AI law and governance frameworks in plain English: what they require, who they apply to, and when.
New: free guide for business owners. AI Governance, Made Simple gives you a 90-day plan in 15 steps, plus ready-to-use templates for your AI tool list, AI policy, vendor questions and incident plan.
The EU AI Act at a glance
The world’s first broad AI law. It sorts AI systems by risk and sets obligations for both the companies that build AI and the companies that use it. It applies to organisations outside the EU too, whenever their AI is placed on the EU market or its output is used in the EU. Read the official text on EUR-Lex or the European Commission’s overview.
- 1 August 2024 The Act enters into force.
- 2 February 2025 Banned AI practices apply, along with the duty to support your staff’s AI literacy.
- 2 August 2025 Obligations for general-purpose AI models apply, and the governance and penalty rules start.
- 2 August 2026 Transparency duties apply, such as telling people they’re talking to an AI and disclosing deepfakes. Generative AI already on the market before this date has until 2 December 2026 to mark its output as AI-generated.
- 2 December 2026 Two new bans apply: non-consensual sexual deepfakes and AI-generated child sexual abuse material.
- 2 December 2027 Obligations for high-risk AI used in sensitive areas (Annex III), such as hiring and credit scoring, apply.
- 2 August 2028 Obligations for high-risk AI built into regulated products (Annex I) apply. The last three dates were set by the Digital Omnibus on AI, in force since 27 July 2026.
The four risk levels
Unacceptable
Banned outright, for example social scoring and manipulative techniques that cause harm.
High
Allowed with strict requirements: risk management, data quality, human oversight, logging and documentation.
Transparency
People must know when they are talking to an AI, and AI-generated content must be marked.
Minimal
Most AI today. No new legal duties, though voluntary codes are encouraged.
Beyond the EU
Most organisations don’t need every framework. They need the right one for their market and customers. These are the ones we work with most:
- NIST AI Risk Management Framework A voluntary US framework for finding and managing AI risk, built around four functions: Govern, Map, Measure and Manage.
- ISO/IEC 42001 The international standard for an AI management system. You can be certified against it, which makes it the AI counterpart of ISO 27001.
- OECD AI Principles Shared principles for trustworthy AI that many national AI policies are built on.
- Council of Europe Framework Convention on AI The first international treaty on AI, human rights, democracy and the rule of law.
- GDPR and data protection law Still the rules that most often apply when AI processes personal data.
Links to all the official texts, standards and trackers we use are on our Sources page.
Last reviewed October 2026. This page is general information, not legal advice. Rules and deadlines change, so check the official text or a qualified lawyer before acting.