New Rules to Regulate Artificial Intelligence in Europe

Key changes to the EU AI rules (adopted 26 March 2026)

• The rules are made simpler, clearer and more uniform so that companies can apply them more easily.
• The Commission, the AI Office and national authorities must coordinate to avoid overlapping supervision, enforcement or monitoring.
• SMEs and small‑mid‑cap enterprises (SMCs) – 99.8 % of EU firms are SMEs – get proportional rules and targeted help.
• AI literacy: providers and deployers must support staff learning about AI, but the Commission will give guidance rather than a hard requirement.
• Prohibition of “nudification”: AI that creates sexual images or videos of a person without their consent is banned, unless the provider has strong safety measures in place.
• Bias detection: providers of any AI system may process special‑category personal data (e.g., race, gender) only for bias detection and correction, with strict safeguards.
• Conformity assessment: a single application and assessment procedure is introduced for notified bodies, and the rules are aligned with other EU product safety laws.
• Transitional periods:
• 3 months for marking obligations for generative AI that was on the market before 2 August 2026.
  ‑ 6 months for high‑risk AI systems (Article 6(2) and Annex III).
  ‑ 12 months for other high‑risk AI systems (Article 6(1) and Annex I).
  ‑ The full rules for high‑risk AI will take effect no later than 2 December 2027 (for Annex III) and 2 August 2028 (for Annex I).
• Registration: the EU database entry for AI systems that are not high‑risk is simplified.
• AI sandboxes: the AI Office will run EU‑level sandboxes, giving priority to SMEs and startups, and will work with national authorities and data‑protection bodies.
• Fees and expertise: the scientific panel’s fees are simplified and the Commission can consult experts directly.
• Governance of general‑purpose AI models: the AI Office will supervise these models (except those linked to specific product safety laws) and can impose penalties.
• Other technical adjustments: alignment with cybersecurity rules, clearer definitions of safety functions, and streamlined cooperation between national and EU authorities.

Broader Context

The EU AI Act is the world’s first comprehensive law regulating artificial intelligence. It was created to ensure that AI is developed and used in a way that is safe, respects people’s rights, and supports innovation. The law is a response to the rapid growth of AI technologies, which can bring big benefits—like better healthcare, safer transport, and more efficient services—but also risks, such as privacy violations, discrimination, and misuse.

The rules are designed to be flexible enough to keep up with fast-moving technology, while also protecting people from harm. The EU wants to set a global standard, encouraging other countries to adopt similar rules. By making the rules clearer and easier to follow, the EU hopes to help businesses, especially smaller ones, use AI responsibly without being overwhelmed by red tape.

Impact on EU Citizens

For people living in the EU, these rules mean more protection and transparency when using AI-powered services. For example:

• Privacy and Safety: The ban on “nudification” AI (creating fake sexual images without consent) helps protect against abuse and harassment online.
• Fairness: Rules on bias detection mean AI systems should be less likely to discriminate based on race, gender, or other personal characteristics.
• Better Information: Companies must help their staff understand AI, which can lead to better customer service and more trustworthy products.
• Support for Small Businesses: Easier rules for small companies mean more local innovation and competition, which can lead to more choices and better prices for consumers.
• Transparency: If you interact with an AI system (like a chatbot or recommendation tool), you should have clearer information about how it works and what data it uses.

The law also encourages the creation of “AI sandboxes”—safe spaces where new AI ideas can be tested before being released to the public, which can lead to more reliable and useful technologies in the future.

What’s Next?

The rules will be rolled out gradually over the next few years, giving companies time to adapt. The EU will continue to update the law as technology evolves, ensuring it stays relevant and effective.