1. Executive Summary

The European Union has moved from a general policy debate on artificial intelligence to a structured regulatory and industrial policy phase. Regulation (EU) 2024/1689, the Artificial Intelligence Act, is now the legal centrepiece, but it is no longer the only point of reference. AI policy in Europe must be read through a wider framework that includes data governance, cybersecurity, product liability, platform regulation, research funding, high-performance computing, sectoral data spaces and the new industrial objective of making Europe an “AI Continent”.

This eDossier updates and expands the previous eBriefing into a more complete analytical product. It keeps the core structure of the earlier brief - legislation, governance, restrictions and investment - but adds the 2025-2026 implementation state of play, the Digital Omnibus on AI, the General-Purpose AI Code of Practice, the Commission guidelines on AI system definition and prohibited practices, the 2026 draft guidelines on high-risk classification and transparency obligations, the European AI Continent Action Plan, the Apply AI Strategy and the AI in Science Strategy.

The EU approach is based on a dual political economy: on the one hand, Europe wants to preserve fundamental rights, product safety, consumer protection, democratic accountability and a human-centric model of innovation; on the other hand, the Commission and Member States now recognise that AI capacity has become a competitiveness, research, defence, productivity and strategic autonomy issue. The policy shift between 2024 and 2026 is therefore not a move away from regulation, but a move toward implementation, simplification and industrial acceleration.

The AI Act entered into force on 1 August 2024. The first obligations - the general provisions, AI literacy and the prohibition of selected unacceptable-risk AI practices - started to apply on 2 February 2025. Governance and general-purpose AI obligations applied from 2 August 2025. Article 50 transparency obligations are due to apply from 2 August 2026. High-risk AI obligations remain the most operationally complex part of the regime: as originally adopted, the general application date was 2 August 2026, with product-integrated systems under Article 6(1) due later. However, the Commission proposed a Digital Omnibus on AI in November 2025 and announced a political agreement in May 2026 to simplify implementation and link parts of the high-risk timeline to the availability of standards and support tools.

This means that a practical AI compliance strategy in 2026 cannot rely on a single deadline. Organisations must classify their AI systems, identify their role as provider, deployer, importer, distributor, product manufacturer or authorised representative, map whether the system falls under prohibited, high-risk, transparency-only, general-purpose or minimal-risk categories, and assess parallel obligations under the GDPR, Data Act, Data Governance Act, Digital Services Act, Cyber Resilience Act, NIS2 Directive, revised Product Liability Directive and sector-specific regimes such as health, finance, employment, transport or critical infrastructure.

The EU’s strategic response now has three pillars. First, governance and trust: the AI Office, the AI Board, national competent authorities, sandboxes, standards, codes of practice and market surveillance. Second, compute and data capacity: AI Factories, AI Gigafactories, EuroHPC supercomputers, European data spaces and access to datasets. Third, adoption and research: the AI Continent Action Plan, Apply AI Strategy, AI in Science Strategy, Horizon Europe, Digital Europe, InvestEU, the European Innovation Council, European Digital Innovation Hubs and national Recovery and Resilience investments.

The core analytical conclusion is that the EU has designed a regulatory model that can become a competitive asset only if implementation is predictable, standards are delivered on time, sandboxes and support tools are accessible to SMEs, and public procurement creates early demand for trustworthy AI solutions. If these conditions are not met, the same framework may generate compliance costs without creating a comparable European scale-up environment. The next 24 months are therefore decisive: Europe’s AI policy will be judged less on legal ambition and more on operational execution, funding absorption, access to compute, sectoral deployment and the ability to translate research excellence into market adoption.

Key takeaways

• The AI Act is now part of a broader EU AI implementation package rather than an isolated regulation.
• The Commission has moved from legislative design to implementation guidance, standardisation, sandboxes, codes of practice and simplification.
• General-purpose AI models are a distinct compliance category, with transparency, copyright and systemic-risk obligations supported by a voluntary Code of Practice.
• High-risk AI remains the most burdensome and strategically important category, especially in employment, education, law enforcement, border management, essential services, health and safety-critical products.
• The AI Liability Directive proposal has been withdrawn; the revised Product Liability Directive is therefore the main EU-level horizontal liability instrument for defective AI-enabled products, alongside national tort law and sectoral rules.
• The EU industrial-policy agenda now centres on compute infrastructure, AI factories, data access, applied adoption in strategic sectors and research capacity.
• For businesses, the immediate priority is not abstract AI ethics but a documented AI inventory, risk classification, data governance, contractual allocation of responsibilities and evidence-based compliance management.

2. Strategic Context and Political Assessment

Artificial intelligence has become a general-purpose technology comparable in strategic significance to electricity, cloud computing, semiconductors and advanced telecommunications. The deployment of generative AI, frontier models and agentic systems has accelerated the policy debate because AI is no longer only a research domain: it is entering administration, education, industrial processes, healthcare, media, finance, energy management, defence-related technologies and scientific discovery.

The EU’s strategic challenge is structural. Europe has strong research institutions, a large internal market, industrial depth, public-sector use cases, high-quality data in regulated sectors and a sophisticated legal tradition. At the same time, it has lagged behind the United States in foundation-model platforms, venture capital scale, cloud hyperscaler capacity and rapid commercial deployment. China adds a second geopolitical pole, combining industrial policy, data scale and state-driven technological capacity. The EU response therefore combines regulation with sovereignty-oriented industrial policy.

The first phase of EU AI policy, from the 2018 High-Level Expert Group guidelines to the 2020 White Paper and the 2021 Coordinated Plan, framed AI around “excellence and trust”. The second phase, culminating in the AI Act, converted that approach into binding law. The third phase, visible from 2025 onwards, is more competitiveness-driven: the EU is seeking to accelerate adoption, reduce fragmentation, mobilise compute, connect research and industry, and simplify implementation where legal obligations risk slowing deployment.

This does not mean that the EU is abandoning the Brussels Effect in AI regulation. Rather, it is attempting to make the Brussels Effect operational. The AI Act can influence global AI governance only if it becomes implementable at scale and if European firms are not confined to compliance while non-European competitors dominate the market. The political balance has therefore shifted toward a more pragmatic triangle: fundamental rights protection, innovation capacity and strategic autonomy.

2.1 Strategic objectives of EU AI policy

• Protect fundamental rights, safety, privacy, non-discrimination, democratic processes and consumer interests.
• Create legal certainty for developers, deployers, investors and public authorities.
• Stimulate AI adoption by SMEs, industry and public administrations.
• Build European compute and data infrastructure to reduce dependence on external providers.
• Support European research excellence and convert it into industrial and scientific leadership.
• Shape international norms through a risk-based and human-centric AI governance model.

2.2 The policy tension: regulation versus scale

The central tension is not whether Europe should regulate AI. The practical question is how to regulate AI while building the technical and financial conditions needed for European AI companies and users to scale. Compliance costs may be justified for high-risk uses affecting people’s rights, health or safety, but the same costs can be damaging if imposed without clear standards, templates, regulatory guidance and affordable conformity-assessment pathways. This explains the importance of the Digital Omnibus on AI, AI sandboxes, the AI Act Service Desk, the AI Pact and standardisation work under CEN-CENELEC.

A second tension concerns data access. AI development requires data, but EU law protects personal data, confidential business information, intellectual property and cybersecurity. The Data Act, Data Governance Act, European Health Data Space, GDPR and sectoral data spaces therefore define the data environment in which AI innovation can occur. For Europe, “more data” is not enough; the policy objective is trusted, lawful and interoperable access to data.

A third tension concerns compute. Advanced AI research and foundation-model development require high-performance computing, specialised chips and large-scale energy-efficient infrastructure. The AI Factories and AI Gigafactories agenda is a recognition that AI sovereignty is not only legal sovereignty. It also depends on access to computing capacity, cloud-edge infrastructure, data pipelines and skilled human capital.

3. EU AI Act: Legal Architecture and Implementation State of Play

The Artificial Intelligence Act, Regulation (EU) 2024/1689, establishes harmonised rules for AI systems in the internal market. Its policy logic is risk-based: stricter obligations apply where an AI system can create more serious risks to health, safety, fundamental rights or public interests. The Act regulates providers and deployers, but also importers, distributors, product manufacturers and authorised representatives where they participate in the AI value chain.

3.1 Scope and basic legal logic

The AI Act applies to AI systems placed on the EU market, put into service in the EU, or whose output is used in the EU, subject to specific scope limitations. It therefore has extraterritorial effects for non-EU providers whose AI systems or outputs reach the EU market. The regulation distinguishes between AI systems and general-purpose AI models. The distinction is important: an AI system is deployed for a specific use, while a general-purpose AI model can be integrated into many downstream systems.

The Act uses a layered classification. Some AI practices are prohibited because they pose unacceptable risks. High-risk AI systems are allowed but subject to stringent obligations. Certain AI systems are subject mainly to transparency obligations. Minimal-risk AI systems remain largely unregulated under the AI Act, although other EU laws may still apply.

3.2 Application timeline

3.3 Prohibited AI practices

The prohibited-practices regime is the most immediate legal restriction. It reflects the EU’s view that certain applications are incompatible with fundamental rights, human dignity or democratic values. The Commission published guidelines on prohibited AI practices in February 2025 to facilitate application of these rules. The prohibitions are not a ban on AI as a technology; they target specific practices and use contexts.

• AI systems using materially distortive subliminal or manipulative techniques in ways that cause or are likely to cause significant harm.
• AI systems exploiting vulnerabilities related to age, disability or specific social or economic situations in ways that cause or are likely to cause significant harm.
• Public-authority social scoring leading to unjustified or disproportionate detrimental treatment.
• Certain predictive policing practices based solely on profiling or personality traits.
• Untargeted scraping of facial images from the internet or CCTV footage to create or expand facial-recognition databases.
• Emotion-recognition systems in workplaces and educational institutions, subject to narrow exceptions such as medical or safety reasons.
• Biometric categorisation systems inferring sensitive characteristics, subject to narrowly defined exclusions.
• Real-time remote biometric identification in publicly accessible spaces for law enforcement, except under strictly limited conditions and safeguards.

3.4 High-risk AI systems

High-risk AI systems are the core compliance category. The legal obligation is not to avoid high-risk AI altogether, but to design, document, test, monitor and govern it in a way that satisfies the Act’s requirements. High-risk status can arise in two main ways: first, where AI is a product or safety component covered by specified EU harmonisation legislation and subject to third-party conformity assessment; second, where the AI system falls within Annex III use cases that can significantly affect health, safety or fundamental rights.

Core obligations for high-risk AI providers

• Risk-management system covering foreseeable risks throughout the lifecycle.
• Data governance for training, validation and testing datasets, including relevance, representativeness and bias mitigation where applicable.
• Technical documentation sufficient to demonstrate conformity.
• Automatic logging capabilities to support traceability.
• Transparency and instructions for use enabling deployers to understand capabilities, limitations and conditions of use.
• Human oversight measures appropriate to the risks and deployment context.
• Accuracy, robustness and cybersecurity requirements.
• Quality-management system, conformity assessment, EU declaration of conformity and CE marking where required.
• Post-market monitoring and serious-incident reporting.

Core obligations for deployers

Deployers are not passive users. They must use the system according to instructions, ensure appropriate human oversight, monitor operation, keep logs where under their control, conduct fundamental-rights impact assessments in specified cases, inform workers or affected persons where required, and cooperate with competent authorities. The deployer role is especially important in employment, education, public administration and financial services, where the same technical system can have different legal consequences depending on context.

3.5 General-purpose AI models and systemic risk

General-purpose AI models are regulated because they can be integrated into numerous downstream systems and can generate systemic risks even before a specific application is known. The AI Act imposes transparency and documentation obligations on providers of GPAI models. Providers of GPAI models with systemic risk face additional obligations, including model evaluation, risk assessment and mitigation, adversarial testing where appropriate, cybersecurity measures, incident reporting and cooperation with the AI Office.

The General-Purpose AI Code of Practice, received by the Commission in July 2025, is designed as a voluntary compliance tool addressing transparency, copyright and safety/security. Although voluntary, it is strategically important because it provides a practical bridge between high-level legal obligations and operational compliance expectations.

3.6 Transparency obligations

Article 50 introduces transparency obligations for specific AI systems. From 2 August 2026, people in the EU must be informed when they are interacting with AI systems in covered situations or when they are exposed to certain AI-generated or manipulated content. The Commission opened consultations in 2026 on draft guidelines and on a Code of Practice for transparency of AI-generated content. This area is important for chatbots, deepfakes, synthetic media, automated content generation and systems that produce or manipulate text, audio, images or video.

3.7 Enforcement and penalties

The AI Act uses market surveillance, national competent authorities and EU-level coordination. Penalties vary according to the infringement. The most serious breaches, including prohibited practices, may trigger the highest administrative fines. The enforcement model is designed to combine national supervision with centralised expertise for general-purpose AI models through the AI Office. For companies, the practical issue is not only the maximum fine, but the evidentiary burden: documentation, logs, risk management and governance records will be essential to show compliance.

4. Governance: AI Office, AI Board, National Authorities and Standardisation

The AI Act is an implementation-heavy regulation. Its effectiveness depends on governance structures, standards, guidance and consistent enforcement. The European AI Office, established within the Commission, is the central actor for expertise, coordination and supervision of general-purpose AI. It works alongside the European Artificial Intelligence Board, national competent authorities, market surveillance authorities, the advisory forum and scientific expertise mechanisms.

4.1 European AI Office

The European AI Office supports the development and adoption of trustworthy AI while protecting against risks. Its role includes supporting AI Act implementation, contributing to guidance, supervising general-purpose AI models, coordinating with Member States and stakeholders, and promoting innovation initiatives. The Office also has a strategic function: it connects regulatory implementation with the Commission’s industrial-policy initiatives, including AI Factories and the AI Continent Action Plan.

4.2 European Artificial Intelligence Board and national authorities

The AI Board brings together Member State representatives to promote consistent application of the AI Act. Member States must designate competent authorities and market surveillance authorities. This decentralised layer matters because high-risk systems will often be deployed in national administrative, labour, education, health or law-enforcement contexts. Divergent national practices could create fragmentation unless guidance, standards and Board coordination are effective.

4.3 Standardisation

European harmonised standards are central to practical implementation because they can give providers a presumption of conformity with certain requirements. The Commission mandated CEN and CENELEC to develop standards for high-risk AI requirements, and the mandate was amended in 2025 to align with the final AI Act text. As of 2026, the standardisation work remains a critical bottleneck. The Digital Omnibus approach explicitly recognises that high-risk obligations should be implemented with adequate support tools, including standards.

4.4 AI sandboxes and real-world testing

Regulatory sandboxes are intended to reduce uncertainty and support innovation, especially for SMEs and startups. They allow controlled experimentation under authority supervision. Real-world testing provisions are particularly important for AI systems whose performance cannot be fully evaluated in laboratory conditions. The challenge will be capacity: sandboxes must be accessible, timely and technically competent, not only symbolic.

4.5 AI Pact and voluntary preparation

The AI Pact encourages organisations to prepare for AI Act compliance before obligations fully apply. It is politically useful because it builds implementation culture, but companies should not confuse voluntary commitments with legal compliance. A credible AI Pact strategy should include an AI inventory, governance roles, training, classification methodology, risk documentation and procurement controls.

5. EU Regulatory Ecosystem Around AI

AI systems rarely operate in a legal vacuum. A recruitment algorithm may trigger the AI Act, GDPR, labour law and equality law. A medical AI system may trigger the AI Act, medical-device rules, EHDS obligations, cybersecurity requirements and product liability. A generative AI platform may trigger the AI Act, GDPR, copyright law, DSA obligations and consumer law. The following table maps the main EU instruments that should be considered in any AI compliance or policy analysis.

5.1 GDPR and AI

The GDPR remains one of the most important legal constraints on AI in Europe. It applies when AI systems process personal data, including training, fine-tuning, inference, monitoring, profiling or decision support. Key issues include lawful basis, purpose limitation, data minimisation, special-category data, automated decision-making, explainability, data-subject rights, data protection impact assessments and transfers outside the EU. The AI Act does not replace the GDPR; it operates alongside it. In practice, many AI projects require both an AI Act classification assessment and a GDPR data protection impact assessment.

5.2 Data access and the European data economy

The EU data strategy is intended to provide lawful and interoperable access to data for innovation. The Data Governance Act facilitates trusted data sharing and reuse of certain public-sector data. The Data Act focuses on fair access to and use of data, particularly industrial and connected-product data, and also addresses cloud-switching issues. The European Health Data Space is especially important for medical AI, research and health-policy innovation. Together, these instruments seek to address a structural weakness in Europe’s AI ecosystem: fragmented access to high-quality data.

5.3 Cybersecurity and resilience

AI systems are both cybersecurity tools and cybersecurity targets. They can support threat detection, vulnerability analysis and incident response, but they can also be attacked through model poisoning, prompt injection, adversarial inputs, data leakage, supply-chain compromise or manipulation of autonomous agents. The Cyber Resilience Act and NIS2 Directive therefore interact with the AI Act’s requirements on robustness, accuracy, cybersecurity and post-market monitoring.

5.4 Liability and consumer protection

The withdrawal of the AI Liability Directive proposal changes the liability landscape. The revised Product Liability Directive now carries much of the horizontal EU-level burden for defective AI-enabled products and software. However, it does not cover every AI-related harm. National tort law, contract law, consumer law, equality law, sectoral regulation and procedural rules remain important. For businesses, this reinforces the importance of documentation, logs, quality management, risk assessment and contractual allocation of responsibilities along the AI value chain.

6. EU AI Strategy: From Trustworthy AI to an AI Continent

The EU’s AI strategy has evolved from a trust-and-excellence framework to an explicit competitiveness agenda. The objective is no longer only to regulate AI; it is to ensure that AI is developed, deployed and scaled in Europe. The AI Continent Action Plan, Apply AI Strategy and AI in Science Strategy are the main 2025-2026 policy pillars of this shift.

6.1 AI Continent Action Plan

The AI Continent Action Plan, launched in 2025, sets out the ambition to make Europe a global leader in AI. It focuses on the conditions needed for AI leadership: computing infrastructure, data access, algorithmic and industrial capacity, skills, deployment in strategic sectors and simpler implementation of rules. Politically, the plan responds to the concern that regulation alone cannot create a competitive AI ecosystem.

• Build large-scale AI computing infrastructure through AI Factories and AI Gigafactories.
• Improve access to high-quality data through data spaces and data governance instruments.
• Accelerate AI adoption in strategic sectors of the economy and public services.
• Strengthen skills, talent and research capacity.
• Simplify and support implementation of the AI regulatory framework.

6.2 Apply AI Strategy

The Apply AI Strategy is the EU’s sectoral adoption strategy. It aims to move AI from research and experimentation into the productive economy. Its emphasis is on strategic sectors such as healthcare, manufacturing, automotive, energy, pharmaceuticals, public administration, climate, agriculture, defence-related applications and SMEs. It encourages an AI-first approach where AI is considered as a solution to policy and productivity challenges, while remaining consistent with EU safeguards.

The strategic value of Apply AI is demand creation. Europe has research strengths, but adoption gaps in SMEs and public administration limit productivity gains. Sector-specific deployment programmes, technical assistance, procurement and demonstrators can create reference markets for trustworthy AI. This is particularly relevant for regulated sectors where legal certainty and conformity with EU rules can become a competitive advantage.

6.3 AI in Science Strategy

The AI in Science Strategy addresses the research side of the AI ecosystem. It seeks to support scientists in adopting AI tools responsibly, reinforce Europe’s scientific leadership and accelerate discovery. The policy logic is that AI is not only a sector in itself; it is a research infrastructure for all scientific fields, including medicine, climate science, materials, energy, engineering, life sciences and social sciences.

The strategy is relevant for Horizon Europe, the European Research Council, the European Innovation Council, research infrastructures, data spaces and supercomputing. It also raises governance questions: research AI must preserve scientific integrity, reproducibility, transparency, ethical review and responsible data use.

6.4 AI Factories and AI Gigafactories

AI Factories are designed to connect high-performance computing resources, data, algorithms, skills and support services. They are intended to help startups, SMEs, researchers and industry develop and train AI models. AI Gigafactories respond to the shortage of very large-scale computing capacity needed for frontier AI. The strategic message is clear: without compute, Europe cannot fully control its AI future.

For SMEs, the main question is accessibility. AI factories must provide practical routes to compute, technical support and testing environments. For Member States, the issue is coordination: compute infrastructure should not become fragmented national prestige investment, but part of a European network serving cross-border innovation.

6.5 International cooperation and global standard setting

The EU continues to promote trustworthy AI internationally through cooperation with partners, standards bodies, the G7 Hiroshima process, OECD principles, Council of Europe instruments and bilateral digital partnerships. The international dimension matters because AI supply chains are global. European AI regulation will affect non-EU providers, but Europe also depends on external chips, cloud services, foundation models, research collaboration and global markets. The EU’s strategic aim is not isolation, but interdependence under rules that protect European values and interests.

7. Research, Innovation and EU Funding for AI

EU AI funding is distributed through several programmes rather than a single AI fund. This creates opportunities but also complexity. Applicants must identify whether a project fits research and innovation, digital deployment, infrastructure, SME finance, regional development, defence, health, skills or recovery priorities. The following sections map the principal instruments.

7.1 Horizon Europe

Horizon Europe is the EU’s key research and innovation programme for 2021-2027, with a total budget of approximately EUR 95.5 billion. AI is supported across several pillars and clusters, particularly Cluster 4 - Digital, Industry and Space - but also health, climate, energy, mobility, security, food systems and research infrastructures. Horizon Europe supports both technological AI research and the societal, ethical and governance dimensions of AI deployment.

AI-related Horizon Europe projects may address trustworthy AI, robotics, data technologies, edge AI, AI for science, industrial AI, digital twins, cybersecurity, health AI, climate modelling, language technologies, autonomous systems and AI-enabled public services. The European Research Council supports frontier research, while the European Innovation Council supports breakthrough innovations and scale-up potential.

7.2 Digital Europe Programme

The Digital Europe Programme is deployment-oriented. It supports high-performance computing, artificial intelligence, cybersecurity, advanced digital skills and the broad use of digital technologies across the economy and society. In AI, Digital Europe is particularly relevant for testing and experimentation facilities, data spaces, European Digital Innovation Hubs, AI-on-demand services, sectoral deployment and skills.

7.3 EuroHPC Joint Undertaking

The EuroHPC Joint Undertaking is central to Europe’s compute strategy. Supercomputing capacity supports AI research, model training, simulation, digital twins, scientific computing and industrial applications. The AI Factories agenda strengthens this role by making HPC resources more directly accessible for AI development and adoption. The EuroHPC ecosystem is therefore both a research infrastructure and an industrial-policy instrument.

7.4 European Innovation Council and InvestEU

The European Innovation Council supports high-risk, high-potential innovation through grants, blended finance and scale-up instruments. It is relevant for AI startups developing deep-tech solutions, especially where commercialisation requires significant technical validation. InvestEU supports investment and access to finance, including for digital and AI projects. Its strategic function is to mobilise additional public and private investment rather than fund projects directly in the same way as grant programmes.

7.5 Recovery and Resilience Facility and national plans

The Recovery and Resilience Facility required Member States to allocate a significant share of national plans to digital transition. AI-related investments can appear under digital public services, cloud, cybersecurity, digital skills, research infrastructure, SME digitalisation and sectoral transformation. Because these funds are implemented nationally, opportunities vary significantly by Member State.

7.6 Cohesion Policy and regional innovation

The European Regional Development Fund and Cohesion Fund can support digital transformation, innovation ecosystems, research infrastructure and SME capacity in less-developed regions. For AI, regional smart specialisation strategies are important. They can focus on industrial AI, health innovation, energy systems, agriculture, logistics or public-sector digitalisation depending on regional strengths.

7.7 European Digital Innovation Hubs

European Digital Innovation Hubs act as one-stop shops to help companies and public-sector organisations test before investing, find finance, develop skills and access innovation ecosystems. For SMEs, EDIHs can be the most practical first contact point for AI adoption because they translate EU-level priorities into local technical assistance.

7.8 Funding map

8. Sectoral Deployment Priorities and Strategic Implications

AI adoption will not be uniform. The EU strategy prioritises sectors where Europe has industrial strengths, public-interest needs or strategic dependencies. The sectoral view is essential because compliance obligations, datasets, business models and public acceptance differ substantially by domain.

8.1 Healthcare and life sciences

Healthcare is one of the most promising and sensitive AI domains. AI can support diagnostics, imaging, clinical decision support, drug discovery, hospital logistics, personalised medicine, public-health surveillance and administrative efficiency. The regulatory stack is dense: AI Act, medical-device rules, GDPR, EHDS, cybersecurity, product liability and professional responsibility. Trustworthy deployment will require clinical validation, bias assessment, human oversight, explainability appropriate to the clinical context and integration into medical workflows.

8.2 Manufacturing and industrial AI

Industrial AI is strategically important for European competitiveness. Use cases include predictive maintenance, quality control, robotics, energy optimisation, supply-chain management, digital twins and autonomous production processes. Many industrial systems may not be high-risk under the AI Act unless linked to safety-critical products or critical infrastructure, but cybersecurity, trade secrets, data access and product safety remain central.

8.3 Energy, climate and infrastructure

AI can support grid optimisation, demand response, renewable forecasting, building efficiency, climate modelling, industrial decarbonisation and infrastructure maintenance. In critical infrastructure contexts, high-risk classification, NIS2 obligations and cybersecurity resilience become central. Public authorities should view AI not only as a technology investment but as part of resilience and climate policy.

8.4 Public administration

Public-sector AI can improve service delivery, fraud detection, document processing, translation, planning and citizen support. However, public authorities face heightened legitimacy requirements. AI systems used to allocate benefits, assess risks or support decisions affecting individuals may be high-risk. Public-sector deployment should therefore include transparency, human review, appeal mechanisms, procurement clauses, auditability and fundamental-rights impact assessment.

8.5 Education and employment

Education and employment are high-sensitivity domains because AI can affect life chances. Admission tools, exam proctoring, learner evaluation, CV screening, ranking, worker monitoring and algorithmic management may be high-risk. Deployers should pay particular attention to bias, explainability, human oversight, labour consultation, data minimisation and documentation of decision-making processes.

8.6 Finance and essential services

AI in credit scoring, fraud detection, insurance, risk modelling and customer segmentation intersects with financial regulation, consumer protection, GDPR and potentially the AI Act. Essential-service access decisions require procedural safeguards and non-discrimination controls. Financial-sector supervisors are likely to focus on model governance, explainability, operational resilience and third-party dependencies.

8.7 Defence, security and dual-use technologies

Defence and national security remain partially outside the ordinary internal-market logic of the AI Act, but AI-enabled defence, cybersecurity and dual-use technologies are central to Europe’s strategic autonomy debate. Funding, export controls, procurement and ethical safeguards will shape this field. The policy challenge is to support security capabilities without undermining democratic oversight and fundamental rights.

9. Compliance Roadmap for Companies and Public Authorities

AI compliance should be managed as a structured governance programme, not as a one-off legal memo. The following roadmap is designed for providers, deployers and public authorities preparing for the AI Act and related EU digital regulation.

• Create an AI inventory. List all AI systems and GPAI models used, developed, procured, embedded or integrated into services. Include shadow AI tools used by staff.
• Identify legal roles. Determine whether the organisation acts as provider, deployer, importer, distributor, product manufacturer or authorised representative for each system.
• Classify risk. Assess whether each system is prohibited, high-risk, subject to transparency obligations, a GPAI model, or minimal/limited risk. Document the reasoning.
• Map data flows. Identify personal data, special-category data, industrial data, third-party datasets, training data, fine-tuning data, logs and cross-border transfers.
• Run GDPR and fundamental-rights assessments. Conduct DPIAs and fundamental-rights impact assessments where required or prudent.
• Establish governance. Assign accountability to legal, compliance, IT, cybersecurity, data protection, procurement, product and business owners.
• Review procurement and contracts. Require documentation, audit rights, conformity commitments, data-use restrictions, cybersecurity guarantees and incident-reporting clauses.
• Implement technical controls. Address logging, monitoring, cybersecurity, human oversight, access control, robustness testing and performance drift.
• Prepare documentation. Maintain technical files, instructions for use, model cards where appropriate, risk-management records, training data governance and post-market monitoring plans.
• Train staff. Implement AI literacy for relevant personnel, including management, developers, procurement officers and operational users.
• Monitor regulatory updates. Track standards, Commission guidelines, Digital Omnibus implementation, national authority guidance and sectoral rules.
• Prepare for incidents. Define escalation, serious-incident reporting, user communication, remediation and suspension procedures.

9.1 Minimum AI governance policy

A minimum AI governance policy should define allowed, restricted and prohibited uses; require prior review for high-impact systems; regulate use of external generative AI tools; set data input rules; require human oversight for decisions affecting individuals; define vendor due diligence; and establish reporting channels for errors, bias or security incidents.

9.2 Procurement checklist

• Does the vendor identify whether the product is an AI system or integrates a GPAI model?
• Has the vendor provided AI Act classification and supporting documentation?
• What training, validation and testing data were used, and what are the known limitations?
• Are logs available and who controls them?
• What human oversight measures are supported?
• What cybersecurity controls are implemented?
• Can the customer audit or request compliance evidence?
• How are updates, model drift and performance changes handled?
• Are EU data protection, data localisation or transfer requirements implicated?
• Who bears liability for defects, non-compliance, incidents or misuse?

10. Risks, Opportunities and Policy Outlook

The EU’s AI policy architecture is ambitious and increasingly comprehensive. Its strengths are legal certainty, human-centric legitimacy, protection of fundamental rights, data governance and the potential to create a premium market for trustworthy AI. Its weaknesses are complexity, fragmentation risk, compliance costs, delayed standards, limited scale-up finance and dependence on external compute and foundation-model ecosystems.

10.1 Opportunities

• Trustworthy AI as a competitive differentiator in regulated global markets.
• Public-sector demand for compliant AI solutions in health, administration, transport, energy and security.
• Industrial AI in manufacturing, robotics, energy efficiency, logistics and quality control.
• AI in science as a multiplier for European research excellence.
• AI Factories and EuroHPC as infrastructure for startups, SMEs and researchers.
• Data spaces as a European advantage where trust and interoperability are essential.

10.2 Risks

• Compliance overload for SMEs if standards, templates and sandboxes are not practical.
• Regulatory fragmentation if Member States interpret high-risk obligations differently.
• Delayed standards creating uncertainty for providers and conformity-assessment bodies.
• Dependence on non-EU cloud, chips and foundation models.
• Insufficient venture and growth capital for European AI scaleups.
• Public distrust if AI is deployed without transparency, appeal mechanisms or accountability.
• Cybersecurity threats against AI systems and AI-enabled infrastructure.

10.3 Policy outlook 2026-2028

The next phase will be dominated by implementation. The most important developments to monitor are the final adoption and publication of the AI Omnibus changes, the final high-risk classification guidelines, the transparency guidelines and Code of Practice, the delivery of harmonised standards, the practical operation of sandboxes, the AI Office’s supervision of GPAI models, and the accessibility of AI Factories and Gigafactories for European innovators.

By 2028, Europe’s AI model will be clearer. If implementation support works, the EU may combine regulatory legitimacy with industrial adoption. If implementation remains complex and compute remains scarce, Europe risks becoming a rule-maker without sufficient market power in the technologies it regulates. The decisive variable is therefore execution: standards, funding, infrastructure, skills, procurement and applied deployment.

Annex I. Updated EU Legislative and Policy References

Annex II. Source List

This eDossier is based on the earlier eEuropa eBriefing on EU Artificial Intelligence actions, updated with official EU and other reliable sources available up to 20 June 2026. The list below is designed for editorial verification and future updates.

- Original eEuropa eBriefing uploaded by the user: “Artificial Intelligence eBriefing 0225 copia.pdf”, latest update 2 December 2024.

- European Commission, AI Act overview and implementation timeline. https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

- EUR-Lex, Regulation (EU) 2024/1689 - Artificial Intelligence Act. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

- European Commission, European approach to artificial intelligence. https://digital-strategy.ec.europa.eu/en/policies/european-approach-artificial-intelligence

- European Commission, European AI Office. https://digital-strategy.ec.europa.eu/en/policies/ai-office

- European Commission, Guidelines on prohibited AI practices under the AI Act, February 2025. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act

- European Commission, Guidelines on the definition of an AI system, February 2025. https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-ai-system-definition-facilitate-first-ai-acts-rules-application

- European Commission, General-Purpose AI Code of Practice. https://digital-strategy.ec.europa.eu/en/policies/ai-code-practice

- European Commission, contents of the General-Purpose AI Code of Practice. https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai

- European Commission, draft guidelines on classification of high-risk AI systems, May 2026. https://digital-strategy.ec.europa.eu/en/library/draft-commission-guidelines-classification-high-risk-ai-systems

- European Commission, consultation on AI transparency obligations under Article 50, May 2026. https://digital-strategy.ec.europa.eu/en/consultations/consultation-draft-guidelines-transparency-obligations-under-ai-act

- European Commission, Code of Practice on transparency of AI-generated content, June 2026. https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content

- European Commission, Digital Omnibus on AI Regulation Proposal, November 2025. https://digital-strategy.ec.europa.eu/en/library/digital-omnibus-ai-regulation-proposal

- EUR-Lex, COM(2025) 836 - Digital Omnibus on AI proposal. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52025PC0836

- European Commission, Press release on political agreement to simplify AI rules, May 2026. https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1024

- European Commission, AI Continent Action Plan. https://digital-strategy.ec.europa.eu/en/library/ai-continent-action-plan

- European Commission, AI Factories. https://digital-strategy.ec.europa.eu/en/policies/ai-factories

- European Commission, AI Gigafactories. https://commission.europa.eu/topics/competitiveness/competitiveness-coordination-tool-projects/ai-gigafactories_en

- European Commission, Apply AI Strategy. https://digital-strategy.ec.europa.eu/en/policies/apply-ai

- European Commission, European AI in Science Strategy. https://research-and-innovation.ec.europa.eu/strategy/strategy-research-and-innovation/our-digital-future/european-ai-science-strategy_en

- European Commission, Artificial Intelligence in Science. https://research-and-innovation.ec.europa.eu/research-area/industrial-research-and-innovation/artificial-intelligence-ai-science_en

- European Commission, Horizon Europe. https://research-and-innovation.ec.europa.eu/funding/funding-opportunities/funding-programmes-and-open-calls/horizon-europe_en

- European Commission, Horizon Europe Cluster 4 - Digital, Industry and Space. https://research-and-innovation.ec.europa.eu/funding/funding-opportunities/funding-programmes-and-open-calls/horizon-europe/cluster-4-digital-industry-and-space_en

- European Commission, Digital Europe Programme performance. https://commission.europa.eu/strategy-and-policy/eu-budget/performance-and-reporting/programme-performance-statements/digital-europe-programme-performance_en

- EUR-Lex, Regulation (EU) 2023/2854 - Data Act. https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng

- EUR-Lex, Regulation (EU) 2025/327 - European Health Data Space. https://eur-lex.europa.eu/eli/reg/2025/327/oj/eng

- EUR-Lex, Regulation (EU) 2024/2847 - Cyber Resilience Act. https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

- European Commission, NIS2 Directive. https://digital-strategy.ec.europa.eu/en/policies/nis2-directive

- European Parliament Legislative Train, AI Liability Directive withdrawal state of play. https://www.europarl.europa.eu/legislative-train/theme-legal-affairs-juri/file-ai-liability-directive

- EUR-Lex, Directive (EU) 2024/2853 - Product Liability Directive. https://eur-lex.europa.eu/eli/dir/2024/2853/oj/eng

Legal Notice

This eDossier provides a general policy, legislative and strategic overview of European Union actions on artificial intelligence. It is intended for information, research, editorial and business-intelligence purposes. It does not constitute legal advice, technical certification advice, investment advice or an official interpretation of EU law. For compliance decisions, readers should consult the official texts, competent authorities, sectoral regulators and qualified legal or technical advisers.

The document reflects information available up to 20 June 2026. EU AI policy is evolving quickly. Particular attention should be paid to the final adoption and publication status of the Digital Omnibus on AI, Commission implementing and delegated acts, harmonised standards, final guidance on high-risk AI systems, final guidance on transparency obligations, national implementation measures and sector-specific supervisory practice.

Copyright notice: © eEuropa.org / eEuropa Belgium, 2019-2026. All rights reserved. EU institutional source material remains subject to the applicable European Union reuse rules.