AI and the law in the European Union
In the EU, the Commission proposes laws and the Parliament and Council adopt them. Statuses are as of October 2026; the EUR-Lex link on each entry is the authoritative record.
Applying now
AI Act, Regulation (EU) 2024/1689
The comprehensive AI law: prohibitions, high-risk requirements, transparency and general-purpose model duties.
Digital Omnibus on AI, Regulation (EU) 2026/1744in force
Moves high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I), adds a ban on nudification and child abuse material generation, eases rules for smaller firms.
General Data Protection Regulation (EU) 2016/679
Lawful processing, accountability, data subject rights and safeguards for automated decisions (Article 22).
Digital Services Act, Regulation (EU) 2022/2065
Statements of reasons for moderation (including automated), recommender transparency, systemic risk duties for very large platforms.
Digital Markets Act, Regulation (EU) 2022/1925
Obligations on designated gatekeepers, including limits on combining personal data and self-preferencing in ranking.
Data Act, Regulation (EU) 2023/2854
Access to connected-product data, switching between cloud providers, and smart contract safeguards (Article 36).
Cyber Resilience Act, Regulation (EU) 2024/2847
Security by design for products with digital elements, and 24-hour reporting of actively exploited vulnerabilities.
NIS2 Directive (EU) 2022/2555
Cybersecurity risk management and incident reporting for essential and important entities.
General Product Safety Regulation (EU) 2023/988
Safety duties for consumer products including connected ones, with accident reporting.
eIDAS 2, Regulation (EU) 2024/1183
European Digital Identity Wallets and trust services; electronic timestamps can't be refused as evidence for being electronic.
European Accessibility Act, Directive (EU) 2019/882
Accessibility for e-commerce, banking, transport, e-books and communications.
Empowering Consumers for the Green Transition, Directive (EU) 2024/825
Bans generic and offset-based environmental claims; every claim needs evidence.
Adopted, applying soon
Product Liability Directive (EU) 2024/2853adopted
Software and AI are products; courts can presume a defect when the maker can't disclose evidence.
Machinery Regulation (EU) 2023/1230adopted
Safety requirements for machinery with self-evolving behaviour, including recording safety-related decisions.
Pay Transparency Directive (EU) 2023/970adopted
Objective, gender-neutral pay criteria and the employer's burden to prove no discrimination.
Platform Work Directive (EU) 2024/2831adopted
Human oversight and review of algorithmic management of platform workers.
Consumer Credit Directive (EU) 2023/2225adopted
Human intervention and explanation for automated creditworthiness assessments.
European Health Data Space, Regulation (EU) 2025/327adopted
Patients' access to electronic health data and rules for secondary use of health data, including for training AI.
Withdrawn
AI Liability Directive (proposal)withdrawn
Would have eased proof of fault for AI harm. Withdrawn; AI harm is handled by national law and the new Product Liability Directive.
ePrivacy Regulation (proposal)withdrawn
Would have replaced the ePrivacy Directive on cookies and electronic communications. The Directive remains in force.