3), point (a), this Regulation shall apply to operators of high-risk AI systems,
Without prejudice to the application of Article 5 as referred to in Article 113(3), point (a), AI systems which are components of the large-scale IT systems established by the legal acts listed in Annex X that have been placed on the market or put into service before 2 August 2027 shall be brought into compliance with this Regulation by 31 December 2030. The requirements laid down in this Regulation shall be taken into account in the evaluation of each large-scale IT system established by the legal acts listed in Annex X to be undertaken as provided for in those legal acts and where those legal acts are replaced or amended
Verification: verified 13 November 2026, 13:06 UTC — Wording and date matched in the Official Journal text of the act that set this date.
12 of 12 milestones verified against the Official Journal. Latest consolidated version available from the EU Publications Office (02024R1689-20260727, consolidated to 2026-07-27). Consolidated texts are documentation tools; each date is cross-checked against the Official Journal text of the act that set it. Last checked 13 November 2026, 13:06 UTC.
Regulatory update feed
Official developments
Publications linked to the AI Act in official EU sources: legislation, amendments, implementing acts, guidance, consultations and court cases.
75 updates
GuidanceNon-binding Commission guidanceIndicative impact: medium
· European Commission · Commission notice / guidelines
Official metadata:Commission notice / guidelines dated 2026-11-12. In the official EU Publications Office metadata this document adopted on the basis of / pursuant to the AI Act.
Relevant AI Act articles
Art. 50
Topics
Transparency
Potential business impact and governance considerations: not yet analysed.
· European Parliament and Council of the EU · Implementing regulation
Official metadata:Implementing regulation dated 2026-11-10. In the official EU Publications Office metadata this document adopted on the basis of / pursuant to the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
—
Potential business impact and governance considerations: not yet analysed.
Source excerpt:The European Commission has published the reference to the first harmonised standard supporting the implementation of the AI Act in the Official Journal of the European Union. The standard, EN 18286:2026 - Artificial intelligence - Quality management system for EU AI Act regulatory purposes , developed by CEN and CENELEC, provides a clear legal pathway for providers of high-risk AI systems to comply with the quality…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI, Conformity assessment
Potential business impact and governance considerations: not yet analysed.
· Publications Office of the European Union · Consolidated text
Official metadata:Consolidated text dated 2026-07-27. In the official EU Publications Office metadata this document consolidated version of the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
—
Potential business impact and governance considerations: not yet analysed.
· European Parliament and Council of the EU · Implementing regulation
Official metadata:Implementing regulation dated 2026-07-20. In the official EU Publications Office metadata this document adopted on the basis of / pursuant to the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
—
Potential business impact and governance considerations: not yet analysed.
Official metadata:Report dated 2026-05-20. In the official EU Publications Office metadata this document adopted on the basis of / pursuant to the AI Act.
Relevant AI Act articles
Art. 112
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Point 7(b) of Annex III classifies as high-risk AI systems intended to be used by or on behalf of competent public authorities or by Union institutions, bodies, offices or agencies to assess a risk, including a security risk, a risk of irregular migration, or a health risk, posed by a natural person who intends to enter or who has entered into the territory of a Member State. (394) The most important element in…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Point 7(c) of Annex III classifies as high-risk AI systems intended to be used by or on behalf of competent public authorities or by Union institutions, bodies, offices or agencies to assist competent public authorities in the examination of applications for asylum, visa or residence permits and with associated complaints as regards the eligibility of the natural persons applying for a status, including related…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Overview of use cases and horizontal issues (435) Point (8)(b) of Annex III lists as high-risk AI systems intended to be used for (i) influencing the outcome of an election or referendum or (ii) the voting behaviour of natural persons in the exercise of their vote in elections or referenda. That provision clarifies that this use case does not include AI systems the output of which natural persons are not directly…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:These Guidelines constitute a first interpretation with practical examples of the classification of AI systems as high-risk pursuant to Article 6 AI Act. The AI Office is available to provide additional support to operators and authorities on how to understand the classification of high-risk AI systems and to collect further practical use cases on an ongoing basis with input from providers and deployers of AI…
Relevant AI Act articles
Art. 6
Topics
High-risk AI, Governance and accountability
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Point 7(a) of Annex III classifies as high-risk AI systems intended to be used in the field of migration, asylum and border control management as polygraphs or similar tools. Such AI systems are generally designed to analyse physiological, behavioural or biometric signals with the purpose of inferring deception by natural persons in migration, asylum or border-control settings. Where such systems are intended to be…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Point 7 of Annex III lists four high-risk AI systems intended to be used by or on behalf of competent public authorities, or Union institutions, bodies, offices or agencies, in the field of migration, asylum, and border-control management, in so far as such use is permitted under relevant Union or national law. In particular, that provision classifies the following use cases as high-risk: Polygraphs or similar…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:According to Article 113 AI Act, Article 6(2) and the corresponding obligations for high-risk AI systems classified under that provision will apply as from 2 August 2026, whereas Article 6(1) and the corresponding obligations for high-risk AI systems classified under that provision will apply as from 2 August 2027. These dates are now postponed with the AI Omnibus to 2 December 2027 and 2 August 2028 respectively.…
Relevant AI Act articles
Art. 6, Art. 113
Topics
High-risk AI, Regulatory deadlines
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Point 8 of Annex III AI Act identifies the administration of justice and democratic processes as one of the areas in which certain use cases of AI systems can pose significant risks to the health, safety and fundamental rights of natural persons. Recital 61 AI Act justifies the classification of such systems as high-risk due to their potentially significant impact on democracy, the rule of law and fundamental rights…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Point 7(d) of Annex III classifies as high-risk AI systems intended to be used by or on behalf of competent public authorities, or by Union institutions, bodies, offices or agencies, in the context of migration, asylum or border control management, for the purpose of detecting, recognising or identifying natural persons, with the exception of the verification of travel documents. Such systems are classified as…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Commission (AI Act Service Desk) · Service Desk explanatory page
Source excerpt:Point 8(a) of Annex III classifies as high-risk AI systems intended to be used by judicial authorities or on their behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution. Point 8(a) of Annex III therefore contains two distinct use cases: first, AI systems intended to…
Relevant AI Act articles
None stated in the source metadata
Topics
High-risk AI
Potential business impact and governance considerations: not yet analysed.
· European Parliament and Council of the EU · Proposal for a regulation
Official metadata:Proposal for a regulation dated 2025-12-16. In the official EU Publications Office metadata this document proposes to amend the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
Regulatory deadlines
Potential business impact and governance considerations: not yet analysed.
· European Parliament and Council of the EU · Proposal for a regulation
Official metadata:Proposal for a regulation dated 2025-11-19. In the official EU Publications Office metadata this document proposes to amend the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
Regulatory deadlines
Potential business impact and governance considerations: not yet analysed.
· Court of Justice of the European Union · Court of Justice case notice
Official metadata:Court of Justice case notice dated 2025-04-01. In the official EU Publications Office metadata this document asks the Court of Justice to interpret the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
Enforcement
Potential business impact and governance considerations: not yet analysed.
· European Parliament and Council of the EU · Implementing regulation
Official metadata:Implementing regulation dated 2025-03-07. In the official EU Publications Office metadata this document adopted on the basis of / pursuant to the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
Governance and accountability
Potential business impact and governance considerations: not yet analysed.
· Court of Justice of the European Union · Court of Justice case notice
Official metadata:Court of Justice case notice dated 2025-02-26. In the official EU Publications Office metadata this document asks the Court of Justice to interpret the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
Enforcement
Potential business impact and governance considerations: not yet analysed.
· Court of Justice of the European Union · Court of Justice case notice
Official metadata:Court of Justice case notice dated 2024-11-25. In the official EU Publications Office metadata this document asks the Court of Justice to interpret the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
Enforcement
Potential business impact and governance considerations: not yet analysed.
OrbletiQ AI-assisted analysis · Reviewed by OrbletiQ
Potential business impact:Organisations that provide high-risk AI systems embedded in, or delivered as, connected hardware or software products will need to manage cybersecurity compliance under two regimes. They may be able to use CRA conformity, documented in the CRA EU declaration of conformity, to demonstrate the cybersecurity element of AI Act Article 15. However, accuracy and robustness obligations under Article 15 remain separate. The conformity assessment route depends on whether the product is listed as important (Annex III) or critical (Annex IV) under the CRA and on which AI Act route would otherwise apply. Where the AI Act Annex VI internal control route would apply to an important or critical product, CRA procedures govern the cybersecurity requirements, which may involve third-party assessment. Notified bodies under the AI Act may also assess CRA Annex I requirements, subject to the CRA Article 39 condition. Beyond the AI Act interface, the CRA creates the following manufacturer obligations:
- vulnerability handling for the support period;
- early warning notifications to the CSIRT designated as coordinator and ENISA within 24 hours;
- information to impacted users;
- documentation retention for at least 10 years or the support period, whichever is longer;
- due diligence over third-party and open-source components.
The Regulation also defines obligations and scope for importers, distributors and open-source software stewards, but the detailed importer and distributor articles are not included in the excerpt provided. Member States must take CRA compliance, including manufacturers' ability to handle vulnerabilities, into consideration when procuring in-scope products (Article 5(2)). Several elements depend on later Commission implementing or delegated acts, such as technical descriptions of product categories, SBOM format and notification formats.
Practical governance considerations:
Consider updating the AI system inventory to flag high-risk AI systems that are also products with digital elements within CRA scope, and record whether each falls under CRA Annex III (important, class I or II) or Annex IV (critical).
Consider reviewing the conformity assessment pathway for each dual-scope AI product, including whether the CRA derogation for important or critical products overrides the AI Act Annex VI internal control route, and confirm whether the intended notified body holds competence under both regimes.
Consider reviewing technical documentation and the cybersecurity risk assessment for high-risk AI products so that they explicitly address AI-specific threats such as data poisoning and adversarial attacks, and so that the EU declaration of conformity demonstrates the Article 15 level of cybersecuri
Consider assessing logging, monitoring and incident escalation controls against CRA reporting timelines: early warning within 24 hours, notification within 72 hours, and final reports. Assign clear accountability for submissions via the single reporting platform and for informing users.
Consider reviewing AI third-party risk management, covering models, libraries and open-source components, to evidence due diligence, maintain an SBOM and define how vulnerabilities found in components are reported upstream.
Consider reviewing product lifecycle governance so that support periods are defined and documented, security updates remain available for the required period, and documentation retention controls are in place. Reflect these points in audit methodology and control testing.
· European Parliament and Council of the EU · Draft implementing regulation
Official metadata:Draft implementing regulation dated 2024-10-18. In the official EU Publications Office metadata this document adopted on the basis of / pursuant to the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
Governance and accountability
Potential business impact and governance considerations: not yet analysed.
· Publications Office of the European Union · Consolidated text
Official metadata:Consolidated text dated 2024-07-12. In the official EU Publications Office metadata this document consolidated version of the AI Act.
Relevant AI Act articles
None stated in the source metadata
Topics
—
Potential business impact and governance considerations: not yet analysed.
· European Parliament and Council of the EU · Regulation
Official metadata:Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), as published in the Official Journal.
Relevant AI Act articles
None stated in the source metadata
Topics
Regulatory deadlines
Potential business impact and governance considerations: OrbletiQ analysis pending review.
This monitor is regulatory intelligence, not legal advice. Official metadata, titles and dates come directly from EU sources; legal status labels follow the official document type. Only texts published in the Official Journal of the European Union are legally authentic. Interpretations marked “OrbletiQ AI-assisted analysis” are generated with AI and published only after OrbletiQ review.
