Most AI rules before 2024 were guidance. The EU AI Act was law. The European Commission announced that the Act entered into force on 1 August 2024, published as Regulation (EU) 2024/1689.
The Act sorts AI uses by risk. A short list of practices is banned outright. "High-risk" uses, such as AI in hiring, credit or critical infrastructure, carry duties on risk management, data quality, logging, human oversight and documentation. Providers of general-purpose models get their own transparency and copyright duties.
The timetable is what turned the law into work. Per the published implementation timeline, prohibitions applied from 2 February 2025, general-purpose model rules from 2 August 2025, and most of the rest from 2 August 2026 [3].
The penalties made boards pay attention: under Article 99, the most serious breaches can draw fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
The practical effect reached well beyond Europe. Any company selling AI-enabled products into the EU now needed to know which of its systems were in scope, who the "provider" and "deployer" were, and whether it could show its controls on paper. Many found they did not have a list of their AI systems at all [2].
What to do about it
Start with an inventory: every AI system, what it decides, whose data it touches and who owns it. Then map each one to a risk class and write down the controls you can prove today. Our Govern service puts tested stop controls, audit trails and scoped credentials around your agents. See Govern.
