AI Regulation News

MARCH

EU AI ActGPAIAI Act

EU AI Act: General-Purpose AI (GPAI) Code of Practice — First Draft Published

EU AI Office

FEBRUARY

EU AI ActProhibited AIAI Act

Prohibited AI Practices Under EU AI Act Enter into Force

EUR-Lex / European Commission

JANUARY

European Banking Authority (EBA)

DORADORAFinance

DORA Fully Applicable: Financial Sector AI Risk Management Obligations Active

The Digital Operational Resilience Act (DORA) became fully applicable on 17 January 2025. Financial institutions must now demonstrate ICT and AI risk management, third-party oversight, and resilience testing compliance.

DECEMBER

CybersecurityCRACybersecurity

Cyber Resilience Act Published in EU Official Journal

The Cyber Resilience Act (CRA) was published in the Official Journal of the EU. Products with digital elements, including AI-enabled hardware and software, must meet mandatory cybersecurity requirements by December 2027.

NOVEMBER

AI StandardsISO 42001Certification

ISO/IEC 42001 Adoption Accelerates Across EU — Certification Bodies Active

Multiple European accreditation bodies have begun certifying organisations against ISO/IEC 42001 (AI Management System). The standard is increasingly referenced in EU AI Act compliance strategies and procurement requirements.

ISO / European Accreditation (EA)

OCTOBER

EU AI ActAI OfficeGovernance

EU AI Office Established — First Operational Activities Begin

The EU AI Office, established under the European Commission, began its first operational activities including oversight of GPAI models, development of codes of practice, and coordination with national authorities.

European Commission

SEPTEMBER

AutomotiveUNECEAutomotive

UNECE WP.29 Adopts New Guidelines for AI in Automated Driving

UNECE Working Party 29 adopted new guidelines addressing AI validation, testing, and documentation requirements for automated driving systems, complementing existing R155/R156 regulations.

UNECE

AUGUST

EU AI ActAI ActEntry into Force

EU AI Act Enters into Force — Official Journal Publication

Regulation (EU) 2024/1689 — the EU AI Act — entered into force on 1 August 2024 following publication in the Official Journal. The phased application timeline begins, with full application by August 2027.

MARCH

Healthcare AIEHDSHealthcare

EU Health Data Space Regulation Enters into Force

Regulation (EU) 2025/327 establishing the European Health Data Space entered into force, enabling secondary use of health data for AI research and training under strict governance frameworks.

FEBRUARY

AI StrategyAI StrategyInvestment

European Commission Launches AI Continent Action Plan

The European Commission launched the AI Continent Action Plan, a comprehensive strategy to position Europe as a global AI leader through investment in AI factories, data infrastructure, and talent development.

European Commission

JANUARY

ENISAENISACybersecurity

ENISA Publishes AI Cybersecurity Guidance for High-Risk AI Systems

ENISA published comprehensive cybersecurity guidance for high-risk AI systems under the EU AI Act, covering threat modelling, security testing, and incident response requirements for AI providers.

ENISA

DECEMBER

Product LiabilityProduct LiabilityAI Liability

Revised Product Liability Directive Published — AI Products Covered

Directive (EU) 2024/2853 modernising product liability rules was published, explicitly covering AI systems and software. AI product manufacturers can now be held liable for damages caused by defective AI.