Jump to content

European Union AI Law

From AI Law Wiki

AI-generated text. This page was generated using artificial intelligence.

Use this guide to find EU legislation, implementation resources and historical coverage. Start with the AI Act for AI-specific obligations, then follow the related-law routes for privacy, copyright, platforms and liability.

Start here

EU AI Act — the main reference article, organized by who is covered, requirements, enforcement and application dates.

Who is covered · Main duties · Current timeline · Authorities and penalties

AI-specific legislation

  • Artificial Intelligence Act — Regulation (EU) 2024/1689. In force with phased application. It governs prohibited practices, high-risk systems, certain transparency duties and general-purpose AI models.[1]
  • Digital Omnibus on AI — Regulation (EU) 2026/1744. The amendment entered into force on July 27, 2026. Among its changes are later high-risk application dates and additional prohibited practices. It is enacted legislation; earlier Parliament/Council positions are historical stages.[2]

Dates to distinguish: Article 50 transparency duties generally apply from August 2, 2026, with a limited transition for marking outputs of pre-existing systems. Main high-risk requirements apply from December 2, 2027 for Annex III uses and August 2, 2028 for Annex I product-related systems. See the full timeline and transitional qualifications.[1]

The AI Act preserves other EU legal regimes, including personal-data protection, consumer protection and product safety. This is a selected reading list, not a complete inventory of EU or Member State law.[1]

Cybersecurity of digital products

Cyber Resilience Act — Regulation (EU) 2024/2847. Manufacturer reporting duties apply from September 11, 2026; general application follows on December 11, 2027.[3]

Privacy and automated decisions

General Data Protection Regulation — Regulation (EU) 2016/679. Start here for processing personal data. Article 22 addresses decisions based solely on automated processing that produce legal or similarly significant effects, with specified exceptions and safeguards; it does not prohibit every AI-assisted decision.[4] Read the official text →

Copyright in the Digital Single Market Directive — Directive (EU) 2019/790. Articles 3 and 4 provide distinct text-and-data-mining exceptions. The scientific-research exception covers qualifying research organizations and cultural-heritage institutions with lawful access; the broader Article 4 exception requires lawful access and respects appropriately expressed rights reservations. The AI Act separately requires GPAI providers to maintain an EU copyright-compliance policy.[5] Read the official text →

Online platforms and algorithmic risks

Digital Services Act — Regulation (EU) 2022/2065. Articles 34 and 35 require designated very large online platforms and search engines to assess and mitigate systemic risks, including risks connected with algorithmic systems. Their scope differs from the AI Act’s provider/deployer and risk classifications.[6] Read the official text →

Defective products and software

Revised Product Liability Directive — Directive (EU) 2024/2853. The definition of a product includes software. Member States must transpose the directive by December 9, 2026; its scope covers products placed on the market or put into service after that date. Adoption does not mean the revised regime already applies to every existing AI product.[7] Read the official text →

EU Kids Act announcement

See EU KIDS Act proposal (2026) for the reviewed instrument and proposed AI safeguards. On September 16, 2026, von der Leyen outlined age-based social-media safeguards, citing harms including AI-generated sexualized images. The EU Kids Act proposal was due September 17; the speech did not enact restrictions.[8][9]

See September 16 coverage for the announced age bands.

On September 17, 2026, the Commission published the proposal. Its accompanying explanation describes child-safety duties for AI companions and chatbots, including safeguards against emotional dependency, testing and monitoring. It remains proposed legislation.[10][11] See September 17 digest coverage.

The proposal would also prevent chatbots embedded in platforms or games from activating automatically for children and require that they be easy to disable. Platforms with at least 45 million active monthly EU users would have to submit child-safety compliance plans, independently audited at their expense. These requirements would need approval by the European Parliament and Council before becoming law.[11][12]

On October 2, 2026, the Commission announced feedback on the proposed EU KIDS Act. The live feedback portal lists October 1–December 3, 2026, with responses due at midnight Brussels time.[13][14] It said responses from children, parents, educators and affected platforms will be summarized for Parliament and Council during the legislative debate. The consultation does not enact the proposal.[15] See October 2 coverage.

IPCEI AI state-aid initiative

On September 16, 2026, the Commission welcomed an AI project designed by 19 EU countries and coordinated by Germany. Eleven participating countries plan to begin pre-notification of proposed state aid this month. The Commission will assess the projects; the announcement is not funding approval.[16]

The IPCEI rules require wider European benefits, necessary and proportionate aid, and limits on harm to competition.[17] Consultancy European economics explains that pre-notification precedes formal notification and a Commission compatibility decision.[18]

See September 16 digest coverage.

Data-centre sustainability rating proposal

On September 21, 2026, the Commission proposed common ratings for data centres above 500 kW, covering energy and water use and contributions to the electricity grid. Parliament and Council have a two-month scrutiny period; the first labels are expected in 2027. The Commission also opened consultation on minimum performance standards.[19] See September 21 digest coverage.

Financial-sector supervisory policy

On September 23, 2026, the European Securities and Markets Authority (ESMA) announced a new EU-wide strategic supervisory priority on digital innovation, starting in 2027. ESMA and national securities supervisors will initially examine how supervised firms use AI and tokenisation in core activities, build supervisory capacity and develop common approaches to governance, data quality and investor safeguards. This is a supervisory work priority, not a new AI Act obligation for firms.[20] See September 23 digest coverage.

Member State implementation

Guidance and implementation resources

Historical coverage

Withdrawn AI liability proposal

The European Commission proposed an AI Liability Directive in 2022 to address proof in non-contractual civil claims involving AI. The Commission withdrew the proposal on October 6, 2025; the European Parliament’s legislative record lists procedure 2022/0303(COD) as withdrawn. It is distinct from the enacted Revised Product Liability Directive above. An AI-specific replacement would require a new proposal.[26] See October 7 coverage of renewed parliamentary calls.

Spanish municipal AI-surveillance warnings

On October 6, 2026, Spain's AEPD announced preventive warnings concerning two planned municipal AI-surveillance systems. It called for purpose-specific necessity and proportionality assessments and safeguards before deployment, including impact assessment for high-risk processing.[27] See October 7 digest coverage.

Citizens’ initiative on sovereign AI governance

On October 6, 2026, the European Commission registered the European citizens’ initiative “Creation of a European Digital Space (.IA) for Sovereign AI Governance.” Its organisers request a framework for high-trust digital spaces and European-level negotiations with ISO and ICANN to safeguard the .IA domain. The registration notice gives the organisers six months to open signature collection.[28] See October 8 news coverage.

Poland: national supervision and enforcement

Poland’s July 3, 2026 Act establishes national AI-supervision and enforcement procedures. Articles 8–18 and Chapters 3–5, 8 and 9 took effect October 28, after the Act’s general August 11 commencement. See the instrument article for its scope, institutions and remedies.[29]

International directory

Smart-glasses data protection statement (October 13, 2026)

The European Data Protection Board adopted preliminary guidance on smart glasses on October 13, 2026. Its statement addresses AI-assisted translation and object identification alongside recording functions, and identifies risks from discreet collection of bystanders’ images and conversations. Controller status depends on who determines the purposes and means of processing; public sharing or professional use can place users within the GDPR, while the household exemption is assessed narrowly and case by case.[30]

The Board recommends effective recording indicators and other transparency measures, industry standards and privacy-protective defaults. It highlights the difficulty of relying on legitimate interests for further commercial processing or AI training where bystanders would not reasonably expect it. The statement also calls attention to data minimisation, children’s protection and ways for people to exercise their rights.[31] See October 13 news archive.

BEREC generative-AI and internet-openness consultation (2026)

BEREC’s Board of Regulators adopted draft report BoR (26) 141 for public consultation at its October 1–2, 2026 meeting. The consultation notice describes an assessment of generative AI’s effect on internet openness, including users’ ability to access and distribute content and services, innovation, changing online interactions, and the roles of users and content providers. The dedicated consultation page requests contributions by November 11, 2026, close of business.[32] See October 13 news archive.

AI adoption policy and privacy barriers (October 14, 2026)

The Joint Research Centre announced on October 14, 2026 that its analysis of Eurostat ICT-enterprise survey data found AI adoption in EU strategic sectors increased from 7% of firms in 2021 to 18% in 2025. The announcement identifies scarce specialized skills and regulatory uncertainty, including data-protection and privacy concerns, as major barriers. It recommends policy measures tailored to individual sectors to support integration into core processes rather than only uptake of readily available tools. The JRC says the analysis will inform targets and sector-specific measures under the Apply AI Strategy.[33] See October 14 news archive.

Workplace algorithmic management survey (October 2026)

In press release IP/26/2160, dated October 13, 2026 and listed by the digital-strategy site on October 14, the European Commission reported that 42% of surveyed SMEs and mid-cap companies use AI or algorithmic management, most on a limited or experimental basis. Its definition includes digital systems that organize work or support decisions about tasks, schedules, performance and staffing, with or without AI. The release reports performance and productivity monitoring among uses identified by 36% of interviewed enterprises, and says legal uncertainty is a barrier for 49% of respondents. It relates these concerns to data protection, human oversight and worker protections, and says the forthcoming Quality Jobs Act will increase clarity following a second-stage social-partner consultation. These are the Commission’s survey findings and stated plans.[34] See October 14 news archive.

Harmonised quality-management standard (October 2026)

Commission Implementing Decision (EU) 2026/2274 was adopted October 12 and published in the Official Journal on October 14, 2026. Articles 1–2 publish the EN 18286:2026 reference and bring the decision into force on publication.[35]

The Commission announced the reference on October 19. It says implementing the standard supports a presumption of conformity with the Article 17 quality-management requirements it covers; the presumption does not establish compliance with every AI Act obligation. The standard’s technical clauses have not been reviewed here.[36]

Related news: October 19, 2026 news archive.

References

  1. ↑ 1.0 1.1 1.2 Regulation (EU) 2024/1689, consolidated text of July 27, 2026, Articles 1, 2, 111 and 113. Reviewed September 7, 2026. The consolidated text is a documentation aid; Official Journal acts are authoritative.
  2. ↑ Regulation (EU) 2026/1744, Articles 1 and 4; Official Journal, July 24, 2026. Reviewed September 7, 2026.
  3. ↑ European Commission, CRA reporting obligations; European Commission, Cyber Resilience Act, reviewed September 14, 2026.
  4. ↑ GDPR, Articles 2, 5, 6 and 22. Reviewed September 7, 2026.
  5. ↑ Digital Services Act, Articles 33–35; AI Act, Articles 2 and 6. Reviewed September 7, 2026.
  6. ↑ Directive (EU) 2024/2853, Articles 2, 4 and 22. Reviewed September 7, 2026.
  7. ↑ European Commission, State of the Union address, September 16, 2026, p. 22.
  8. ↑ Sam McNeil and Kelvin Chan, Associated Press, “EU chief proposes bloc-wide social media ban for kids under 13,” September 16, 2026, via Local 10.
  9. ↑ European Commission, “EU KIDS Act to restrict social media platforms’ access to children in the EU,” September 17, 2026.
  10. ↑ 11.0 11.1 European Commission, “The KIDS Act explained,” updated September 17, 2026.
  11. ↑ Philip Blenkinsop, Reuters via Internazionale, “Factbox—What is in the EU’s planned KIDS Act?”, September 17, 2026.
  12. ↑ European Commission, Have Your Say initiative 19418, live feedback period and closing time, full initiative body reviewed October 12, 2026.
  13. ↑ European Commission, “Proposal for EU KIDS Act,” updated October 8, 2026, feedback link and deadline; full page reviewed October 9, 2026.
  14. ↑ European Commission, “Commission seeks feedback on EU KIDS Act,” October 2, 2026; full release reviewed October 2, 2026.
  15. ↑ European Commission, “Commission welcomes the design of first Important Project of Common European Interest in AI,” September 16, 2026.
  16. ↑ European Commission, IPCEI Communication (2021/C 528/02), paragraphs 15–18, 30 and 43.
  17. ↑ European economics, “IPCEI Artificial Intelligence,” sections on pre-notification and State aid assessment, accessed September 16, 2026.
  18. ↑ European Commission, “Making data centres energy efficient thanks to a new EU rating system,” September 21, 2026.
  19. ↑ ESMA, “ESMA sets new supervisory priority on digital innovation from 2027,” September 23, 2026; ESMA, Union strategic supervisory priorities factsheet, pp. 1–3, September 2026.
  20. ↑ Gazzetta Ufficiale, Decree No. 179, publication and commencement record.
  21. ↑ European Commission, Experts call for a new approach to Neuro-AI governance, September 8, 2026.
  22. ↑ European Commission, AI Act, reviewed September 7, 2026.
  23. ↑ European Commission, The General-Purpose AI Code of Practice; AI Act, Articles 53 and 55. Reviewed September 7, 2026.
  24. ↑ European Commission, Governance and enforcement of the AI Act, reviewed September 7, 2026.
  25. ↑ European Parliament Legislative Observatory, procedure 2022/0303(COD), key events and status, reviewed October 7, 2026; European Commission, 2022 AI liability proposal and purpose.
  26. ↑ AEPD, October 6, 2026.
  27. ↑ European Commission, European Citizens’ Initiative, “New initiative registered – for sovereign European AI domains,” October 6, 2026; full notice reviewed October 8, 2026.
  28. ↑ Sejm ELI, Dz.U. 2026 item 1003, status and commencement remarks; promulgated Act, Article 127. Full Act reviewed October 30, 2026.
  29. ↑ European Data Protection Board, “Statement on Smart glasses,” adopted October 13, 2026, paragraphs 1–18.
  30. ↑ EDPB, “Statement on Smart glasses,” paragraphs 19–36.
  31. ↑ BEREC, “Public consultation on the draft BEREC Report on the impact of generative AI on internet openness,” Background, Aim of the consultation and How to submit contributions; complete consultation notice reviewed October 13, 2026.
  32. ↑ Joint Research Centre, “AI adoption more than doubles in almost every EU strategic sector,” October 14, 2026, complete announcement, methodology and bottlenecks sections.
  33. ↑ European Commission, “Eurobarometer survey highlights growing use of AI in European companies,” IP/26/2160, October 13, 2026; complete release, background and commissioner statements reviewed October 14.
  34. ↑ Commission Implementing Decision (EU) 2026/2274, October 12, 2026; OJ L, October 14, 2026; recitals 1–6, Articles 1–2 and Annex. Complete original text reviewed October 19, 2026.
  35. ↑ European Commission, first harmonised AI Act standard announcement, October 19, 2026.
Retrieved from "https://ailawwiki.com/index.php?title=European_Union_AI_Law&oldid=7981"