EU AI Act anchors

Primary texts, operating bodies, harmonized standards bodies, related instruments, named voices, reference resources for the EU AI Act cluster.

Primary text

Regulation (EU) 2024/1689 — the AI Act. Published in OJEU 12 July 2024. Free at eur-lex.europa.eu (search "Regulation 2024/1689").
Recitals — explanatory preamble (180 recitals). Interpretive aid.
Articles — operative provisions (113 articles).
Annexes — Annex I (Union harmonization legislation), Annex II (criminal offences list for biometric exception), Annex III (high-risk AI systems areas), Annex IV (technical documentation), Annex V (EU declaration of conformity), Annex VI / VII (conformity assessment procedures), Annex VIII (information for registration), Annex IX (information for EU database for high-risk AI systems), Annex X (Union acts on large-scale information systems), Annex XI (technical documentation for GPAI), Annex XII (transparency information for GPAI), Annex XIII (criteria for designating GPAI with systemic risk).

European Commission — DG CNECT (Communications Networks, Content and Technology) — primary policy ownership.
European AI Office — within DG CNECT. Operational since late 2024. Oversees GPAI, coordinates harmonized standards, manages Codes of Practice.
AI Board — Member State representatives. Coordinates national implementation.
Scientific Panel — independent experts advising on systemic-risk GPAI designation.
Advisory Forum — stakeholder input (industry, academia, civil society).

CEN-CENELEC — European standardization organizations. EU's standards-development bodies.
CEN-CENELEC JTC 21 — Joint Technical Committee on Artificial Intelligence. EU mirror of ISO/IEC JTC 1/SC 42. Develops harmonized standards for the AI Act.
ETSI — also involved in AI standardization for telecommunications-adjacent areas.
ISO/IEC JTC 1/SC 42 — international standards work. ISO 42001 is the most consequential international standard for AI Act harmonization.

DE has designated multiple authorities reflecting federal structure (subject to update):

Bundesnetzagentur (BNetzA) — market surveillance and various sectoral aspects.
BfDI (Federal Commissioner for Data Protection and Freedom of Information) — privacy aspects.
Sector-specific authorities — BaFin (financial), Bundesamt für Verbraucherschutz und Lebensmittelsicherheit (BVL), Federal Cartel Office, others as applicable.
State-level authorities (Bundesländer) — for sectors under state competence.

Other Member States have varying designation structures; centralized (France: CNIL + sector authorities) vs federated (Germany, Spain) approaches.

For high-risk AI systems requiring third-party conformity assessment:

Designation process ongoing through 2025-2026.
Member States designate Notified Bodies under harmonized procedures.
Bodies need AI-specific competence; many existing Notified Bodies (TÜV Süd, TÜV Rheinland, DEKRA, DNV, BSI, others) adding AI scope.
Limited capacity in 2026; expected to expand through 2027.

GDPR (Reg 2016/679) — data protection. Strong overlap with AI Act on personal data; AI Act does not replace GDPR.
DSA (Reg 2022/2065) — Digital Services Act. Platform regulation; some AI-system implications.
DMA (Reg 2022/1925) — Digital Markets Act. Gatekeeper regulation; AI-system competition implications.
DORA (Reg 2022/2554) — Digital Operational Resilience Act for financial services. ICT systems and AI overlap.
NIS2 Directive (Dir 2022/2555) — cybersecurity for essential and important entities. AI systems used in NIS2-scope entities have cybersecurity overlap.
Cyber Resilience Act (Reg 2024/2847) — digital product cybersecurity. AI-enabled products covered.
Product Liability Directive revision (Dir 2024/2853) — extends product liability to AI systems.
AI Liability Directive (proposed; status uncertain) — civil liability for AI harm. Process slowed; uncertain outcome.

GPAI Code of Practice — published mid-2025. Stakeholder-developed; signing helps GPAI providers demonstrate compliance.
Other Codes of Practice under development for specific obligations.

NIST AI RMF (US) — voluntary; crosswalks to AI Act published.
UK AI Action Plan — pro-innovation; divergence from EU heavy-regulation approach.
Canada AIDA (Artificial Intelligence and Data Act) — proposed; AI Act-influenced.
Brazil AI Bill — under consideration; AI Act-influenced.
California SB 1047 (vetoed Sep 2024) — would have been first major US state AI safety law.
Colorado AI Act (2024) — first US state AI consumer protection law; partial AI Act influence.
China AI regulation — sector-specific (generative AI, recommendation algorithms, deepfakes). Different structure but addresses overlapping concerns.

Margrethe Vestager — former Commissioner, EVP for "Europe Fit for the Digital Age." Drove AI policy through 2019-2024.
Lucilla Sioli — AI Office Director (2024-).
Various Commission staff at DG CNECT.

Lilian Edwards — academic critic and commentator on AI regulation.
Mireille Hildebrandt — academic on AI governance and law.
Charlotte Stix — AI governance researcher.
Various AI ethics researchers at academic institutions and think tanks (Future of Humanity Institute legacy, AI Now, AI Foundation, CFI Cambridge, GovAI Oxford).

Various AI industry voices arguing the AI Act suppresses EU AI competitiveness.
AI safety researchers arguing the AI Act is insufficiently focused on frontier-model existential / catastrophic risks.
Academic voices critiquing AI Act definitional choices.