Article 2 of 1132%
Article 2: Scope
EU Official:
Title I: General Provisions
Article 2 states the AI Act applies to providers, deployers, importers and distributors of AI systems in the EU, as well as parties outside the EU whose AI output is used in the EU.
Official text
||
Source: EUR-Lex, Regulation (EU) 2024/1689. Text reproduced verbatim.
Download AI Act (PDF)→Official guidance on this article
7- Commission Guidelines on prohibited artificial intelligence practices established by Regulation (EU) 2024/1689 (AI Act)Expands on the meaning of Article 2, paragraph 7, that GDPR, LED and EUDPR continue to apply alongside the prohibitions, so that a separate data protection legal test is always required.PublishedGuidelinesEuropean Commission (DG CONNECT / AI Office)4 Feb 2025
- Commission Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689 (AI Act)In practice determines the material scope of Article 2, because without an AI system the obligations do not apply.PublishedGuidelinesEuropean Commission (DG CONNECT / AI Office)6 Feb 2025
- Interplay between the AI Act and the EU digital legislative frameworkProvides context for the rule that other EU law remains applicable alongside the AI Act by showing for each adjacent regulation what duplicate or conflicting obligations this createsPublishedOpinionEuropean Parliament (Policy Department, at the request of the ITRE Committee)30 Oct 2025
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI modelsMakes concrete what Article 2, paragraph 7, which states that EU data protection law applies in full, means in practice for training and deploying AI models on personal dataPublishedOpinionEDPB (European Data Protection Board)17 Dec 2024
- EDPB-EDPS Joint Opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus)Touches the core of Article 2(7): the opinion ensures that the data protection law that remains applicable alongside the AI Act is not silently undermined via the OmnibusPublishedOpinionEDPB and EDPS jointly11 Feb 2026
- Statement 3/2024 on data protection authorities' role in the Artificial Intelligence Act frameworkConfirms on the basis of Article 2(7) that GDPR, Law Enforcement Directive, EUDPR and ePrivacy Directive remain fully applicable throughout the entire lifecycle of an AI system, in addition to the AI Act.PublishedOpinionEDPB (European Data Protection Board)16 Jul 2024
- Guidance on generative AI and the GDPRWorks out the national application of the given that the GDPR remains applicable alongside the AI Act, with the legal basis question as the first hurdle before AI Act obligations come into viewPublishedGuidelinesDutch Data Protection Authority (AP)13 Jul 2026
Related enforcement
No enforcement actions for this article yet. Follow developments via the Enforcement Tracker.
Related articles
Frequently asked questions
Who does the AI Act apply to under Article 2?+
Article 2 states the AI Act applies to providers, deployers, importers and distributors of AI systems in the EU, as well as parties outside the EU whose AI output is used in the EU.
Does the AI Act apply to open source AI systems?+
Article 2(12) exempts open source AI systems unless they are classified as high-risk or fall under Article 5 (prohibited practices) or Article 50 (transparency).
Does the AI Act apply to military use?+
No, Article 2(3) explicitly excludes AI systems used exclusively for military, defence or national security purposes from the AI Act.
Does Article 2 AI Act apply to personal use?+
No, Article 2(10) states that the regulation does not apply to natural persons using AI systems in the course of a purely personal non-professional activity.
Do SMEs also need to comply with Article 2 of the AI Act?+
Article 2 of the AI Act does not provide a general exemption for SMEs. However, the AI Act includes supportive measures and potentially lighter obligations for small and medium-sized enterprises, depending on their role in the AI value chain.
How does Article 2 of the AI Act relate to the GDPR?+
Article 2 of the AI Act complements the GDPR. While the GDPR protects personal data, the AI Act focuses on the safety and trustworthiness of AI systems. Organisations must comply with both regulations when their AI system processes personal data.
What are the deadlines for Article 2 of the AI Act?+
The AI Act follows a phased implementation. Prohibited AI practices apply from February 2025, obligations for high-risk AI systems from August 2026, and other provisions take effect gradually. The specific deadline for Article 2 depends on the category of the obligation.
Does Article 2 of the AI Act also apply to AI systems I purchase?+
Yes, Article 2 of the AI Act may also be relevant when you purchase AI systems. As a deployer, you have your own obligations under the AI Act, regardless of whether you developed the system yourself or purchased it from a provider.
What is the difference between provider and deployer under Article 2 of the AI Act?+
Under Article 2 of the AI Act, the provider is the entity that develops or places the AI system on the market, while the deployer is the entity that uses the system under its own authority. Both roles carry different obligations.