One year ago, on Aug. 1, 2024, the implementation of the AI regulation began. After years of negotiations, a knot was finally tied and the first international law regulating AI was introduced in stages, spread over two years. In this article, we look back at what has happened since then and look ahead to what awaits us in the coming period.
In November 2024, the intended regulators announced. In the Netherlands, the designated supervisors are: the Human Rights Board for the supervision of the protection of fundamental rights and the Personal Data Authority for the supervision of data protection law. In addition, a number of supervisors have been designated for the performance of judicial duties, namely the Procurator General at the Supreme Court, the Chairman of the Administrative Law Division at the Council of State and the General Court of the Board of Appeal for Business.
In February 2025, provisions on prohibited AI applications went into effect. This means that applications using predictive policing, social scoring and biometric identification in public spaces are now prohibited. At least, that is the starting point. Unfortunately, the AI regulation brings more exceptions to that rule than we care to see. Read here what we wrote about that earlier.
By May 2025, the Codes of Practice (Codes of Practice), which are guidelines that flesh out the standards in the AI regulation, had to be developed. That deadline was not quite met. In July, for example, only the code of practice for generative AI applications.
Generative AI applications already marketed by providers (such as ChatGPT) must comply with the AI regulation. The rules for generative AI are similar to those that apply to high-risk applications. This means that a wide range of rules on transparency and accountability will apply to these AI applications.
Member states must disclose to the European Commission the financial and human capacity of supervisors.
Member states must have adopted and implemented rules on fines and shared this with the European Commission.
In February, the European Commission will provide guidelines for the practical implementation of high-risk applications. These are applications that can, for example, impact your rights as a human being or your health.
Member states should ensure that regulators have at least a regulatory sandbox. This makes room for innovation, while supervisors help think through how the developer can comply with the AI regulation.
In August 2026, the remaining provisions of the AI regulation will come into force. Also, all high-risk systems must comply with the AI regulation.
If all goes according to schedule, the AI regulation will take full effect on Aug. 1, 2026. However, there have been rumors for some time that the deadline will be delayed. In June, said the technical head of the European Commission that she would not rule out postponing parts of the AI regulation if the standards and guidelines were not developed in time. We joined EDRi's call for the European Commission to stick to the original timeline and the adopted legal text. Indeed, not only is there a haggling over the timeline, there are also attempts to simplify several European laws, including the AI Regulation, to simplify. Read more here. Note before the law has even fully entered into force!
In July, however, the European Commission indicated that there would be no delay and that the original timeline would remain in effect. So after a stormy legislative journey, it appears that the AI regulation has not exactly settled into calmer waters yet. We will keep an eye on it and continue to push for AI legislation and its implementation where your rights are best protected.
