EU AI Act enters into force

The EU Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. Entry into force started the clock rather than switching every duty on, because the general application date was set for 2 August 2026.

What it is

The regulation's entry-into-force clause ties the start date to the twentieth day after publication in the Official Journal. Parliament's procedure file records the final act as signed on 13 June 2024 and published on 12 July 2024. The Commission's announcement recalled that the law was proposed in April 2021 and agreed by Parliament and Council in December 2023, and framed it as addressing risks to health, safety and fundamental rights.

What it requires

The Commission's summary on the day sorted systems into four tiers. Chatbots must tell users they are talking to a machine, and certain generated content must carry a label. High-risk examples such as medical software or recruitment tools face strict requirements, including risk mitigation, high-quality data sets, clear user information and human oversight. For high-risk systems the legal text itself demands resilience against unauthorised parties who try to alter use, outputs or performance by exploiting vulnerabilities. General-purpose AI provisions were set to apply 12 months later.

What security leaders should do

Entry into force is the right moment to anchor an AI inventory to the regulation's four risk tiers. List every AI system in use or in development, record which tier it most plausibly falls into, and note who supplies it. For anything that could be high-risk, map the cybersecurity article to existing controls for data poisoning, adversarial inputs and model integrity, and record the gaps. That inventory becomes the input for every later deadline.