EU AI Act

European UnionRegulation (EU) 2024/1689Updated August 2, 2026

100%became law
Bad for your rightsLaw
  1. Proposed
  2. Parliament position
  3. Trilogue
  4. Adopted

In force; the 2026 Digital Omnibus delayed the high-risk rules

Sold as banning biometric mass surveillance, written to license it: the prohibitions on real-time face scanning, emotion recognition, and predictive policing all carry law-enforcement carve-outs.

Latest update

General application of the Act

The bill

Read the full billOfficial bill record

Key facts

Where
European Union
Bill number
Regulation (EU) 2024/1689
Status
Law
General application
August 2, 2026
Threat
High
Last update
August 2, 2026

Topics

Surveillance bills

Share this bill

What it does

Article 5 of the AI Act bans real-time remote biometric identification in public, emotion recognition, predictive policing, and social scoring. The bans carry exceptions. Real-time face scanning is permitted for listed law-enforcement purposes with authorization; retrospective face scanning of recorded footage is treated as high-risk rather than banned; emotion recognition is barred in workplaces and schools but not for police or borders. The prohibitions have applied since February 2025, general-purpose AI rules since August 2025, and the Act's general application date was August 2, 2026. The high-risk regime was then delayed by Regulation (EU) 2026/1744, the Digital Omnibus, published July 24, 2026. According to the Future of Privacy Forum, high-risk duties for the uses listed in Annex III now apply from December 2, 2027, and duties for products under Annex I from August 2, 2028.

What’s at stake

This is the law every government will point to as proof biometric surveillance is regulated, and its exceptions are the operating manual. A ban with a law-enforcement carve-out is an authorization with paperwork: the member states that wanted face scanning in public squares got a legal pathway to it, written into the world's flagship AI law.

Our take

The AI Act did what a decade of surveillance debate could not: it made real-time biometric identification of the public lawful in Europe, provided the right box is ticked. The bans got the headlines; the exceptions got the future. The Digital Omnibus delayed the high-risk rules; the law-enforcement exceptions in the bans have applied since February 2025.

Timeline

  1. High-risk duties for Annex I products apply (per the Future of Privacy Forum's reading of the Omnibus)Upcoming

  2. High-risk duties for Annex III uses apply (per the Future of Privacy Forum's reading of the Omnibus)Upcoming

  3. General application of the ActLatest

  4. Digital Omnibus published in the Official Journal as Regulation (EU) 2026/1744

  5. Council adopted the Digital Omnibus

  6. Parliament adopted the Digital Omnibus delay to the high-risk rules

  7. Commission proposed delaying parts of the high-risk regime (digital omnibus)

  8. General-purpose AI rules took effect

  9. Prohibitions and their carve-outs took effect

  10. Entered into force

  11. Parliament adopted the AI Act, 523 to 46

  12. Proposed by the European Commission

The record

Votes

  • European Parliament: Adoption (523 to 46), March 13, 2024