Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (the EU AI Act) is the European Union's first comprehensive legal framework for artificial intelligence (AI). It establishes harmonised rules for the development, placing on the market, putting into service and use of AI systems, while promoting innovation and ensuring the protection of fundamental rights, health, safety and democracy, as well as fostering the development and uptake of trustworthy artificial intelligence.
The Regulation entered into force on 1 August 2024 and applies progressively, with different groups of obligations becoming applicable between 2025 and 2030.
Its primary objective is to establish a balanced regulatory framework that fosters innovation while ensuring safety, transparency, the protection of fundamental rights and the effective management of risks associated with artificial intelligence.
 
Scope of the Regulation
Regulation (EU) 2024/1689 has a broad territorial scope. It applies to organisations established within the European Union and, under the conditions laid down in the Regulation, to certain organisations established outside the EU where the output produced by an AI system is used within the European Union.
The Regulation applies to:

• providers of AI systems — organisations that develop an AI system or have an AI system developed and place it on the market or put it into service under their own name or trademark;
• deployers — organisations that use AI systems in the course of their activities;
• importers and distributors;
• authorised representatives of providers established outside the EU; and
• organisations established outside the EU where the output produced by an AI system is used within the European Union.

The applicable obligations depend on the organisation's role under the Regulation, the type of AI system concerned and its level of risk.

Risk-Based Approach
The Regulation establishes a risk-based framework for AI systems.
1. Prohibited AI Practices (Unacceptable Risk)
The Regulation prohibits certain AI practices that present an unacceptable risk to fundamental rights and safety.
These include, among others:

• AI systems used for social scoring, where falling within the scope of the prohibition;
• certain manipulative or deceptive techniques, or techniques exploiting vulnerabilities of individuals, where they are likely to materially distort behaviour;
• certain biometric categorisation systems based on sensitive characteristics;
• emotion recognition systems used in workplaces and educational institutions, except where expressly permitted;
• certain AI systems used for predictive policing based solely on profiling or personality traits; and
• the creation of facial recognition databases through the untargeted scraping of facial images from the internet or CCTV footage.

The provisions relating to prohibited AI practices became applicable on 2 February 2025.
2. High-Risk AI Systems
High-risk AI systems are the primary focus of the regulatory requirements under the EU AI Act. They include AI systems referred to in Article 6 and listed in Annex III, as well as AI safety components of products covered by the EU harmonisation legislation listed in Annex I.
Typical high-risk areas include:

• biometrics;
• critical infrastructure;
• education and vocational training;
• employment and workers management;
• access to essential public and private services;
• law enforcement;
• migration, asylum and border control;
• administration of justice; and
• democratic processes.

High-risk AI systems are subject to requirements relating to:

• risk management;
• data governance and data quality;
• technical documentation;
• record-keeping and traceability;
• transparency and provision of information;
• human oversight;
• accuracy, robustness and cybersecurity;
• conformity assessment; and
• registration in the EU database, where applicable.

3. AI Systems Subject to Transparency Obligations
Certain AI systems are subject to transparency obligations under Article 50 of the Regulation.
These include, among others:

• informing natural persons when they are interacting with an AI system; and
• labelling AI-generated or AI-manipulated content, including deepfakes, where required.

4. Minimal-Risk AI Systems
The Regulation does not impose specific mandatory requirements on AI systems presenting minimal risk. Instead, it encourages the voluntary adoption of codes of conduct and good AI governance practices.
General-Purpose AI (GPAI) Models
Chapter V of the Regulation establishes specific obligations for providers of General-Purpose AI (GPAI) models.
Providers of GPAI models are required to:

• prepare technical documentation;
• provide information and documentation to providers integrating the model into AI systems;
• comply with applicable copyright obligations; and
• publish a sufficiently detailed summary of the content used for training the model.

Providers of GPAI models presenting systemic risk are subject to additional obligations, including:

• risk assessment and mitigation;
• model evaluation;
• incident reporting; and
• implementation of appropriate cybersecurity measures.

Implementation Timeline
The Regulation applies progressively.

 
Penalties
The EU AI Act provides for significant administrative fines for infringements of the Regulation.
The maximum fines are:

• up to EUR 35 million or 7% of the total worldwide annual turnover, whichever is higher, for infringements relating to prohibited AI practices;
• up to EUR 15 million or 3% of the total worldwide annual turnover, whichever is higher, for infringements of other obligations under the Regulation; and
• up to EUR 7.5 million or 1% of the total worldwide annual turnover, whichever is higher, for supplying incorrect, incomplete or misleading information to competent authorities.

Specific provisions apply to the calculation of administrative fines for small and medium-sized enterprises (SMEs).
 
Practical Implications for Organisations
In Bulgaria, the national institutional framework for implementing the Regulation is currently being established, including the designation of competent authorities and coordination mechanisms.
As an EU Regulation, the AI Act is directly applicable in all Member States and does not require transposition into national legislation.
In practice, every organisation—whether it develops, places on the market or uses AI systems in its business operations—should assess:

• which AI systems are used within the organisation;
• the business processes in which they are deployed;
• the organisation's role under the Regulation (provider, deployer, importer or distributor);
• whether any AI systems qualify as high-risk; and
• which contractual, technical and organisational measures should be implemented in relation to AI providers and other relevant business partners.

 
Recommended Preparation Steps
Organisations should:

• establish an inventory of AI systems used within the organisation;
• determine their role under the Regulation;
• assess whether any AI systems fall within the high-risk category;
• establish internal AI governance policies and provide AI literacy training;
• review contracts with AI providers and other relevant suppliers; and
• prepare documentation demonstrating traceability, accountability and regulatory compliance.

For organisations operating management systems certified or aligned with ISO 9001, ISO/IEC 27001 or ISO/IEC 27701, many AI Act requirements can be integrated into existing quality, information security, privacy and risk management processes.
In particular, ISO/IEC 42001 (Artificial Intelligence Management System – AIMS) provides a structured governance framework that supports organisations in establishing AI management processes and demonstrating conformity with the requirements of Regulation (EU) 2024/1689.
 
Relationship with International Standards
The EU AI Act does not require mandatory certification against international standards.
However, standards such as:

• ISO/IEC 42001 — Artificial Intelligence Management System;
• ISO/IEC 27001 — Information Security Management System;
• ISO/IEC 27701 — Privacy Information Management System; and
• ISO 9001 — Quality Management System,

can assist organisations in establishing a structured approach to AI governance, risk management, internal controls, documentation and operational processes.
Compliance with international standards does not replace the legal obligations established by Regulation (EU) 2024/1689. Nevertheless, it can form an important element of an organisation's overall AI governance and compliance framework.
 

Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence