AI regulation and standards

The source is a guide to the EU AI Act's provisions for small and medium-sized enterprises (SMEs). It covers regulatory sandboxes that SMEs can access free of charge with priority, assessment fees proportional to company size, simplified technical documentation forms, and dedicated guidance channels.

Austria has set up an AI Service Desk under RTR to support EU AI Act implementation, but its notifying and market surveillance authorities have not been appointed. Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic and other states have named representatives to the AI Board or published lists of designated authorities, with many listed as unclear. Finland's draft implementing act from October 2024 appoints 10 existing market surveillance authorities and is still before parliament.

The European Commission's AI Office has a set of responsibilities under the AI Act, covering AI literacy, registration of Member State decisions on real-time remote biometric identification, and handling of notified bodies. Most of these tasks carry no concrete time frame, and the applicable rules take effect on 02 February 2025 or 02 August 2025 depending on the article.

Member States must designate national authorities that handle AI Act duties, including receiving and registering notifications about real-time remote biometric identification and high-risk AI systems. The source lists specific obligations per authority and says that rules under Article 113(b) apply from 02 August 2025, while the general rule under Article 113 applies from 02 August 2026.

The AI Office and a wide range of stakeholders developed the general-purpose AI (GPAI) Code of Practice, published in July 2025, as a voluntary tool under Article 56 of the EU AI Act. Providers can adhere to it to demonstrate compliance with GPAI model obligations until harmonised European standards take effect, expected August 2027 or later. The Commission and the EU AI Board have confirmed that the Code adequately covers the obligations in Articles 53 and 55.

Novelli, Hacker, Morley, Trondal and Floridi (2024) examine how the European Commission should implement and enforce the AI Act, with a focus on the AI Office and general-purpose AI (GPAI). The source lays out the Commission's tasks, including issuing guidelines on risk-based classification, defining 'significant modifications' under Art 43(4) AIA, and classifying GPAI as posing 'systemic risk' under Art 51 AIA based on criteria such as FLOPs and high-impact capabilities.

The article outlines the key compliance dates for implementing the EU AI Act, based on a timeline it says was correct when written but is now out of date. It also lists secondary legislation the Commission may adopt, such as delegated and implementing acts, and guidelines it may publish to support compliance.

This article gives a high-level summary of the EU AI Act, updated on 30 May in line with the Corrigendum version of the Act. It sorts AI systems into risk tiers: unacceptable risk is prohibited, high-risk systems are the main regulated category, limited-risk systems carry lighter transparency duties, and minimal-risk systems are unregulated.

The EU's AI Act standard-setting process is covered here, specifically the formal effort in the CEN-CENELEC JTC21 standards committee, not ISO/IEC work. The European Commission requested harmonised standards for the AI Act's high-risk provisions in 2021, and CEN and CENELEC are drafting them, a process the source describes as ongoing and behind schedule.