EU Artificial Intelligence Act: what changes from August 2026 and how it affects users and companies

The European Artificial Intelligence Regulation (AI Act) was approved through the ordinary legislative procedure, which involved an initial proposal from the Commission, parallel negotiations in the Council and the European Parliament, and finally trilogues to finalize a common text. The original proposal was COM(2021) 206 final, presented in April 2021, and the political agreement between co-legislators was reached in December 2023. The Parliament gave its approval in March 2024 and the Council granted final approval in May 2024, before publication in the Official Journal and entry into force at the end of July/beginning of August 2024. Below are the main procedures and stages in the Council and Parliament.

1. Commission Initiative: COM(2021) 206 final

The process started on April 21, 2021, when the European Commission approved the proposal for Regulation COM(2021) 206 final, which establishes harmonized rules on AI and amends various sectoral legislation. The proposal can be consulted in the official Eur-Lex reference of the COM(2021) 206 proposal. With this adoption, the ordinary legislative procedure under Article 294 TFEU was formally opened.

2. Processing in the Council of the EU

2.1 Work in working groups and technical guidelines

Since 2021, the proposal has been discussed in the Council's working groups (telecommunications, internal market, etc.), where Member States have been shaping positions on the definition of AI, list of prohibited systems, high-risk regime, governance (AI Office), and sanctions. This phase culminated with the adoption of a general approach.

2.2 Council "General approach"

In December 2022, the Council adopted its general approach, which sets the negotiation position vis-à-vis the Parliament. The agreed text is in the Council's position document available in the general approach. From that moment, the Council was mandated to enter trilogues.

2.3 Final approval by the Council

After the political agreement in December 2023, the Council formally adopted the Regulation in May 2024. The press release collected by the Spanish Administration titled “The Council gives final green light to the first global AI rules” summarizes that the Council approved on May 20 a “landmark” risk-based law, and details the schedule for entry into force and phased application (note on the Council's green light). The Council itself describes the act as the first global AI rules in its official statement.

3. Processing in the European Parliament

3.1 Registration and committee work

In the Eurochamber, the file is registered as 2021/0106(COD), with a record accessible in the procedure 2021/0106(COD). The IMCO (Internal Market) and LIBE (Civil Liberties) committees took on the joint rapporteurship, receiving thousands of amendments and negotiating compromise texts on sensitive points: biometric identification, high-risk systems, generative AI, fundamental rights, and governance.

3.2 Negotiation mandate and trilogues

Once the report was approved in IMCO/LIBE (May 2023), Parliament granted a mandate to negotiate with the Council. Several trilogues were held thereafter, culminating in the provisional political agreement of December 2023, under the Spanish Presidency of the Council. According to the Council's summary, the provisional agreement between co-legislators was reached on December 8, 2023, marking the political closure of the negotiation (Council reference).

3.3 Vote in the Eurochamber Plenary

On March 13, 2024, the European Parliament Plenary approved the Artificial Intelligence Act. The institutional chronicle “The Eurochamber approves a historic law to regulate artificial intelligence” indicates that the Regulation, the result of the December 2023 negotiations, was supported with 523 votes in favor, 46 against, and 49 abstentions (note on the Parliament vote). The approved legal text can be consulted in the Parliament decision.

4. Publication, entry into force, and subsequent stages

After signature by the Presidents of Parliament and Council, the Regulation was published in the OJ EU as Regulation (EU) 2024/1689, with the text accessible on Eur-Lex (Regulation (EU) 2024/1689). It enters into force 20 days after publication, and its application is phased: prohibitions of unacceptable risk practices apply after six months, rules for general-purpose AI models after 12 months, and full high-risk obligations after 24–36 months, as detailed in the Parliament's note (historic AI law).

The Commission summarizes this phase in its press release “The European Artificial Intelligence Act enters into force” (Commission note), and the Spanish Government frames the Regulation within its national AI strategy in the note “What is the 2024 Artificial Intelligence Strategy?” (AI Strategy 2024). From Spain, the newspaper Demócrata has also analyzed the entry into force and political significance of the new framework in articles such as “The entry into force of the new AI Regulation”, “Europe faces a new step to regulate artificial intelligence”, and “Europe wants to become an AI continent”, highlighting the Regulation's role as a central piece of the EU's new digital regulatory architecture.

The European Artificial Intelligence Office (AI Office) is the Commission body responsible for applying and enforcing much of the European Artificial Intelligence Act (AI Act), with direct competencies over general-purpose models and a coordinating role vis-à-vis Member States. Its legal basis combines the AI Regulation itself and a specific Commission decision that creates the Office and assigns it functions. Besides supervision and sanctioning, it acts as a public policy center, technical support, scientific coordination, and promoter of trustworthy AI innovation in the EU.

Legal basis and institutional position

According to the official note on the AI innovation package, the Commission adopts a decision to create an AI office within the institution itself, with the mandate to “ensure the development and coordination of AI policy at the European level and oversee the application and compliance of the future AI Act” (AI innovation package).

When the European AI Regulation enters into force, the Commission specifies that the Artificial Intelligence Office will be the main enforcement body of the AI Act at the EU level and the authority responsible for enforcing rules on general-purpose AI models (AI Act entry into force). The Office is integrated within the Commission but acts as the central point of the Regulation's governance system, alongside the European AI Board and other advisory bodies.

Regulatory and supervisory functions

Strictly regulatory competencies attributed to the Office by legislation and Commission decisions can be grouped into several blocks:

• Enforcement of the AI Act at the EU level: it is the “main enforcement body” of the Regulation, especially regarding general-purpose models (GPAI), and “will directly enforce the rules for general-purpose AI models” (creation of the AI Office and entry into force).
• Supervision and coordination with national authorities: it must “ensure coherent implementation of the AI Act by supporting Member States' governance bodies” and closely cooperate with the European AI Board, which groups national authorities (creation of the AI Office).
• Information and sanction powers: the Office can “request information and impose sanctions, when necessary” regarding general-purpose models that breach the rules (creation of the AI Office). The maximum sanction regime (up to 7% of global turnover in the most serious cases) is set in the Regulation, which the Office helps to enforce.
• Development of guidelines and codes of conduct: it prepares “guidelines on the definition of AI systems and on prohibitions” and coordinates the development of “codes of practice for obligations related to general-purpose AI models” within the deadlines set by the Regulation (creation of the AI Office).

Technical, scientific, and innovation support role

Beyond sanctioning, the Office has a broad mandate to provide technical support and foster a European trustworthy AI ecosystem:

• Technical model assessment: it coordinates and conducts “testing and evaluation of general-purpose AI models” in cooperation with developers, the scientific community, and other stakeholders (creation of the AI Office).
• Network of experts and advisory bodies: it works with the European AI Board, an independent Scientific Panel of experts, and an Advisory Forum integrating industry, SMEs, academia, and civil society, to ensure regulatory decisions are based on scientific evidence and sectoral expertise (creation of the AI Office and entry into force).
• Promotion of an innovative ecosystem: it “will promote an innovative ecosystem in the EU for trustworthy AI,” providing advice on best practices and facilitating access to AI testing environments, real-world testing, and other European support structures such as experimentation facilities and European Digital Innovation Hubs (creation of the AI Office).
• Support for research and specific initiatives: it supports R&D activities in AI and robotics and launches initiatives like GenAI4EU so that generative models developed and trained in Europe are applied in key economic sectors (creation of the AI Office and AI innovation package).

Strategic and international dimension

Finally, legislation and Commission communications assign the Office a strategic and international function:

• Coordination of European AI policy: it must become the “central coordinating body for AI policy at the EU level” and develop knowledge and understanding about AI to guide regulatory action and foster adoption (AI innovation package).
• International projection: the Office has an “international vocation” and must ensure “a strategic, coherent, and effective European approach to AI at the international level, becoming a global reference point” (creation of the AI Office and AI innovation package).

In summary, the European Artificial Intelligence Office combines powers of supervision and sanction, coordination with Member States, production of guidelines and codes, and scientific and innovative support, functioning as the core of the European AI governance model established by the AI Act.

Companies that already have AI systems on the market in Spain and the EU must, by summer 2026, classify them according to the European AI Regulation (AI Act), conduct a risk and compliance gap analysis, and begin adapting technical documentation, data governance, human oversight, and internal processes. Prohibited AI systems must be withdrawn or redesigned before the prohibition regime is fully applicable; high-risk systems must progressively align with quality, traceability, risk management, and conformity assessment requirements, although many full technical obligations extend beyond August 2026. Spain relies on the Spanish Artificial Intelligence Supervisory Agency (AESIA) and the controlled testing environment to facilitate this transition. Below is a summary of key elements companies should have in place before August 2, 2026.

1. System classification and strategic decision

The first step is to inventory all marketed AI systems and classify them into four main categories:

• Prohibited AI: uses such as severe subliminal manipulation or social scoring. They must cease marketing when the prohibition enters into force (before 2026), or be redesigned to exit that category.
• High-risk AI: for example, systems affecting employment, education, essential services, or critical infrastructure. These are the main focus of technical obligations.
• Limited-risk AI: systems requiring enhanced transparency (notices that one is interacting with AI, synthetic content labeling, etc.).
• General-purpose AI / foundational models: large models reusable in multiple products.

Before August 2026, the company should have a clear decision for each system: continue and adapt, withdraw from the market, or replace it.

2. Technical requirements for already marketed systems

Although the AI Act introduces staggered schedules, high-risk systems already on the market will have a transitional regime: they may continue operating but must progressively comply with key safety and governance requirements. In practice, before August 2, 2026, it is advisable to have advanced:

• Risk management system: identification of risks to fundamental rights, health, and safety, mitigation measures, and periodic review.
• Data governance: traceability of training, validation, and test datasets; bias control; documentation of data provenance and quality.
• Human oversight: definition of who can intervene, deactivate, or review automated decisions, and under what procedures.
• Robustness and cybersecurity: documented tests, response plans for failures and attacks, known usage limits.
• Technical documentation: a “technical file” of the system that allows authorities such as AESIA and, where applicable, notified bodies, to understand its design, data, tests, and controls.

3. Organizational and compliance procedures

Besides the technical part, companies must organize internally for compliance:

• Internal AI governance: policies approved by management, clear roles (AI compliance, DPO, security), and an approval circuit for new deployments.
• Conformity assessment: for high-risk AI, preparation for self-assessments or, when applicable, third-party assessments, in line with the experience of the Spanish “sandbox” regulated by Royal Decree 817/2023.
• Post-market surveillance: system to collect incidents, complaints, adverse outcomes, and improve the model.
• Incident notification: procedures to report serious incidents or systematic failures to authorities when required by the AI Act.
• Registration: prepare for the eventual registration of high-risk systems in the corresponding European databases.

4. Spain's role: AESIA and controlled environment

In Spain, Royal Decree 729/2023 approves the Statute of the Spanish Artificial Intelligence Supervisory Agency, which will be the national authority responsible for supervising the application of the AI Act. Spanish legislation configures it as a central piece of the supervisory ecosystem and as a contact point with the EU.

Complementarily, the high-risk AI testing environment regulated in Royal Decree 817/2023 allows companies to test compliance with the future Regulation's requirements in a controlled framework, with guidance and support. Participating in this sandbox can be a practical tool to adapt systems already marketed before the European deadlines.

5. Other pieces of the Spanish regulatory ecosystem

Alongside these structural rules, the BOE includes complementary measures that, although they do not directly regulate the AI Act's transitional regime, show the construction of the Spanish AI framework: sectoral aid (Order TDF/1494/2024, Order TDF/304/2025), advisory bodies (International AI Advisory Council), and the deployment of AESIA itself (Order TDF/774/2025, Resolution of August 25, 2025, constitution of the contracting board). In the judicial field, the General Council of the Judiciary has approved a specific instruction on the use of AI in courts (Instruction 2/2026).

Many other BOE resolutions reflect the expansion of AI training in universities and the integration of digital skills (Royal Decree 532/2025, Royal Decree 546/2023, and various curricula such as those of the University of Santiago de Compostela, CUNEF, University of Navarra, or the University of La Rioja, among many others).

All this configures an environment in which, by August 2026, companies with AI systems already marketed will have to combine the technical adaptation required by the AI Act with increasing interaction with AESIA and, when appropriate, with the regulatory testing programs available in Spain.