European Union: AI regulation & deadlines

EU — General TDM Exception with Rightholder Opt-Out (DSM Directive Art. 4)

Binds Anyone carrying out text and data mining on lawfully accessible works in the EU, including commercial AI model training (grants a permission that lapses for any work whose use the rightholder has expressly reserved under Art. 4(3)). Art. 4 requires Member States to allow reproductions and extractions of lawfully accessible works for text and data mining by anyone, for any purpose including commercial AI training, and lets copies be retained as long as the mining needs them. The permission applies only where rightholders have not expressly reserved the use in an appropriate manner — machine-readable means for content made publicly available online. This opt-out is the reservation that AI Act Art. 53(1)(c) then obliges general-purpose AI model providers to identify and respect.

LEGAL PERMISSION with an opt-out — not a compliance obligation in itself. Directive (EU) 2019/790 entered into force on 7 June 2019 (Art. 31: twentieth day after publication in OJ L 130 of 17 May 2019) and Art. 29(1) set the Member State transposition deadline at 7 June 2021, which is the date carried here; as a directive it takes effect through national implementing law, so the precise wording and any national nuance vary by Member State. Art. 4(1) verbatim: 'Member States shall provide for an exception or limitation to the rights provided for in Article 5(a) and Article 7(1) of Directive 96/9/EC, Article 2 of Directive 2001/29/EC, Article 4(1)(a) and (b) of Directive 2009/24/EC and Article 15(1) of this Directive for reproductions and extractions of lawfully accessible works and other subject matter for the purposes of text and data mining.' Art. 4(3) verbatim: 'The exception or limitation provided for in paragraph 1 shall apply on condition that the use of works and other subject matter referred to in that paragraph has not been expressly reserved by their rightholders in an appropriate manner, such as machine-readable means in the case of content made publicly available online.' Art. 2(2) defines text and data mining as 'any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations'. Art. 4(4) preserves the separate scientific-research exception in Art. 3, which carries no opt-out.

Stated maximum penalty — N/A — permissive exception (no penalty attaches to mining within Art. 4; mining a work whose use has been reserved under Art. 4(3) falls outside the exception and is dealt with as ordinary copyright infringement under national law)

Prohibited AI practices (Art. 5)

Binds All providers & deployers of AI systems in the EU. Bans on social scoring, manipulative AI, untargeted scraping.

Stated maximum penalty — Up to 7% global turnover or €35M

GPAI model provider obligations (Art. 53) — docs, copyright policy, training summary

Binds Providers of general-purpose AI models. Technical documentation (Annex XI), downstream-provider information (Annex XII), a copyright-and-related-rights policy identifying Art. 4(3) DSM rights reservations, and a public summary of training content on the AI Office template.

Stated maximum penalty — Up to 3% turnover or €15M

GPAI enforcement & fines (Art. 101)

Binds GPAI model providers (enforced by the Commission / AI Office). Commission may fine GPAI providers; supervision powers begin.

Stated maximum penalty — Up to 3% global turnover or €15M

Article 50 transparency & deepfake labelling

Binds Providers & deployers of interactive, synthetic-content or biometric AI. Disclosure of AI interaction; marking of AI-generated content.

In force 2 August 2026. Commission adopted Guidelines on Transparency Obligations under Art. 50 on 20 July 2026, C(2026) 5054 final (https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems) (soft law, interpretive guidance on chatbots, deepfakes, emotion recognition, AI-generated text). No enforcement actions by national authorities reported as of 2026-08-09; first enforcement expected Q4 2026 as national market surveillance authorities build capacity (10 of 27 member states advanced implementation). Note: marking/watermarking of systems already on market before 2 Aug 2026 deferred to 2 Dec 2026 per Reg. (EU) 2026/1744.

Stated maximum penalty — Up to 3% turnover or €15M

EU AI Act — GPAI Enforcement Procedures Implementing Regulation (EU) 2026/1755

Binds General-Purpose AI (GPAI) model providers whose models are placed on the EU market or whose services are used in the EU. Binding procedural rules activating Commission enforcement against GPAI model providers: (1) providers must grant Commission technical access to models on demand — including APIs, source code, weights, and infrastructure — for AI Act evaluations under Art. 92; (2) detailed proceedings rules for investigations leading to Art. 99–101 fines, including rights of defence, 21-day minimum observation period, oral hearings, and 5-year limitation period. All communications require qualified electronic signatures.

Adopted 20 July 2026; published OJ L 2026/1755 on 21 July 2026; entered into force on the twentieth day following publication, i.e. 10 August 2026, per Art. 12 of the Regulation. IN FORCE since 2026-08-10. Procedural safeguards for GPAI enforcement proceedings under Art. 101 of Reg. (EU) 2024/1689 are now operative; the Commission's substantive GPAI enforcement powers themselves applied from 2 August 2026. No provision of this implementing regulation is deferred to a later date.

Stated maximum penalty — Implementing regulation activates fines under Art. 99-101 of Reg. (EU) 2024/1689: up to 3% of global annual turnover for GPAI providers (Art. 101(3)); up to 1% for false/misleading information

Art. 50(2) marking retrofit — synthetic-content systems placed on the market before 2 Aug 2026

Binds Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content placed on the EU market before 2 August 2026. Four-month transitional period: providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text and were placed on the EU market before 2 Aug 2026 have until 2 Dec 2026 to implement the Art. 50(2) machine-readable marking of synthetic output.

Added by the Digital Omnibus on AI, Regulation (EU) 2026/1744, Article 1(39)(b), which adds a new paragraph 4 to Article 111 of Regulation (EU) 2024/1689 (OJ L, 24.7.2026). Recital (38) describes it as a transitional period of four months for providers who had already placed their systems on the market. Distinct from the Article 50 transparency entry, which binds from 2 Aug 2026, and from the new Article 5 CSAM/NCII prohibitions, which share the 2 Dec 2026 date but sit in the higher Article 99(3) penalty tier.

Stated maximum penalty — Up to 3% turnover or €15M

New prohibitions — AI CSAM / intimate imagery

Binds All providers / deployers of such AI systems. New Art. 5 prohibition added by Digital Omnibus (Reg. EU 2026/1744, OJ L 2026/1744 published 24 Jul 2026); prohibits AI generation of CSAM and non-consensual intimate imagery. Applies from 2 Dec 2026.

Prohibition introduced by Regulation (EU) 2026/1744; the new Article 5 prohibition applies from 2 December 2026.

Stated maximum penalty — Up to 7% turnover or €35M

GPAI models placed on the market before 2 Aug 2025 — legacy compliance deadline (Art. 111(3))

Binds Providers of general-purpose AI models placed on the EU market before 2 August 2025. The AI Act's GPAI duties bite on legacy models on 2 August 2027: general-purpose AI models placed on the EU market before 2 August 2025 have until that date to be brought into line with the Regulation. Until then, legacy models sit outside the Chapter V obligations that have bound newly placed models since 2 August 2025.

Article 111(3) of Regulation (EU) 2024/1689, unchanged by the Digital Omnibus on AI: Regulation (EU) 2026/1744 Article 1(39) amends only Article 111(2) (replaced) and adds Article 111(4) (synthetic-content marking retrofit, 2 Dec 2026) — paragraph 3 and its 2 August 2027 date are untouched (OJ L, 24.7.2026). This is the counterpart to the GPAI duties that bound new models from 2 August 2025 (Art. 53, Annex XI/XII, copyright policy, training-data summary) and to Commission enforcement powers live since 2 August 2026 (Art. 101). Scope is the model, not the system: a legacy model that is substantially modified is treated as newly placed on the market and loses the grace period.

Stated maximum penalty — Up to 3% turnover or €15M

High-risk AI obligations (Annex III)

Binds Providers & deployers of Annex III high-risk AI (employment, credit, education, biometrics, law enforcement, migration). Omnibus (Reg. EU 2026/1744, OJ L 2026/1744 published 24 Jul 2026) defers high-risk obligations for standalone Annex III systems from 2 Aug 2026 to 2 Dec 2027.

Regulation (EU) 2026/1744 (Digital Omnibus) published in the Official Journal; application of the Annex III high-risk obligations is deferred to 2 December 2027.

Stated maximum penalty — Up to 3% turnover or €15M

EU AI Act high-risk obligations (Annex I — product-embedded)

Binds Providers and deployers of AI systems embedded in regulated products listed in Annex I (medical devices, general product safety, machinery, toys, aviation, automotive, railway). Omnibus (Reg. EU 2026/1744, OJ L 2026/1744 published 24 Jul 2026) defers high-risk obligations for AI embedded in Annex I regulated products (medical devices, machinery, toys, aviation) from 2 Aug 2026 to 2 Aug 2028.

Regulation (EU) 2026/1744 (Digital Omnibus) published in the Official Journal; application of the Annex I product-embedded high-risk obligations is deferred to 2 August 2028.

Stated maximum penalty — Up to 3% global turnover or €15M

High-risk AI intended for public authorities — legacy-system compliance deadline

Binds Providers and deployers of high-risk AI systems intended to be used by public authorities. Providers and deployers of high-risk AI systems intended to be used by public authorities have until 2 Aug 2030 to bring those systems into line with the AI Act, regardless of the general legacy-system grace period for systems placed on the market before the high-risk rules apply.

Article 111(2) of Regulation (EU) 2024/1689 as replaced by the Digital Omnibus on AI, Regulation (EU) 2026/1744, Article 1(39)(a) (OJ L, 24.7.2026). Distinct from the main high-risk application dates (Annex III standalone systems, 2 Dec 2027; Annex I product-embedded systems, 2 Aug 2028): this is the backstop retrofit date for legacy systems that would otherwise sit in the grace period indefinitely. Recital (39) of the Digital Omnibus clarifies that the Article 111(2) grace period operates at type-and-model level: where at least one individual unit was lawfully placed on the market or put into service before the cut-off, other units of the same type and model stay within the grace period as long as the design remains unchanged, while a significant change in design ends it. Breaches fall in the Article 99(4) tier, points (a) for provider obligations under Article 16 and (e) for deployer obligations under Article 26.

Stated maximum penalty — Up to 3% turnover or €15M