LegislationDigital, technology and crypto

AI Act · Artificial Intelligence Act

Regulation (EU) 2024/1689 · Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)

BOE / DOUE →EUR-Lex →Consolidated →

Legal status

In force since

1 August 2024 art. 113, párrafo primero (veinte días tras su publicación en el DOUE de 12.7.2024); análisis del BOE, DOUE-L-2024-81079

Applies from

2 August 2026 art. 113, párrafo segundo

Phased application

2 February 2025: Chapters I and II: general provisions (definitions, AI literacy under Art. 4) and prohibited practices under Art. 5. art. 113, párrafo tercero, letra a) (redacción original y redacción dada por el Reglamento (UE) 2026/1744)
2 August 2025: Chapter III, Section 4 (notifying authorities and notified bodies), Chapter V (general-purpose AI models), Chapter VII (governance), Chapter XII (penalties, except Art. 101) and Art. 78. art. 113, párrafo tercero, letra b)
27 July 2026: Articles 102 to 110 (amendments to other Union acts). Same date as the entry into force of Regulation (EU) 2026/1744 (Digital Omnibus on AI). art. 113, párrafo tercero, letra d), añadida por el art. 1.40 del Reglamento (UE) 2026/1744; art. 4 del Reglamento (UE) 2026/1744 y análisis del BOE, DOUE-L-2026-81147
2 August 2026: General application, including the transparency obligations under Art. 50 (Chapter IV). art. 113, párrafo segundo
2 December 2026: New prohibitions in Art. 5(1), points (ba) and (bb), and Art. 5(1a) and (1b) (systems generating non-consensual intimate imagery or child sexual abuse material). Same deadline for generative systems placed on the market before 2.8.2026 to comply with the Art. 50(2) marking obligation. art. 113, párrafo tercero, letra a), y art. 111, apartado 4, en la redacción del Reglamento (UE) 2026/1744 (art. 1, puntos 39 y 40)
2 December 2027: Chapter III, Sections 1, 2 and 3 (classification, requirements and obligations) for high-risk systems under Art. 6(2) and Annex III, including creditworthiness assessment and credit scoring and life and health insurance pricing (Annex III, point 5(b) and (c)). Before the Omnibus, the date was 2.8.2026. art. 113, párrafo tercero, letra c), inciso i), en la redacción del art. 1.40 del Reglamento (UE) 2026/1744
2 August 2028: Chapter III, Sections 1, 2 and 3 for high-risk systems under Art. 6(1) and Annex I (safety components of regulated products). Before the Omnibus, the date was 2.8.2027. art. 113, párrafo tercero, letra c), inciso ii), en la redacción del art. 1.40 del Reglamento (UE) 2026/1744

Published amendments

Reglamento (UE) 2026/1744 (Ómnibus digital sobre IA): Regulation of 8.7.2026, published in OJ L of 24.7.2026 and in force since 27.7.2026. It postpones high-risk obligations (Annex III to 2.12.2027; Annex I to 2.8.2028), rewrites Art. 4 (AI literacy), adds two prohibitions to Art. 5 applicable from 2.12.2026, creates Art. 4a (special-category data to correct bias), gives generative systems already on the market until 2.12.2026 to meet the Art. 50(2) marking duty, strengthens the AI Office (Art. 75) and extends relief to SMEs and small mid-caps. (applies from 27 July 2026)

Legal status reviewed on 12 November 2026 by The Neural Herald · Publications included up to 8 July 2026

What it is

Professional

Regulation (EU) 2024/1689 regulates AI by risk level and, in the financial sector, classifies as high-risk the creditworthiness assessment of natural persons and risk assessment and pricing in life and health insurance (Annex III, point 5(b) and (c)). Following the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27.7.2026), those obligations apply from 2.12.2027, while prohibitions and AI literacy (Art. 4) have applied since 2.2.2025 and the Art. 50 transparency rules since 2.8.2026. Providers and deployers that are financial institutions may integrate quality management, monitoring and logging into their sectoral governance (Arts. 17(4), 26(5) and 26(6)). Market surveillance of these systems falls by default to the national financial supervisor (Art. 74(6)), unless the Member State designates another authority (Art. 74(7)).

Plain-language

The European Union has a common law on artificial intelligence that sets stricter rules the higher the risk to people. When a bank uses AI to decide whether to grant you a loan, or an insurer uses it to price life or health insurance, that use counts as high-risk and must meet strict controls from 2 December 2027. Since August 2026, you also have the right to know when you are talking to a chatbot and to have AI-made fake content labelled. Some practices, such as manipulating people or exploiting their economic situation, have been banned since February 2025.

Who it applies to

providers placing on the market or putting into service AI systems or general-purpose AI models in the Union, whether or not established there
deployers (professional users) of AI systems established or located in the Union
third-country providers and deployers where the output of the system is used in the Union
importers, distributors, product manufacturers and authorised representatives
in the financial sector: banks, insurers, asset managers, payment institutions and fintechs, either as providers or as deployers

Exclusions:

AI systems used exclusively for military, defence or national security purposes
systems and models developed and put into service solely for scientific research and development
research, testing or development activity before placing on the market (except testing in real-world conditions)
use by natural persons in purely personal, non-professional activities
systems released under free and open-source licences, unless they are high-risk, prohibited or subject to Art. 50

art. 2 (apartados 1, 3, 6, 8, 10 y 12)

What it requires and what to review

Obligation	Who	From	Basis
Take measures to support the AI literacy of staff who operate or use AI systems, according to their knowledge and the context of use. Since the Omnibus, a specific literacy level for each person is not required.	providers and deployers of any AI system	2 February 2025	↗" target="_blank" rel="noopener">art. 4 (redacción dada por el art. 1.5 del Reglamento (UE) 2026/1744, en vigor desde el 27.7.2026); art. 113.a)
Do not use or place on the market prohibited practices: subliminal or deceptive manipulation, exploitation of vulnerabilities due to age, disability or social or economic situation, social scoring leading to detrimental treatment, crime prediction based solely on profiling, facial databases built by untargeted scraping, emotion recognition at work and in education, and biometric categorisation of sensitive data.	all operators	2 February 2025	↗" target="_blank" rel="noopener">art. 5.1, letras a) a h); art. 113.a)
New prohibitions: systems that generate or manipulate realistic intimate imagery of identifiable persons without their explicit consent, or child sexual abuse material.	providers and deployers	2 December 2026	↗" target="_blank" rel="noopener">art. 5.1, letras b bis) y b ter), y art. 5.1 bis y 1 ter (añadidos por el art. 1.7 del Reglamento (UE) 2026/1744); art. 113.a)
Inform people that they are interacting with an AI system (for example, virtual assistants or customer-service chatbots), unless it is obvious.	providers	2 August 2026	↗" target="_blank" rel="noopener">art. 50.1 y 50.5; art. 113, párrafo segundo
Mark synthetic audio, image, video or text generated by AI in a machine-readable format so that it can be detected. Systems placed on the market before 2.8.2026 have until 2.12.2026.	providers of generative AI systems, including general-purpose ones	2 August 2026	↗" target="_blank" rel="noopener">art. 50.2; art. 111.4 (añadido por el art. 1.39 del Reglamento (UE) 2026/1744)
Disclose that content is a deep fake, or that text published to inform the public on matters of public interest was AI-generated, unless it underwent human review with editorial responsibility. Inform people exposed to emotion recognition or biometric categorisation.	deployers	2 August 2026	↗" target="_blank" rel="noopener">art. 50.3, 50.4 y 50.5; art. 113, párrafo segundo
Requirements for high-risk systems used to assess the creditworthiness or credit score of natural persons (except fraud detection) and to assess risk and price life and health insurance: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and cybersecurity, quality management system and conformity assessment. Financial institutions may integrate quality management, documentation and logs into their sectoral governance.	providers of high-risk systems (including institutions developing them in-house)	2 December 2027	↗" target="_blank" rel="noopener">anexo III, punto 5, letras b) y c); arts. 6.2, 8 a 17; arts. 17.4, 18.3 y 19.2 (entidades financieras); art. 113.c).i) en la redacción del Reglamento (UE) 2026/1744
Use the high-risk system in line with its instructions, assign competent human oversight, monitor its operation, keep the logs and inform affected persons that it is used in decisions concerning them. For financial institutions, monitoring and log-keeping are integrated into their internal governance rules.	deployers of high-risk systems (banks, insurers, fintechs using them)	2 December 2027	↗" target="_blank" rel="noopener">art. 26 (en especial 26.5 y 26.6, párrafos sobre entidades financieras); art. 113.c).i)
Carry out a fundamental rights impact assessment before deploying creditworthiness or life and health insurance pricing systems. It may cross-refer to the GDPR data protection impact assessment where that already covers part of what is required.	deployers of systems under Annex III, point 5(b) and (c)	2 December 2027	↗" target="_blank" rel="noopener">art. 27.1 y 27.4 (apartado 4 en la redacción del art. 1.13 del Reglamento (UE) 2026/1744); art. 113.c).i)
Exceptional possibility to process special categories of personal data where strictly necessary to detect and correct bias, with safeguards (pseudonymisation, restricted access, subsequent deletion and record of the justification). It does not create a duty to do so for systems that are not high-risk.	providers and deployers	27 July 2026	↗" target="_blank" rel="noopener">art. 4 bis (añadido por el art. 1.6 del Reglamento (UE) 2026/1744)
Technical documentation, information for downstream providers, copyright policy and public summary of training content; additional obligations for models with systemic risk.	providers of general-purpose AI models	2 August 2025	↗" target="_blank" rel="noopener">arts. 53 y 55; art. 113.b)
Penalties: fines of up to EUR 35 million or 7% of worldwide turnover for prohibited practices, and up to EUR 15 million or 3% for breaching, among others, provider obligations (Art. 16), deployer obligations (Art. 26) and transparency obligations (Art. 50). Set by Member States.	Member States (regime); operators (subject to fines)	2 August 2025	↗" target="_blank" rel="noopener">art. 99.1, 99.3 y 99.4; art. 113.b)

General guidance based on the official text. Not legal advice or a compliance assessment.

Upcoming milestones

2 December 2026The new Art. 5 prohibitions (non-consensual intimate imagery and child sexual abuse material) apply, and the deadline expires for marking output of generative systems placed on the market before 2.8.2026. art. 113.a) y art. 111.4, en la redacción del Reglamento (UE) 2026/1744

1 August 2027The Commission must publish guidelines on the coordinated application of the Regulation with the Annex I, Section A product legislation. art. 96.1, letra g), añadida por el art. 1.36 del Reglamento (UE) 2026/1744

2 September 2027The Commission must adopt guidance including a template for the post-market monitoring plan. art. 72.3, en la redacción del art. 1.30 del Reglamento (UE) 2026/1744

2 December 2027Annex III high-risk obligations: among others, creditworthiness assessment and credit scoring, and risk assessment and pricing in life and health insurance. art. 113.c).i), en la redacción del Reglamento (UE) 2026/1744

2 August 2028High-risk obligations for Annex I systems (safety components of regulated products). art. 113.c).ii), en la redacción del Reglamento (UE) 2026/1744

Recent milestones

2 August 2026General application of the Regulation, including the Art. 50 transparency obligations. art. 113, párrafo segundo

27 July 2026Regulation (EU) 2026/1744 (Digital Omnibus on AI) enters into force, postponing high-risk obligations. art. 4 del Reglamento (UE) 2026/1744; ↗

Map of texts

The legal act

Implementing rules (technical standards and delegated acts)

Reglamento de Ejecución (UE) 2026/1755 de la Comisión, de 20 de julio de 2026, relativo a las disposiciones detalladas para la tramitación de determinados procedimientos por parte de la Comisión con arreglo al Reglamento (UE) 2024/1689 (dictado conforme al art. 92, evaluaciones de modelos de IA de uso general) 20 July 2026

Guidelines and Q&As (non-binding)

Directrices sobre prácticas de IA prohibidas establecidas por el Reglamento (UE) 2024/1689 (no vinculantes) Comisión Europea 4 February 2025
Directrices sobre la definición de sistema de IA (no vinculantes) Comisión Europea 6 February 2025
Código de buenas prácticas de IA de uso general (voluntario) Comisión Europea (Oficina de IA) 10 July 2025
Código de buenas prácticas sobre transparencia de contenidos generados por IA, art. 50.2, 50.4 y 50.5 (voluntario) Comisión Europea (Oficina de IA) 10 June 2026
Directrices sobre las obligaciones de transparencia de proveedores y responsables del despliegue de determinados sistemas de IA, art. 50 (no vinculantes) Comisión Europea
Borrador de directrices sobre la clasificación de sistemas de IA de alto riesgo, art. 6 (borrador sometido a consulta, no definitivo) Comisión Europea 19 May 2026
AI Act: implications for the EU banking and payments sector (nota informativa, no vinculante) EBA 21 November 2025
Carta del presidente de la EBA a la Comisión sobre el resultado del ejercicio de mapeo del AI Act (no vinculante) EBA 20 November 2025
Opinion on Artificial Intelligence governance and risk management (dictamen, no vinculante) EIOPA 6 August 2025
Letter to EU institutions on AI Act and EU Insurance legislation proposal for clarifying application of the AI Act EIOPA 14 April 2026
Letter and technical annex on the exclusion of GLMs and GAMs from the AI Act high-risk classification EIOPA 10 July 2026

In Spain

Authorities

Comisión Europea (Oficina de IA): Supervises general-purpose AI models and, after the Omnibus, has exclusive competence over certain systems built on those models by the same provider, expressly excluding those of financial institutions covered by Art. 74(6) (Art. 75(1)). Publishes guidelines and codes of practice.
Supervisores financieros nacionales: By default they are the market surveillance authority for high-risk systems placed on the market, put into service or used by financial institutions, where directly linked to the provision of financial services (Art. 74(6)). The Member State may designate another authority (Art. 74(7)).
Banco Central Europeo: Receives from market surveillance authorities supervising credit institutions in the Single Supervisory Mechanism information relevant to its prudential supervisory tasks (Art. 74(7), second subparagraph).
AESIA: Spanish state agency with supervisory, advisory, awareness and training functions on national and EU AI rules (Statute approved by Royal Decree 729/2023).
EBA / EIOPA: Analyse the interaction of the Regulation with banking and insurance rules and submit proposals to the Commission. Their documents are not binding.

Supervisor publications on this rule

Collected automatically from the CNMV, Bank of Spain, ECB, ESMA, EBA and EIOPA since January 2025. Partial coverage: it does not include everything published before 2025.

8 July 2026Bank of SpainReglamento (UE) 2026/1744 del Parlamento Europeo y del Consejo, de 8 de julio de 2026, por el que se modifican los Reglamentos (UE) 2024/1689, (UE) 2018/1139 y (UE) 2023/1230 en lo que respecta a la simplificación de la aplicación de normas armonizadas en materia de inteligencia artificial (Ómnibus digital sobre IA) (DOUE de 24).Legislación financiera DOUE · about the rule
14 April 2026EIOPALetter to EU institutions on AI Act and EU Insurance legislation proposal for clarifying application of the AI ActLetter · about the rule
21 November 2025EBAAI Act: implications for the EU banking and payments sectorFactsheet · about the rule
20 November 2025EBAEBA Chair letter to Mr Berrigan and Mr Viola on outcome of EBA’s AI Act mapping exerciseDocumento · about the rule

Fact sheet history

12 November 2026: Ficha creada (borrador)
12 November 2026: Ficha revisada y aprobada para su publicacion

Fact sheet drafted with the help of artificial intelligence from the linked official texts and reviewed by the editorial team. It is general information, not legal advice: always check the rule as published in the Official Journal.