EU AI Governance Profile

Executive summary

Regulation (EU) 2024/1689 entered into force on 1 August 2024 and applies in phases. Chapters I and II, including the AI system definition, AI literacy, and prohibited practices, have applied since 2 February 2025. Governance rules, GPAI obligations, and penalties have applied since 2 August 2025. The regulation generally applies from 2 August 2026, while Article 6(1) product-safety high-risk obligations had an original statutory application date of 2 August 2027 under the base regulation. The AI Act uses a four-level risk logic in Commission-facing communications: unacceptable risk, high risk, transparency risk, and minimal or no risk. In legal terms, the binding structure is anchored in prohibited practices under Article 5, high-risk systems under Article 6 and Annex III plus product-safety legislation in Annex I, transparency obligations under Article 50, and model-level obligations for general-purpose AI under Chapter V. The EU governance architecture is hybrid. The AI Office, established within the Commission, supports implementation across the Union and directly supervises GPAI obligations. National market surveillance authorities supervise and enforce most system-level rules. The AI Board, Scientific Panel, and Advisory Forum provide coordination and expert or stakeholder input. The Commission appointed the Scientific Panel and Advisory Forum in June 2026, strengthening the institutional layer behind enforcement. At EU level, the AI Office is the core implementation node. It was established within the Commission and is tasked with supporting coherent application of the AI Act, preparing guidance and implementing tools, investigating possible infringements, and supervising the most powerful general-purpose AI models. The governance page and the AI Office page also identify the European AI Board, Scientific Panel, and Advisory Forum as the main advisory bodies surrounding the system. At member-state level, national competent authorities include market surveillance authorities and notifying authorities. Market surveillance authorities supervise and enforce compliance for AI systems, including prohibited and high-risk rules, while notifying authorities designate and supervise notified bodies that carry out relevant third-party conformity assessment. The Commission stated that these authorities had to be designated and empowered by 2 August 2025. For GPAI, the legal architecture is more centralized than for other AI categories. Article 88 gives the Commission exclusive powers to supervise and enforce Chapter V, and the Commission entrusts those tasks to the AI Office. That centralization is one of the EU model’s most consequential structural choices.

Governance architecture

At EU level, the AI Office is the core implementation node. It was established within the Commission and is tasked with supporting coherent application of the AI Act, preparing guidance and implementing tools, investigating possible infringements, and supervising the most powerful general-purpose AI models. The governance page and the AI Office page also identify the European AI Board, Scientific Panel, and Advisory Forum as the main advisory bodies surrounding the system. At member-state level, national competent authorities include market surveillance authorities and notifying authorities. Market surveillance authorities supervise and enforce compliance for AI systems, including prohibited and high-risk rules, while notifying authorities designate and supervise notified bodies that carry out relevant third-party conformity assessment. The Commission stated that these authorities had to be designated and empowered by 2 August 2025. For GPAI, the legal architecture is more centralized than for other AI categories. Article 88 gives the Commission exclusive powers to supervise and enforce Chapter V, and the Commission entrusts those tasks to the AI Office. That centralization is one of the EU model’s most consequential structural choices.

Major policies and frameworks

Policy timeline

Enterprise implications

For providers, the EU regime requires disciplined product governance. The immediate tasks are role-mapping, AI-system inventory, prohibited-practice screening, high-risk classification, documentation architecture, vendor-chain allocation, incident-handling pathways, and literacy measures. For high-risk systems, providers should assume that conformity assessment, declaration of conformity, CE marking, registration, post-market monitoring, and evidence retention are core control functions rather than legal back-office items. For deployers, the main enterprise risk lies in use-context governance. Deployers cannot outsource all responsibility to vendors. They must ensure use consistent with instructions, assign competent human oversight, manage controlled input data, monitor operations, report serious incidents, satisfy notice duties in relevant cases, and—where applicable—carry out fundamental-rights impact assessments. Employers using AI in workforce contexts should pay particular attention to high-risk triggers in employment and worker-management use cases, as well as the workforce-facing implications of Article 4 literacy duties. For GPAI providers and downstream integrators, the EU’s most distinctive burden is value-chain transparency. Documentation must flow downstream, copyright and training-content summary obligations must be operationalized, and systemic-risk providers must be prepared for Commission-facing engagement, including notification, evaluations, incident reporting, and cybersecurity expectations. Penalty exposure is material. Member-state penalties can reach up to EUR 35 million or 7% of worldwide turnover for prohibited-practice violations, and up to EUR 15 million or 3% of worldwide turnover for a broad set of operator, deployer, notified-body, and Article 50 obligations. GPAI providers face Commission-level fines up to 3% of worldwide turnover or EUR 15 million.

Observatory interpretation

Observatory interpretation: The EU model is best understood as a layered governance stack rather than a single compliance rulebook. The statute sets the legal architecture, but actual enterprise burden is distributed across guidance, standards, conformity processes, national authorities, and role-specific controls. This is especially true for high-risk and GPAI governance. Observatory interpretation: The EU’s most globally influential design choice is the split between centralized supervision for GPAI and decentralized supervision for most AI systems. That makes the EU simultaneously a market-regulation regime and a frontier-model governance regime. Observatory interpretation: As of mid-2026, the EU profile is strongest on legal architecture and weaker on settled operational certainty in some areas, because key implementation materials remain draft or are still moving through standardisation and post-political-agreement channels. That does not reduce the law’s significance; it increases the importance of documented governance judgments and publication control.

Official resources

Update log