The EU Artificial Intelligence Act (AI Act, Regulation 2024/1689) entered into force on 1 August 2024 and creates a single legal framework across the Union for the development, placing on the market and use of AI. The regulation follows a risk based logic. The greater an AI system’s potential impact on people’s health, safety or fundamental rights, the more specific the requirements for its provider and deployer. Some rules already apply. Since 2 February 2025, the prohibited use restrictions and the AI literacy requirement bind every organisation that provides or uses AI, and since 2 August 2025 the obligations for providers of general purpose AI models (GPAI) apply.
The AI Act does not introduce new technological barriers. It makes mandatory what good risk governance and engineering practice already expects: a documented intended purpose, traceable data provenance, tested performance, workable risk management and a clear allocation of responsibility along the supply chain. An organisation that starts working on compliance before the deadlines arrive can set its own pace and integrate the requirements into its normal product development or deployment cycle. AIRE supports organisations in implementing the AI Act and helps map its requirements onto internal processes.
In Estonia, the competent supervisory authority for the AI Act is the Consumer Protection and Technical Regulatory Authority (TTJA), which coordinates sector specific supervision together with the Data Protection Inspectorate, the State Agency of Medicines, the Transport Administration and the Financial Supervision Authority, depending on the AI system’s field of use. Read more: TTJA – Artificial Intelligence Systems.
Amendments that entered into force on 27 July 2026 (EU Digital Omnibus on AI)
Some application deadlines have been pushed back. Compliance obligations for high risk systems will start applying to systems classified under Annex III from 2 December 2027 (instead of the original 2 August 2026) and to systems classified under Annex I from 2 August 2028 (instead of the original 2 August 2027).
Prohibited practices:
- AI systems that use subliminal, manipulative or deceptive techniques and distort a person’s behaviour in a way that causes or is likely to cause significant harm.
- Systems that exploit a person’s vulnerability due to age, disability, or social and economic situation, influencing their behaviour in a way that causes or is likely to cause significant harm.
- Social scoring of people based on their behaviour or personal characteristics, where this leads to detrimental treatment in a context unrelated to the original purpose of the assessment.
- Assessing the risk of a person committing a criminal offence solely on the basis of profiling or personality traits (so called predictive policing).
- Creating or expanding facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.
- Recognising a person’s emotions at the workplace or in educational institutions (except for medical or safety related purposes).
- Biometric categorisation that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
- Real time remote biometric identification in publicly accessible spaces for law enforcement purposes, except for the narrow exceptions set out in the regulation (for example searching for the victim of a serious crime, preventing an imminent threat to life, or identifying a suspect in a specific serious crime).
Prohibited practices added by the Omnibus (applicable from 2 December 2026):
- Using AI to generate child sexual abuse material (CSAM).
- Using AI to generate non consensual intimate imagery (deepfake pornography).
AI regulatory sandbox
Provisions on the AI regulatory sandbox have also been moved from 2 August 2026 to 2 August 2027, giving Member States more time to launch their national AI Regulatory Sandboxes. Further substantive changes affect the scope of technical documentation (lighter rules for small and medium sized enterprises and startups), the requirements for registration in the EU AI database, the scope of the Fundamental Rights Impact Assessment (FRIA) for public sector deployers, and a clearer allocation of supply chain responsibility for general purpose AI (GPAI) models. The Commission has also gained the right to establish its own AI regulatory sandbox at EU level, together with stronger coordination between Member State sandboxes.
AIRE supports the journey into the AI regulatory sandbox. The service is open for testing the first use cases.
