--- title: "EU Artificial Intelligence Act" url: "https://ailawframework.com/frameworks/eu-ai-act" type: "framework_note" site: "AI Law Framework" issuer: "European Union" status: "An Australian law firm is not subject to the Act merely because the firm is in Australia. Whether a firm is in scope depends on Article 2 of the text in force." checked: "2026-10-10" --- # EU Artificial Intelligence Act > Regulation (EU) 2024/1689. Most of it applies from 2 August 2026, with later dates for high-risk systems after the AI Omnibus. Canonical page: https://ailawframework.com/frameworks/eu-ai-act Checked: 2026-10-10 Site index for agents: https://ailawframework.com/llms.txt An Australian law firm is not subject to the Act merely because the firm is in Australia. Whether a firm is in scope depends on Article 2 of the text in force. Regulation (EU) 2024/1689. Most of it applies from 2 August 2026, with later dates for high-risk systems after the AI Omnibus. This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard. ## What it is The Artificial Intelligence Act is Regulation (EU) 2024/1689. The European Commission’s AI Act service desk sets out Article 113. The regulation entered into force on the twentieth day after publication in the Official Journal. It applies from 2 August 2026, with the earlier and later dates Article 113 states. The Commission’s digital-strategy page, read with the service desk, says prohibited practices and AI literacy obligations applied from 2 February 2025, and that governance rules and obligations for general-purpose AI models applied from 2 August 2025. From 2 August 2026 the Commission’s AI Office and Member State authorities enforce the Act, including transparency rules for certain systems. The Commission’s 31 July 2026 press release says chatbots and other interactive systems have to tell users they are dealing with AI, that deepfakes have to be labelled, and that AI-generated or altered content has to carry machine-readable marks. The same Commission page says a political agreement on a simplification proposal, the AI Omnibus, was reached and the amending regulation entered into force on 27 July 2026. As a result, rules for high-risk systems in areas including biometrics, critical infrastructure, education, employment, migration, asylum and border control apply from 2 December 2027, and rules for high-risk systems embedded in regulated products apply from 2 August 2028. The Commission’s Article 50 FAQ says a limited grace period applies only to systems placed on the market before 2 August 2026 and only to the marking and detection obligation in Article 50(2); those providers must comply from 2 December 2026. New prohibitions on generating or manipulating non-consensual intimate material and child sexual abuse material apply from 2 December 2026. ## Who it applies to The Act is European Union law. An Australian law firm is not subject to it merely because the firm is in Australia or because a vendor mentions the Act. Whether a firm is a provider, a deployer, or outside the regulation depends on the scope provisions in the current text, including where a system is placed on the market or put into service. Read Article 2 of the text in force. This page does not apply that article to a particular firm. A firm can still be affected indirectly. A vendor that is in scope may change the product, the contract, or the labels the firm sees. That is the vendor’s compliance, which the firm can ask about. It is not the firm’s own EU filing. ## What it asks of a law firm using AI - Use the Official Journal text, not a summary, before relying on a date. The dates above are the Commission’s account of Article 113 as affected by the Omnibus. - Transparency duties that the Commission describes from 2 August 2026 are about people knowing they are interacting with AI, and about labelling generated or manipulated content. They are EU duties on the actors the Act covers. They are not an Australian costs-disclosure or court-disclosure rule. - High-risk duties have the later dates the Commission states. Do not treat a tool used for legal research as high-risk under the Act without reading the annexes in the text in force. - The Act does not replace the GDPR where personal data is processed. The Commission treats them as separate instruments. ## How it maps to this framework | This site’s question | What the instrument says that bears on it | | --- | --- | | Efficiency: Whether the tool saves total human work at the quality the task needs. | Not set here. | | Effectiveness: Whether the output is good enough for the task. The catalogue does not score this. | The Act’s risk classes are about the use and the system, not about whether a particular letter of advice is right. Human oversight duties, where they apply, still leave the lawyer responsible for the work. | | Due diligence: What the firm has actually read about hosting, training and assurance before it relies on the tool. | Ask a vendor whether it considers itself a provider or a deployer, which obligations it says apply, and from which date. Keep the answer with the contract. Do not treat the answer as a ruling. | | Confidentiality: Whether client and other confidential information can go into the tool. | Not set here. | | Disclosure: When the firm tells the client, and where required the court or another party, that AI was used. | The transparency rules the Commission describes are a form of disclosure to users of certain systems. If the firm is not an actor the Act covers, those articles do not of themselves require an Australian client letter. Court rules and conduct guidance are the Australian sources for that letter. | | Certifications: ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | The Act provides for conformity assessment of some high-risk systems. That mechanism is not ISO/IEC 42001, and it is not a badge this framework records as ISO or IRAP. A vendor’s “AI Act ready” line is a claim. | | Data residency: Where the tool holds data, including whether that place is recorded as Australia. | Not set here. | ## Sources - [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689) - [European Commission, AI Act policy page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) - [AI Act service desk, Article 113](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113) - [European Commission, Transparency obligations under Article 50 of the AI Act (FAQ)](https://digital-strategy.ec.europa.eu/en/faqs/transparency-obligations-under-article-50-ai-act) - [European Commission press release, 31 July 2026](https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august) ## Related pages - [General Data Protection Regulation](https://ailawframework.com/frameworks/gdpr.md) - [Voluntary AI Safety Standard](https://ailawframework.com/frameworks/voluntary-ai-safety-standard.md) - [NIST AI Risk Management Framework and the Generative AI Profile](https://ailawframework.com/frameworks/nist-ai-rmf.md)