The future of AI regulation in Europe

Europe’s AI Act is in force, but how it works in practice will be settled by harmonized standards, codes of practice, supervisory authorities, court rulings and revision, and a 2026 amendment has already moved the high-risk rules to 2027 and 2028.

A staggered start

The Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and applies in stages. Bans on practices such as social scoring and emotion recognition in workplaces and schools have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. Most high-risk obligations were originally due on 2 August 2026, later for AI in regulated products.

The dates have since moved. In November 2025 the European Commission proposed amendments, the digital omnibus; the Parliament and the Council adopted them in mid-2026 as Regulation (EU) 2026/1744, in force since 27 July 2026. Obligations for the listed high-risk uses now apply from 2 December 2027, and for AI in regulated products from 2 August 2028. The amendment also added two prohibitions, on AI that generates non-consensual intimate material or child sexual abuse material, which apply from 2 December 2026. The structure itself is unchanged.

The high-risk list covers uses such as employment, education, essential services, law enforcement and migration. Providers must establish risk management, data governance, documentation and human oversight and complete a conformity assessment, usually a self-assessment. Public bodies, and some private deployers such as those offering public services or credit scoring, must first assess the impact on fundamental rights.

Standards and codes: where the details get written

The Act sets requirements in general terms; what adequate data governance or sufficient human oversight means is worked out largely in harmonized standards, drafted by the standards bodies CEN and CENELEC at the Commission’s request. Following a standard published in the Official Journal creates a presumption of conformity; other routes are allowed, but the provider must then show its approach meets the requirements.

Standardization favors those who can afford to take part, mostly large companies. Drafting takes years, and when standards lag behind legal deadlines, pressure builds to move them: delayed standards were a central argument for the 2026 postponement. The Act allows sensitive personal data to be used for bias detection only where synthetic or anonymized data would not do the job, a permission the 2026 amendment extended beyond high-risk systems; the Foundation’s technical report on bias detection under the EU AI Act examines when such data are enough.

For general-purpose models there is a faster route: the General-Purpose AI Code of Practice, published in July 2025 under the EU AI Office, covers transparency, copyright, and safety and security for models with systemic risk. Adherence is voluntary but recognized as a way to show compliance until standards exist.

Enforcement: institutions and capacity

The EU AI Office supervises general-purpose AI models directly. National market surveillance authorities supervise AI systems on their territory. Fines can reach 35 million euros or 7 percent of worldwide annual turnover, whichever is higher, for prohibited practices, and 15 million euros or 3 percent for most other breaches.

The harder question is capacity. Checking whether a recruitment tool was tested for bias requires people who understand both law and machine learning, who are scarce in public administration. Each member state must also run a regulatory sandbox by 2 August 2027, a year later than first planned, where providers test systems under supervision before launch.

Revision: a law designed to change

The Act can change from within. The Commission may amend the list of high-risk use cases by delegated act, within the areas set by the legislator, and may update the compute threshold above which a general-purpose model is presumed to pose systemic risk.

The Court of Justice of the European Union has the final word on terms such as “AI system” and “substantial modification.” Its SCHUFA judgment of December 2023 held that producing a credit score can itself be an automated decision under the GDPR when a lender draws strongly on it, redrawing that rule’s practical boundaries.

Liability is unfinished. In 2025 the Commission withdrew its proposed AI Liability Directive, so compensation for harm caused by AI rests on national law and on the revised Product Liability Directive of 2024, which treats software, including AI systems, as a product and applies from December 2026.

Europe in a wider landscape

The Council of Europe Framework Convention on Artificial Intelligence, opened for signature in September 2024, is the first binding international treaty on AI; the EU signed it in September 2024, ratified it in May 2026 and will implement it mainly through the AI Act. The OECD AI Principles, the NIST AI Risk Management Framework and ISO/IEC 42001 supply shared vocabulary and management tools.

A developer selling worldwide will either build to the strictest regime, the so-called Brussels effect, or ship different products to different markets; and because Europe depends on computing, models and cloud services built elsewhere, EU policy now pairs rules with public investment in computing capacity.

What builders and citizens can expect

For builders, the durable part of the Act is the discipline, not the calendar:

• Knowing each system’s risk category, and documenting why.
• Recording data sources, design choices and known limitations.
• Testing for bias, accuracy and robustness, and keeping the evidence.
• Keeping a person able to understand, override and stop the system.

These survive any deadline shift; draft standards and AI Office guidance already show what evidence will be expected, and an inventory of systems and their purposes is the cheapest first step.

For citizens, the Act adds rights: to be told when interacting with an AI system or shown a deepfake; to complain to a national authority; and, once the high-risk rules apply, to a clear explanation of the role the system played in a decision that significantly affects them, alongside Article 22 of the GDPR. These rights work only if people use them; the first step is to find out which national authority is responsible. The Foundation researches how such rules work in practice and what evidence they require, and publishes its findings as technical reports.

In short

Europe’s AI Act is in force, but its practical meaning will be settled by harmonized standards, codes of practice, supervisory authorities, court rulings and revision. A 2026 amendment, Regulation (EU) 2026/1744, has already moved the obligations for listed high-risk uses to 2 December 2027, and for AI in regulated products to 2 August 2028.

Frequently asked questions

When do the EU AI Act’s high-risk obligations apply?

Obligations for the listed high-risk uses now apply from 2 December 2027, and for AI in regulated products from 2 August 2028. Most had originally been due on 2 August 2026, but Regulation (EU) 2026/1744, in force since 27 July 2026, moved the dates.

How high are the fines under the EU AI Act?

Under the EU AI Act, fines can reach 35 million euros or 7 percent of worldwide annual turnover, whichever is higher, for prohibited practices. For most other breaches the limit is 15 million euros or 3 percent.

Who enforces the EU AI Act?

The EU AI Office supervises general-purpose AI models directly, while national market surveillance authorities supervise AI systems on their territory. The harder question is capacity, because people who understand both law and machine learning are scarce in public administration.

What are harmonized standards under the EU AI Act?

Harmonized standards are drafted by the standards bodies CEN and CENELEC at the Commission’s request and work out what the Act’s general requirements mean in detail. Following a standard published in the Official Journal creates a presumption of conformity, though other routes are allowed.

What rights do citizens get under the EU AI Act?

The Act gives people the right to be told when they interact with an AI system or are shown a deepfake, and to complain to a national authority. Once the high-risk rules apply, people also have the right to a clear explanation of the system’s role in a decision that significantly affects them.

How to cite LASTHUMAN Foundation. (2026, November 3). The future of AI regulation in Europe. https://lasthuman.today/insights/future-of-ai-regulation-in-europe.html