Key changes to the EU AI rules (adopted 26 March 2026)

• The rules are made simpler, clearer and more uniform so that companies can apply them more easily.
• The Commission, the AI Office and national authorities must coordinate to avoid overlapping supervision, enforcement or monitoring.
• SMEs and small‑mid‑cap enterprises (SMCs) – 99.8 % of EU firms are SMEs – get proportional rules and targeted help.
• AI literacy: providers and deployers must support staff learning about AI, but the Commission will give guidance rather than a hard requirement.
• Prohibition of “nudification”: AI that creates sexual images or videos of a person without their consent is banned, unless the provider has strong safety measures in place.
• Bias detection: providers of any AI system may process special‑category personal data (e.g., race, gender) only for bias detection and correction, with strict safeguards.
• Conformity assessment: a single application and assessment procedure is introduced for notified bodies, and the rules are aligned with other EU product safety laws.
• Transitional periods:
• 3 months for marking obligations for generative AI that was on the market before 2 August 2026.
  ‑ 6 months for high‑risk AI systems (Article 6(2) and Annex III).
  ‑ 12 months for other high‑risk AI systems (Article 6(1) and Annex I).
  ‑ The full rules for high‑risk AI will take effect no later than 2 December 2027 (for Annex III) and 2 August 2028 (for Annex I).
• Registration: the EU database entry for AI systems that are not high‑risk is simplified.
• AI sandboxes: the AI Office will run EU‑level sandboxes, giving priority to SMEs and startups, and will work with national authorities and data‑protection bodies.
• Fees and expertise: the scientific panel’s fees are simplified and the Commission can consult experts directly.
• Governance of general‑purpose AI models: the AI Office will supervise these models (except those linked to specific product safety laws) and can impose penalties.
• Other technical adjustments: alignment with cybersecurity rules, clearer definitions of safety functions, and streamlined cooperation between national and EU authorities.

Broader Context

The EU AI Act is the world's first comprehensive law regulating artificial intelligence. It was originally passed in 2024 and is being rolled out in stages. The document you just read describes amendments adopted in March 2026 that fine-tune the original law — mostly to make it easier to follow and enforce.

The Act sorts AI systems by risk level. Higher-risk AI (like systems used in hiring, credit scoring, or medical diagnosis) faces stricter rules. Lower-risk AI (like a chatbot on a shopping website) faces lighter requirements. General-purpose AI models — like the large language models behind popular AI assistants — have their own separate rules and are supervised directly by the EU's AI Office.

The law applies to any company selling or deploying AI in the EU, even if that company is based outside Europe.

Impact on EU Citizens

Your images are better protected. The explicit ban on AI "nudification" — generating fake sexual images of a person without their consent — is now written into law. This targets a growing form of image-based abuse, particularly affecting women and minors.

AI used to make decisions about you must meet safety standards. If an AI system helps decide whether you get a loan, a job interview, or a place at university, it falls into the high-risk category and must go through checks before it can be used on you.

You have a right to AI literacy at work. If your employer uses AI tools, they are required to help you understand how to work with them.

Bias in AI can be studied using sensitive data — with strict limits. Companies can use data about race or gender, but only to find and fix bias in their systems, not for any other purpose.

Sandboxes let startups test AI safely. New AI tools can be tested in controlled environments before release, which means fewer untested products reaching the public.