The AI Act (Regulation (EU) 2024/1689) stands as the first comprehensive legal framework on artificial intelligence, and its aim is to foster trustworthy AI in Europe, one that reconciles safety and fundamental rights with investment and innovation. Its application, however, is gradual: the regulation is organized into four levels of risk, unacceptable, high, limited (or transparency), and minimal, and provides that obligations take effect at different points in time, according to the level of risk of each system. Implementation and enforcement fall to the AI Office, which centralizes oversight of general-purpose AI (GPAI) models, and to the national authorities, responsible for the remaining obligations.
It is this risk gradation that drives the law’s staggered application: the higher a system’s risk, the stricter the obligations to which it is subject.
At the unacceptable-risk level, the AI Act prohibits nine practices deemed clear threats to safety and fundamental rights, such as the exploitation of vulnerabilities, social scoring, emotion recognition in the workplace and in schools, and real-time remote biometric identification by law enforcement in publicly accessible spaces. The most recent of these, added by the Digital Omnibus on AI and expected to take effect at the end of this year, targets precisely the systems that generate non-consensual intimate content or child sexual abuse material, including “nudification” apps.
One step below are high-risk systems, which cover sensitive areas such as critical infrastructure, education, employment, biometrics, essential services, law enforcement, migration, and justice. They are not prohibited, but they are subject to the regulation’s most stringent obligations: risk assessment and mitigation, data quality, traceability, technical documentation, human oversight, and requirements of robustness, cybersecurity, and accuracy.
At the lower levels, the bar eases. The transparency level, the one that governs deepfakes, imposes disclosure duties, such as informing users that they are interacting with an AI and ensuring that AI-generated content is identifiable, but it dispenses with the conformity requirements of high risk. To it are added the rules for general-purpose AI (GPAI) models, which carry their own obligations of transparency and copyright, reinforced when a model may pose systemic risks. Finally, the vast majority of systems in use today, from spam filters to video games, fall into the minimal-risk level, for which the law creates no obligations.
Much of this design was shaped by the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since July 27, 2026: the simplification package reorganized the law’s timeline, extending deadlines, especially for high risk; reinforced the AI Office’s powers over GPAI models; expanded access to regulatory testing environments (sandboxes, including one at the EU level); and incorporated the new prohibition on non-consensual intimate content and CSAM.
Application thus advances in layers. The first prohibitions have been in force since February 2025, and the GPAI rules since August of that year. The Article 50 transparency obligations became applicable on August 2, 2026, with a single exception: generative AI systems placed on the European market before that date have until December 2, 2026 to comply with the requirement to mark their outputs in a machine-readable format. The other transparency duties, such as telling users they are interacting with an AI and identifying deepfakes, have applied since August, with no transition period. The ban on “nudification” apps takes effect on December 2, 2026. The most stringent requirements, those for high risk, become applicable only from December 2, 2027, or from August 2, 2028 when the AI is embedded in products already regulated, such as lifts and toys. None of this is limited to European companies: the AI Act applies to anyone who places AI systems on the European Union market or whose outputs are used there, which reaches Brazilian companies that offer their systems to users in Europe.