AI GOVWorld Map
← World Map
Supranational

European Union

Comprehensive, risk-based hard law binding all member states

Reviewed September 24, 2026

Country Overview

The European Union is widely regarded as having one of the world's most comprehensive binding AI laws β€” and in June 2026 it amended that law for the first time since 2024 adoption. The 'Digital Omnibus' simplification package, finalised by the Council on 29 June 2026, pushed back several major compliance deadlines in response to industry competitiveness concerns, while adding a new prohibition on AI-generated non-consensual intimate imagery and CSAM.

The Commission is simultaneously pursuing compute sovereignty through the Cloud and AI Development Act, proposed in June 2026 and published in the Official Journal in July 2026, which aims to reduce the EU's dependence on non-EU hyperscalers for AI infrastructure.

A further enforcement milestone arrived on 2 August 2026, when the Commission's general-purpose AI (GPAI) supervision and enforcement powers took effect β€” the power to request documentation, run evaluations, demand mitigations, and fine GPAI providers up to €15M or 3% of global turnover β€” alongside the AI Act's Article 50 transparency duties (chatbot disclosure, AI-content marking and deepfake labelling). This is widely read as the point at which the AI Act's frontier-model provisions acquired real teeth, even as the higher-risk Annex III obligations remain delayed to 2027-2028.

At a Glance

Overall AI policy direction

Comprehensive law, timelines now loosening

7

Major AI companies

4

Research institutions

4

Live debates

Latest development
September 16, 2026
Regulatory approach
Risk-tiered hard law, binding across all member states
Major AI companies
Mistral AI, Aleph Alpha, DeepL +4 more
Major cloud providers
AWS, Microsoft Azure, Google Cloud +4 more
Leading research institutions
ELLIS (European Laboratory for Learning and Intelligent Systems), Max Planck Institute for Intelligent Systems, DFKI (German Research Center for Artificial Intelligence) +1 more
Key ministries
European Commission, European AI Office, Council of the European Union
Government involvement
Very high β€” binding supranational law in force across all 27 member states, though national enforcement readiness reportedly varies
Industrial strategy
Compute sovereignty via CADA and 'AI Gigafactories'; simplification to aid competitiveness
International partnerships
Participates in the G7 Hiroshima Process; the AI Act is frequently cited internationally as a reference point in AI regulatory debates
Primary policy focus
Balancing AI Act enforcement with industrial competitiveness and compute sovereignty

Current Direction

Stable

The AI Act's core structure is unchanged, but June 2026's Digital Omnibus postponed several major compliance deadlines in response to competitiveness pressure β€” a real softening of pace even as the Commission simultaneously pushes forward on compute sovereignty via the newly enacted Cloud and AI Development Act.

Recent Developments

10 this cycle
  • The European Commission welcomed the design of the first Important Project of Common European Interest (IPCEI) in AI, backed by 19 member states and coordinated by Germany, spanning the entire AI stack from compute-management technologies to industrial applications. Of the 19, eleven that will grant state aid said they would begin pre-notifying their projects to the Commission in September 2026, after which the Commission will assess them against IPCEI eligibility criteria. It is an industrial-strategy counterpart to the AI Act's regulatory track, aimed at European compute sovereignty and moving the AI value chain from R&D through to adoption.

    2026-09-16
  • In the first week of live enforcement, the Commission's AI Office has reportedly engaged OpenAI and Anthropic over the late-July agentic-hacking incidents in which the labs' own models breached real external systems during cyber-evaluations. Reporting says senior Commission officials travelled to San Francisco and that Anthropic agreed to give the EU cybersecurity agency ENISA access to its 'Mythos' cyber model, while OpenAI offered the EU access to its 'GPT-5.5-Cyber' model; the specific model-access arrangements are as reported and not yet officially confirmed.

  • The Commission published a first list of more than 180 organisations that have signed the General-Purpose AI Code of Practice β€” including Anthropic, Google, Microsoft, OpenAI, Amazon, IBM, Mistral and Cohere β€” with signatories told the AI Office will treat adherence to the Code as a mitigating factor when setting any fines, effectively earning enforcement deference in the newly live GPAI regime.

  • The AI Act's general-purpose AI (GPAI) supervision and enforcement powers take effect: the Commission's AI Office can now request documentation, run evaluations, demand mitigations or recall, and fine GPAI providers up to €15M or 3% of global turnover (Art. 101). Article 50 transparency duties β€” chatbot disclosure, machine-readable marking of AI-generated content, and deepfake labelling β€” become enforceable the same day, with systems already on the market given until 2 December 2026 to comply with the watermarking requirement. High-risk (Annex III) obligations remain delayed to 2027-2028 following the Digital Omnibus.

    Major
  • European Commission launches a new Action Plan on Cybersecurity and AI, addressing risks and opportunities at the intersection of the two; the Cloud and AI Development Act was published in the Official Journal on 15 July 2026.

    2026-07-07
  • National regulatory sandbox mandate postponed to 2 August 2027.

    2026-06-29
  • Digital Omnibus reportedly softens the synthetic-content labelling duty: Article 50 transparency obligations remain enforceable from 2 August 2026, with sources describing a grace period to 2 December 2026 for systems already placed on the market before that date; the exact scope of this change is not yet fully verified.

    2026-06-29
  • Digital Omnibus adds a new prohibition on AI-generated non-consensual intimate imagery and CSAM, effective 2 December 2026.

    2026-06-29
  • Council gives final approval to the Digital Omnibus, postponing high-risk AI system compliance deadlines to 2 December 2027 (standalone systems) and 2 August 2028 (embedded systems).

    Major
    2026-06-29
  • Cloud and AI Development Act (CADA) proposed, setting four-tier cloud/AI sovereignty assurance levels and a procurement preference for EU providers, aiming to triple EU data-centre capacity within 5-7 years; the Commission separately projects EU data-centre capacity needs will be fully met by 2035 absent intervention.

    2026-06-03

Policy and Regulation

4 tracked

AI Act (Regulation (EU) 2024/1689), as amended by the Digital Omnibus

In force

In force since August 2024; June 2026's Digital Omnibus is the first amendment, postponing most high-risk system obligations to December 2027 / August 2028 while adding a new prohibition on AI-generated intimate imagery and CSAM (effective December 2026). From 2 August 2026 the AI Office's GPAI supervision and enforcement powers apply β€” including fines of up to €15M or 3% of global turnover β€” as do the Article 50 transparency duties.

Official text β†—

Cloud and AI Development Act (CADA)

Passed

Proposed 3 June 2026 and published in the Official Journal on 15 July 2026. Establishes four-tier cloud/AI sovereignty assurance levels and procurement preferences for EU providers. The Commission's stated aim is to triple EU data-centre capacity within roughly 5-7 years, separately from its 2035 projection of when EU data-centre capacity needs would be fully met absent intervention.

Official text β†—

AI Liability Directive (withdrawn)

Repealed

A proposed directive intended to make it easier for individuals harmed by AI systems to bring civil-liability claims. The Commission announced its withdrawal in the 2025 Work Programme (February 2025), confirmed the withdrawal publicly in mid-2025, and formally withdrew the proposal in October 2025 after failing to reach Council/Parliament consensus. As of mid-2026 no replacement proposal has been announced, leaving AI-specific civil liability governed by fragmented national tort law.

AI Liability Directive

Repealed

Would have harmonised civil-liability rules for AI-caused harm across the EU; withdrawn by the European Commission in 2025 with no replacement proposal announced as of mid-2026. Liability claims currently fall to fragmented national tort law.

SourceIAPP

Research Ecosystem

EU AI research is coordinated through pan-European networks like ELLIS rather than a single national champion, reflecting the bloc's fragmented-but-collaborative research base. The Joint Research Centre's AI Watch continues as the Commission's own monitoring effort, tracking uptake and capability trends across all 27 member states.

Major AI Companies

7

Cloud Infrastructure

Frontier AI
Domestic frontier developer
Compute
Building 'AI Gigafactories' and pursuing sovereignty via CADA, but capacity still trails the US and China
Chip access
Import-reliant for AI accelerators (NVIDIA-dominated); key leverage is ASML's EUV lithography, not chip design or fabrication

AWS

One of the largest cloud providers for EU enterprise AI workloads, along with Azure and Google Cloud together holding roughly 70% of the EU cloud market per Synergy Research; now subject to CADA's sovereignty assurance tiers.

Microsoft Azure

Major cloud provider, closely tied to OpenAI's EU deployment.

Google Cloud

Major hyperscaler with a growing EU footprint, including an existing Hanau, Germany campus, new regions coming online in Vienna, Athens, Oslo and Stockholm, and a reported EUR5.5bn Germany investment through 2029.

OVHcloud

French cloud provider positioned as a 'digital sovereignty' alternative to US hyperscalers; one of several EU-headquartered providers that collectively hold a modest single-digit share of the overall EU cloud market.

Deutsche Telekom

German telecom operator and co-leading indigenous EU cloud provider, operating what it describes as one of Europe's largest sovereign AI infrastructure offerings (Industrial AI Cloud).

SAP

German enterprise software company and co-leading indigenous EU cloud provider by market share, per Synergy Research Group.

Scaleway

French sovereign cloud provider selected, alongside OVHcloud, StackIT and Proximus, in the European Commission's EUR180m sovereign-cloud procurement tender (April 2026).

Notable Gaps

2
  • Dedicated AI safety institute

    The EU has no supranational equivalent to the UK's AI Security Institute or the US CAISI. The European AI Office performs a broader regulatory-enforcement role rather than dedicated third-party safety testing of frontier models.

  • Semiconductor and chip sovereignty

    AI accelerator chips used in the EU remain dominated by non-European suppliers (notably NVIDIA). The EU's most significant countervailing asset β€” ASML's position in EUV lithography β€” is not a chip designer/fabricator itself and does not offset the bloc's dependence on foreign AI accelerators.

Key People

4
European Commission→
European AI Office→
Mistral AI→
ELLIS→
CEPS

People and Organisations to Follow

4

Current Debates

4 live
Government

Digital Omnibus β€” simplification or weakening of the AI Act?

The first amendment to the AI Act since 2024 postpones major compliance deadlines by up to two years β€” industry calls it necessary relief, civil society calls it the start of erosion.

β–Ύ

Facing competitiveness pressure, the Commission proposed a simplification package that pushed high-risk system obligations back to December 2027 (standalone) and August 2028 (embedded), and delayed the sandbox mandate and synthetic-content labelling duty. Industry groups argued the AI Act's compliance burden, stacked alongside GDPR and the Digital Services Act, was slowing EU AI deployment relative to the US and China. Digital-rights groups see the Omnibus as a precedent for further softening, even though it also added a new prohibition on AI-generated intimate imagery and CSAM.

Infrastructure

Cloud and AI Development Act and compute sovereignty

CADA, proposed in June 2026 and published in the Official Journal in July 2026, sets sovereignty tiers for cloud and AI infrastructure and targets tripling EU data-centre capacity within roughly 5-7 years.

β–Ύ

Proposed 3 June 2026 and published in the Official Journal on 15 July 2026, CADA classifies cloud and AI infrastructure providers into four sovereignty assurance tiers and gives procurement preference to EU-based providers for sensitive public-sector workloads. Some analysts note that the underlying chips (an area where NVIDIA holds a large share of the AI-accelerator market, though the EU retains leverage via ASML's lithography position) and much of the software stack remain largely non-European regardless of where the data centres sit or who owns them.

Industry

Copyright and text-and-data-mining under the AI Act

GPAI transparency duties require disclosure of training content, colliding with unresolved EU copyright and text-and-data-mining rules.

β–Ύ

The AI Act requires general-purpose AI providers to publish a sufficiently detailed summary of training content and to respect rights holders' opt-outs under the DSM Copyright Directive's TDM exception. Rights holders argue enforcement has been weak in practice; AI developers argue the transparency bar is workable but resource-intensive, especially for smaller EU labs competing with better-resourced US rivals.

Government

AI Act enforcement readiness across member states

With deadlines now pushed to 2027-2028, questions remain about whether national competent authorities across all 27 member states will actually be ready to enforce by then.

β–Ύ

Even before the Digital Omnibus delay, several member states had been slow to designate and resource the national authorities responsible for AI Act enforcement. The extended timeline buys more preparation time, but also raises the question of whether the delay reflects genuine implementation need or is itself a symptom of enforcement capacity concerns.

SourceCEPS

Knowledge Hub

8 curated

Academic papers

Think tank reports

Substacks

  • Digital Briefβ€” Euractiv

    Daily EU tech and digital policy newsletter.

  • Threading the Needleβ€” Anton Leicht

    Political economy of AI, with a strong focus on EU AI Act implementation; Leicht is a Carnegie Endowment Fellow with prior Bundestag policy-advisory experience.

Podcasts

Sources

20 cited

Deliberately sourced beyond government publications. The bars below show each category’s actual share of this page’s citations β€” an internal editorial guideline rather than a rigorously derived target, so treat it as a rough steer, not a precise benchmark.

Government 35%Research 15%Think tanks 10%Industry 5%News 30%Expert commentary 5%
  1. Council gives final green light to simplify AI rulesGovernmentCouncil of the EU2026-06-29
  2. Cloud and AI Development ActGovernmentEuropean Commission2026-06-03
  3. AI Liability Directive proposal (original, 2022; withdrawn 2025)GovernmentEuropean Commission2022-09
  4. AI WatchResearchJoint Research Centre2026
  5. EU agrees Digital Omnibus deal to simplify AI rulesThink tanksWhite & Case2026-06
  6. AI Act enforcement readiness analysisThink tanksCEPS2026
  7. ELLIS network research briefingsResearchELLIS2026
  8. Mistral AI policy blogIndustryMistral AI2026
  9. Reuters coverage of EU AI Act implementationNewsReuters2026
  10. Kai Zenner policy commentaryExpert commentaryKai Zenner2026
  11. New EU plan to address risks and opportunities of advanced AI and cybersecurityGovernmentEuropean Commission2026-07-07
  12. European Commission withdraws AI Liability Directive from considerationNewsIAPP2025-10
  13. Cohere to acquire Aleph Alpha in ~$20bn sovereign-AI dealNewsCNBC2026-04-25
  14. European cloud providers' local market share now holds steady at 15%ResearchSynergy Research Group2026
  15. European Commission withdraws AI Liability Directive from considerationNewsIAPP2025-10
  16. Transparency obligations under Article 50 of the AI ActGovernmentEuropean Commission β€” Shaping Europe's digital future2026-08
  17. EU AI Act Enforcement Is Here: Chatbot Rules Live, High-Risk AI Delay Now Binding LawNewsTech Times2026-07
  18. Commission starts enforcing AI Act rules and new transparency requirements on 2 AugustGovernmentEuropean Commission β€” Shaping Europe's digital future2026-08
  19. Why did OpenAI's and Anthropic's AI models hack other companies?NewsNPR2026-08
  20. Commission welcomes the design of first Important Project of Common European Interest in AIGovernmentEuropean Commission2026-09-16