EU AI Act Summary: The Regulation Explained Chapter by Chapter

This EU AI Act summary explains Regulation (EU) 2024/1689 chapter by chapter: 13 chapters and 119 numbered articles in the text as amended by Regulation (EU) 2026/1744, in force since 27 July 2026. The act sets risk-based rules for AI systems and a separate set of rules for general-purpose AI models, from the bans of Article 5 to the fine ceilings of Article 99. Its chapters apply on different dates between 2 February 2025 and 2 August 2028, so the date of each part matters as much as its content.

The act entered into force on 1 August 2024 and has a general date of application of 2 August 2026 (Article 113), with earlier and later dates for named chapters. This summary in the independent guide to the EU AI Act maps each chapter to what it regulates, for whom and from when, citing the article behind each statement. Dates of the 2024 text appear only as history, marked "before 27 July 2026".

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

The EU AI Act in Brief: What the Regulation Does and How It Is Built

The EU AI Act is a regulation laying down harmonised rules on artificial intelligence that applies directly in every Member State, without transposition. Its short title is "Artificial Intelligence Act". It regulates AI systems by the risk of their intended use and general-purpose AI models in a chapter of their own.

The Commission proposed the act as COM(2021) 206 on 21 April 2021, the European Parliament voted on 13 March 2024 and the Council adopted it on 21 May 2024. The EU AI Act legislative history continues with Regulation (EU) 2026/1744 of 8 July 2026.

The authentic texts are OJ L, 2024/1689, 12.7.2024, and OJ L, 2026/1744, 24.7.2026. The EU AI Act full text also exists as consolidated version 02024R1689-20260727, which merges the two. That version has no legal effect.

The Numbers of the Current Text

The current text is six articles and one annex longer than the 2024 Official Journal text, with the same chapters and recitals:

Regulation (EU) 2024/1689 and consolidated version 02024R1689-20260727.

Among the AI Act articles, the inserted ones cover bias detection (4a), testing of Annex I Section B products (60a) and the enforcement powers of the AI Office (75a to 75d). Among the AI Act annexes, Annex XIV lists the codes that define the scope of a notified-body designation under Article 30.

Four Risk Levels and a Separate Track for Models

The act sorts AI systems into four risk levels, a classification the Commission uses in its guidelines: unacceptable risk (Article 5), high risk (Article 6), transparency risk (Article 50) and minimal risk. These risk categories are Commission vocabulary (guidelines C(2025) 5052, paragraph 2); the act itself regulates practices, systems and models article by article. General-purpose AI models sit outside the EU AI Act risk categories on a separate track, because Chapter V regulates the models themselves. Minimal-risk systems carry no duty specific to their level.

Chapter by Chapter: The Thirteen Parts of the Regulation

The 13 chapters of the EU AI Act run from general provisions (Chapter I) to final provisions (Chapter XIII), with the high-risk rules filling 44 articles of Chapter III:

Article 113, third paragraph, point (c), names only Sections 1 to 3 of Chapter III as postponed.

Three chapters consist of a single article each: Chapter II (Article 5), Chapter IV (Article 50) and Chapter VIII (Article 71).

Chapter I (Articles 1 to 4a): General Provisions

Chapter I sets the ground rules of the EU AI Act in five articles (1 to 4 and 4a), among them the scope (Article 2), 70 definitions (Article 3), AI literacy (Article 4) and bias-detection data processing (Article 4a). Article 2 has 13 paragraphs since paragraph 13 was added in 2026. The AI Act definitions gained the small and medium-sized enterprise (point 14a) and the small mid-cap (point 14b).

Article 4a permits the processing of special categories of personal data for bias detection and correction under six conditions and has applied since 27 July 2026. It replaces the deleted Article 10(5).

Article 4 kept the AI literacy duty in a new wording. Since 27 July 2026, providers and deployers "shall take measures to support the development of AI literacy", the current form of AI literacy under Article 4. The duty guarantees no specific level for any individual, and Article 99(4) sets no EU fine for it.

Chapter II (Article 5): The Practices Banned Outright

Chapter II consists of Article 5 alone, which bans the AI practices listed in ten lettered points of Article 5(1): (a), (b), (ba), (bb) and (c) to (h). The Commission's AI Act page (last update 19 October 2026) states that "The AI Act prohibits nine practices", counting points (ba) and (bb) as one item.

Points (a), (b) and (c) to (h) apply since 2 February 2025; points (ba) and (bb), with Article 5(1a) and (1b), apply from 2 December 2026 (Article 113, third paragraph, point (a)). Point (ba) bans AI systems that generate or manipulate realistic intimate or sexually explicit material of an identifiable natural person without that person's explicit consent, and point (bb) AI-generated child sexual abuse material.

Breaching one of the prohibited AI practices carries the highest fine: up to EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher (Article 99(3)). Regulation (EU) 2026/1744 inserted both 2026 additions to the prohibited AI practices, the only bans not yet in application. Fines for points (a), (b) and (c) to (h) are possible since 2 August 2025, national market surveillance procedures since 2 August 2026.

Chapter III (Articles 6 to 49): The High-Risk Regime in Five Sections

Chapter III regulates high-risk AI systems in 44 articles and five sections, from classification (Articles 6 and 7) to conformity assessment, certificates and registration (Articles 40 to 49):

1. Section 1 (Articles 6 and 7): classification.
2. Section 2 (Articles 8 to 15): requirements.
3. Section 3 (Articles 16 to 27): obligations of providers, deployers and other parties.
4. Section 4 (Articles 28 to 39): notifying authorities and notified bodies.
5. Section 5 (Articles 40 to 49): standards, conformity assessment, certificates, registration.

Two routes make a system high-risk: Article 6(1) for safety components of products, or products, under the 20 acts of Annex I that need third-party conformity assessment, and Article 6(2) for the 25 use cases in eight Annex III areas. Article 6(3) removes an Annex III system that poses no significant risk of harm and meets one of four alternative conditions, unless it profiles natural persons.

The Article 6(5) classification guidelines missed their deadline of 2 February 2026 and exist as a draft of 19 May 2026. The Commission announced on 19 May 2026 that the final guidelines will be adopted by the end of 2026.

Sections 1 to 3, except Article 6(5), apply from 2 December 2027 to Annex III systems and from 2 August 2028 to Annex I systems (Article 113, third paragraph, point (c)). Before 27 July 2026, the rules for high-risk AI systems were due on 2 August 2026 and 2 August 2027. EN 18286:2026 is the only harmonised standard cited (Implementing Decision (EU) 2026/2274), no notified body is listed on NANDO under the AI Act as of 24 October 2026, and AI Act conformity assessment routes sit in Article 43.

Chapter IV (Article 50): Disclosure Duties for Certain AI Systems

Chapter IV is Article 50, whose transparency obligations require providers and deployers of certain AI systems to disclose AI interaction, mark synthetic content and label deep fakes, from 2 August 2026. Paragraphs 1 and 2 bind providers, paragraphs 3 and 4 bind deployers, and a deep fake is image, audio or video content only (Article 3(60)).

Regulation (EU) 2026/1744 left Article 50(1) to (6) unchanged and replaced paragraph 7. Its only transition, Article 111(4), gives generative AI systems placed on the market before 2 August 2026 until 2 December 2026 to meet Article 50(2).

The Code of Practice on Transparency of AI-generated Content, final since 10 June 2026, is voluntary and gives no presumption of conformity. Machine-readable marking by providers and visible labelling by deployers are the core transparency obligations under Article 50. Breaches fall in the Article 99(4) fine tier.

Chapter V (Articles 51 to 56): Duties of Model Providers and the Systemic-Risk Tier

Chapter V regulates general-purpose AI models in six articles (51 to 56) and has applied since 2 August 2025. Its four sections cover classification (Articles 51 and 52), obligations of all model providers (Articles 53 and 54), systemic risk (Article 55) and codes of practice (Article 56). Article 53(1), points (a) to (d), requires technical documentation, information for downstream providers, a copyright policy and a training-content summary.

A model is presumed to have systemic risk when its cumulative training compute is greater than 10^25 floating-point operations (Article 51(2)), and its provider notifies the Commission within two weeks (Article 52(1)). Models placed on the market before 2 August 2025 comply by 2 August 2027 (Article 111(3)).

The General-Purpose AI Code of Practice, published on 10 July 2025 and assessed adequate by Commission Opinion C(2025) 5361, is voluntary and gives no presumption of conformity. The Commission alone supervises providers of general-purpose AI models through the AI Office (Article 88(1)), with Article 101 fines since 2 August 2026. Its list of 7 October 2026 shows 22 full signatories of the Code and one for the Safety and Security chapter only.

Chapter VI (Articles 57 to 63): Measures in Support of Innovation

Chapter VI supports innovation through AI regulatory sandboxes, testing in real-world conditions and measures for SMEs and start-ups (Articles 57 to 63, with Article 60a inserted in 2026). Each Member State must have at least one national AI regulatory sandbox operational by 2 August 2027 (Article 57(1) as replaced), and the AI Office may establish a Union-level sandbox (Article 57(3a)). Participants that follow the sandbox plan in good faith face no administrative fines, though liability for damage to third parties remains (Article 57(12)).

Testing in real-world conditions covers Annex III and Annex I Section A systems (Article 60), and Article 60a allows optional national frameworks for Annex I Section B products; a test lasts at most six months, extendable once. The AI Act for SMEs means free sandbox access for SMEs, including start-ups (Article 58(2)(d)), and a simplified quality management system under Article 63(1). Chapter VI has applied since 2 August 2026.

Chapter VII (Articles 64 to 70): Governance at Union and National Level

Chapter VII creates the governance of the EU AI Act in two sections: Union bodies in Articles 64 to 69 and national competent authorities in Article 70. The AI Office is a Commission function (Article 3(47)), established by Decision C(2024) 390 of 24 January 2024, not an EU agency.

The AI Board gathers one representative per Member State under a Member State chair, with the AI Office attending without a vote (Article 65). A scientific panel of independent experts (Article 68), with 60 members, the cap set by Implementing Regulation (EU) 2025/454, and an advisory forum (Article 67) with 174 members support the Board and the Commission.

Under Article 70, Member States shall designate at least one notifying authority and at least one market surveillance authority, and one market surveillance authority as single point of contact, by 2 August 2025. Which bodies act as AI Act national competent authorities follows from national implementing laws. Chapter VII applies since 2 August 2025 (Article 113, third paragraph, point (b)).

Chapter VIII (Article 71): The EU Database

Chapter VIII consists of Article 71, which sets up the EU database for the high-risk AI systems listed in Annex III, controlled by the Commission and public except the section under Article 49(4) and data on Article 60 testing. EU database registration under Article 49 feeds it with the data items of Annex VIII. Article 113 names no separate date for Chapter VIII.

Chapter IX (Articles 72 to 94): Monitoring, Incidents, Enforcement and Remedies

Chapter IX is the enforcement part of the EU AI Act: 23 numbered articles (72 to 94) plus Articles 75a to 75d inserted in 2026, grouped in five sections:

1. Section 1 (Article 72): post-market monitoring.
2. Section 2 (Article 73): serious incidents.
3. Section 3 (Articles 74 to 84, 75a to 75d): enforcement.
4. Section 4 (Articles 85 to 87): remedies.
5. Section 5 (Articles 88 to 94): supervision of model providers.

Providers run post-market monitoring under Article 72, with Commission guidance and a template due by 2 September 2027 (Article 72(3)). Article 73 sets serious-incident deadlines of 15 days, 2 days or 10 days, unchanged in 2026.

Market surveillance follows Regulation (EU) 2019/1020 (Article 74(1)). Under Article 75(1) as replaced, the AI Office is exclusively competent for AI systems based on a general-purpose AI model where model and system come from the same provider or from providers in the same undertaking, with four exclusions in point (a): Annex I products, Annex III point 2, the law-enforcement, border and financial-institution systems referred to there, and Annex III point 8 systems used in the administration of justice. Point (b) adds AI systems that constitute or are integrated into very large online platforms or search engines designated under the Digital Services Act.

The rights of affected persons form Section 4: any natural or legal person can complain to a market surveillance authority (Article 85), Article 86 gives a right to an explanation from the deployer for decisions based on Annex III high-risk systems, except point 2, with legal effects or a similarly significant adverse impact on the person's health, safety or fundamental rights, and Article 87 applies Directive (EU) 2019/1937 to whistleblowers.

Chapter X (Articles 95 and 96): Codes of Conduct and Guidelines

Chapter X holds two articles: voluntary codes of conduct for AI systems that are not high-risk (Article 95) and the Commission's mandate to issue guidelines (Article 96). Codes of conduct give no presumption of conformity, and no Article 95 code is listed on Commission pages as of 23 October 2026.

Article 96(1) names seven subjects, points (a) to (g); point (g), added in 2026, is due by 1 August 2027. All EU AI Act guidelines are non-binding.

The Commission has adopted guidelines on prohibited practices (C(2025) 5052), the AI system definition (C(2025) 5053) and general-purpose AI models (C(2025) 7719). The register of EU AI Act guidelines also holds the Article 50 guidelines, whose content was approved and published on 20 July 2026. The Article 73 guidance exists only as a draft of 26 September 2025.

Chapter XI (Articles 97 and 98): Delegation of Power and Committee Procedure

Chapter XI governs how the Commission supplements the act: delegated acts under Article 97 and implementing acts through the committee procedure of Article 98. The delegation runs for five years from 1 August 2024 (from 27 July 2026 for Articles 2(13) and 30(2)), with tacit extension and a three-month objection period, extendable by three months. No delegated act had been adopted as of 24 October 2026; the implementing acts are Implementing Regulations (EU) 2025/454 and (EU) 2026/1755 and Implementing Decision (EU) 2026/2274.

Chapter XII (Articles 99 to 101): Penalties and Fine Ceilings

Chapter XII sets three fine ceilings for operators in Article 99, separate ceilings for Union institutions in Article 100 and fines for providers of general-purpose AI models in Article 101. Article 99 sets the maximum fines that national penalty rules must provide for (Article 99(1)), while the Commission fines model providers under Article 101 and the AI Office fines AI systems under its exclusive competence (Article 75c(4)):

Fines on SMEs, including start-ups, are capped at the lower of the two amounts in all three Article 99 tiers (Article 99(6)), fines on small mid-caps only in the Article 99(4) and (5) tiers (Article 99(6a), inserted in 2026). For a small mid-cap, the Article 99(3) maximum therefore stays EUR 35 million or 7 %, whichever is higher.

Article 99(4) does not list Article 4 or Article 27, so the act sets no EU fine amount for AI literacy or the fundamental rights impact assessment. The EU AI Act penalties of Chapter XII apply since 2 August 2025, with Article 101 since 2 August 2026. No fine decision has been published by the Commission as of 24 October 2026.

Chapter XIII (Articles 102 to 113): Final Provisions

Chapter XIII amends nine sectoral acts (Articles 102 to 110), sets transitional rules (Article 111), schedules reviews (Article 112) and fixes every date of application (Article 113). The nine acts are the six regulations and three directives named in the title, and the amendments apply from 27 July 2026 (Article 113, third paragraph, point (d)).

Article 111 governs AI systems already on the market. Annex X large-scale IT components placed on the market before 2 August 2027 comply by 31 December 2030, high-risk systems placed before "the date of application of Chapter III referred to in Article 113" fall under the act only after significant design changes, and those intended for use by public authorities comply by 2 August 2030.

Article 112 requires a yearly Commission assessment of Article 5 and Annex III; the Commission report COM(2026) 234 of 20 May 2026 covers both. Evaluation reports follow by 2 August 2028 and 2 August 2029.

When Each Chapter Applies: The Article 113 Timeline in One Table

The EU AI Act applies in steps between 2 February 2025 and 2 August 2028, set by Article 113 as replaced by Regulation (EU) 2026/1744. The EU AI Act timeline adds the transitional deadlines of Article 111 to these eight steps:

Before 27 July 2026, the high-risk dates were 2 August 2026 (Annex III) and 2 August 2027 (Annex I).

The high-risk dates moved by 16 months for Annex III and 12 months for Annex I because standards, common specifications, guidance and national competent authorities were not ready (recital 40 of Regulation (EU) 2026/1744). The proposed "stop-the-clock" mechanism was not adopted, and the final text sets fixed dates.

Which Parts of the EU AI Act Apply to You: A Four-Question Route

Four questions show which chapters of the EU AI Act concern an organisation: its role, whether the system is in scope, which risk route applies and whether it provides a general-purpose AI model. The route gives an orientation, not a legal assessment:

1. Role: which of the six operators of Article 3(8) is the organisation?
2. Scope: does the AI system fall within Article 2?
3. Risk route: Article 5 ban, Annex III use case, Annex I product or only Article 50?
4. Model: does it provide a general-purpose AI model (Chapter V)?

Scope comes first because Article 2(1) reaches providers placing AI systems on the Union market wherever established, and third-country providers and deployers whose output is used in the Union. The criteria for who the EU AI Act applies to decide whether the other questions arise. A system outside Article 2 meets none of the chapters.

Illustration (our reading): a bank that deploys a credit-scoring system can fall under Annex III, point 5(b), and then meets Article 26 and the fundamental rights impact assessment of Article 27.

Duties by Role and Chapter: Providers, Deployers and Model Providers

Providers carry most duties of the EU AI Act, deployers the use-side duties, and providers of general-purpose AI models a separate set in Chapter V. Each of the six operators of Article 3(8) takes its duties from a different mix of chapters:

A role can change during the life of a system. The line between provider vs deployer moves under Article 25(1): a distributor, importer, deployer or other third party becomes the provider when it puts its name or trademark on a high-risk AI system, makes a substantial modification, or changes the intended purpose so that the system becomes high-risk. Breaches of Article 25(2) and (4) fall in the Article 99(4) tier since 27 July 2026.

From Summary to Compliance Programme: Turning the Chapters into Tasks

A compliance programme turns the chapters into tasks in five moves: inventory, scope check, role assignment, risk classification and a dated plan per chapter.

The inventory lists every AI system in development or use with its intended purpose, because classification under Article 6(2) follows the intended purpose the provider sets.

The dated plan starts with the duties that already apply. A programme for EU AI Act compliance begins with the Article 4 measures and the Article 50 disclosure duties, then adds the high-risk work.

High-risk work takes the longest: classification, the Article 17 quality management system and the technical documentation all need to exist before the Chapter III dates.

A checklist assigns each task an owner and evidence, such as the deployer logs kept for at least six months under Article 26(6).

Duties differ by role and risk class. The EU AI Act checklist sorts every obligation by role, with its article and deadline.

EU AI Act Summary: Related Questions

The related questions turn on Article 2(1) for territorial reach, Regulation (EU) 2026/1744 for the 2026 changes, Article 2(7) for data protection and Article 288 TFEU for the legal form of the act.

Does the EU AI Act Apply to Companies Outside the EU?

Yes: the act reaches providers outside the EU that place AI systems on the EU market or put them into service there, and providers and deployers whose output is used in the Union (Article 2(1)).

The rules of the EU AI Act for non-EU companies sit in the same chapters as for EU companies. Non-EU providers of high-risk AI systems and of general-purpose AI models appoint an authorised representative in the Union (Articles 22 and 54).

What Changed in the EU AI Act in 2026?

Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the high-risk dates, added two bans, replaced Article 4 and inserted six articles and Annex XIV.

The Digital Omnibus on AI started as proposal COM(2025) 836 of 19 November 2025. The data and cyber omnibus COM(2025) 837 is a different proposal, pending ("Awaiting committee decision", 24 October 2026), and does not amend the AI Act.

How Does the AI Act Relate to the GDPR?

Union data protection law keeps applying alongside the AI Act, and Article 2(7) has contained the words "Without prejudice to Articles 4a and 59" since 27 July 2026.

The AI Act vs GDPR overlap includes bias detection under Article 4a. A fundamental rights impact assessment can cross-reference the data protection impact assessment (Article 27(4)).

Is the AI Act a Regulation or a Directive?

A regulation: it applies directly in all Member States; national laws only implement or supplement it.

Member States still designate authorities under Article 70 and lay down penalty rules under Article 99(1), so the national competent authorities differ from country to country.

Frequently Asked Questions about the EU AI Act Summary

What are the main points of the EU AI Act?

Risk-based rules: ten banned practices in Article 5 (points (a), (b) and (c) to (h) since 2 February 2025, points (ba) and (bb) from 2 December 2026), transparency duties under Article 50 since 2 August 2026, general-purpose AI model duties since 2 August 2025, and high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

How long is the AI Act?

The consolidated text of 27 July 2026 has 119 numbered articles, 14 annexes and 180 recitals in 13 chapters, against 113 articles and 13 annexes in the 2024 Official Journal text.

Which chapters of the AI Act apply already?

As of 24 October 2026, Chapters I and II apply, with Article 5 points (a), (b) and (c) to (h), while points (ba) and (bb) apply from 2 December 2026. Section 4 of Chapter III and Chapters IV to XIII apply; Sections 1 to 3 of Chapter III are postponed.

Did the 2026 amendment rewrite the whole act?

No. Regulation (EU) 2026/1744 amended 36 articles, inserted 6 and added Annex XIV, and the 13 chapters remain in the order of 2024.

Does a summary replace the legal text?

No. The consolidated text has no legal effect, only the Official Journal texts are authentic, and this summary gives an orientation, not a legal assessment of any individual case.