Skip to content
Adopted text

Artificial Intelligence Act

TA-9-2023-0236 · P9_TA(2023)0236 · PE731.563

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 26 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the proposed Artificial Intelligence Act sets a risk-based framework: it bans certain AI practices, lays down requirements and obligations for high-risk AI systems and their operators, and sets transparency rules for certain AI systems. It prohibits subliminal manipulation, exploitation of vulnerabilities, social scoring, biometric categorisation, untargeted scraping of facial images, emotion inference in law enforcement, border management, workplace and education, and 'real-time' remote biometric identification in publicly accessible spaces. It classifies as high-risk AI systems used in critical infrastructure, education, employment, essential services, law enforcement, migration, justice and elections, and requires risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity. It creates obligations for providers, deployers, importers and distributors, including a fundamental rights impact assessment for deployers, registration in a public EU database, and a right to explanation and complaint for affected persons. It establishes a European Artificial Intelligence Office, national supervisory authorities, AI regulatory sandboxes, and rules on penalties, with fines up to EUR 40 000 000 or 7% of worldwide annual turnover for prohibited practices.

Key points

  1. Prohibits AI systems that deploy subliminal or manipulative techniques, exploit vulnerabilities, or use biometric categorisation based on sensitive attributes, with exceptions for approved therapeutic purposes with informed consent.
  2. Prohibits social scoring of natural persons or groups, risk assessment for offending or reoffending, untargeted scraping of facial images, and emotion inference in law enforcement, border management, workplace and education.
  3. Prohibits 'real-time' remote biometric identification in publicly accessible spaces, and allows 'post' remote biometric identification only with prior judicial authorisation for a specific serious criminal offence.
  4. Classifies as high-risk AI systems in critical infrastructure, education, employment, essential services, law enforcement, migration, justice and elections, and requires them to meet mandatory requirements before being placed on the market or put into service.
  5. Requires high-risk AI systems to have risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity, and to undergo conformity assessment.
  6. Requires providers to register high-risk AI systems in a public EU database, and requires public authority and gatekeeper deployers to register their use; other deployers may register voluntarily.
  7. Requires deployers of high-risk AI systems to conduct a fundamental rights impact assessment before putting the system into use, and to inform affected persons and provide a right to explanation.
  8. Sets transparency obligations for AI systems interacting with natural persons, emotion recognition and biometric categorisation systems, and deep fakes, requiring disclosure and, for emotion recognition, consent.
  9. Establishes a European Artificial Intelligence Office with legal personality, a management board, a secretariat and an advisory forum, and requires Member States to designate national supervisory authorities.
  10. Requires Member States to establish at least one AI regulatory sandbox at national level, with additional sandboxes possible, and provides for priority access for SMEs and start-ups.
  11. Sets penalties: up to EUR 40 000 000 or 7% of worldwide annual turnover for prohibited practices, up to EUR 20 000 000 or 4% for data and transparency breaches, and up to EUR 10 000 000 or 2% for other breaches.
  12. Requires the Commission to issue standardisation requests within two months of entry into force, to adopt common specifications under certain conditions, and to develop guidelines on implementation.

Who is affected

  • Providers, deployers, importers and distributors of AI systems in the Union, who must comply with obligations and may face fines.
  • Affected persons, who gain rights to information, explanation, complaint and judicial remedy.
  • SMEs and start-ups, which get priority access to sandboxes, reduced conformity assessment fees and protection from unfair contract terms.
  • Member States, which must designate national supervisory authorities and establish AI regulatory sandboxes.
  • Union institutions, offices, bodies and agencies, which are subject to the regulation when acting as provider or deployer.

Figures and deadlines

  • Fines up to EUR 40 000 000 or 7% of total worldwide annual turnover for prohibited AI practices.
  • Fines up to EUR 20 000 000 or 4% for non-compliance with data and transparency requirements.
  • Fines up to EUR 10 000 000 or 2% for other non-compliance.
  • Fines up to EUR 5 000 000 or 1% for supplying incorrect, incomplete or misleading information.
  • Serious incidents must be reported no later than 72 hours after becoming aware.
  • National supervisory authority must take measures within 7 days of receiving a serious incident notification.
  • Joint investigations may be initiated where an infringement affects or is likely to affect at least 45 million individuals in more than one Member State.
  • Certificates issued by notified bodies shall be valid for no more than four years.

Legal basis: Article 114 of the Treaty on the Functioning of the European Union (TFEU) and Article 16 TFEU.