
2025 is set to be a pivotal year for artificial intelligence regulation in Europe. New legal and operational standards will come into force that will shape AI development and deployment across sectors. Both developers of AI technology and businesses integrating AI into their operations must be prepared for significant changes. These range from regulatory compliance deadlines, to evolving positions on the application of existing laws, and hopefully greater clarity in areas of uncertainty in the law.
AI Act deadlines
The AI Act will introduce the first key compliance obligations on 2 February 2025. These include the ban on prohibited AI practices under Article 5 and the AI literacy obligations under Article 4. The guidelines on prohibited practices are expected to be published in early 2025, with the aim of adopting the guidelines before the prohibitions come into force. The Code of Practice for general purpose AI models is scheduled to be published on 2 May 2025. Later on in 2025, the associated AI Act obligations for general purpose AI models kick in on 2 August, with the exception of those availing of the grandfathering / legacy provision under Article 111(3). In addition, by this date the relevant national competent authorities should be set up, and the provisions on penalties will apply. We expect enforcement will begin after the national competent authorities are established in August, with the possibility of the first penalties being imposed in the latter half of 2025.
As a result, it is vital that companies start preparing for compliance as soon as possible.
High-risk AI standards and product liability
The Commission has tasked the CEN and the CENELEC with developing standards to support compliance with the AI Act’s high-risk AI requirements which is expected by the end of 2025. Companies should closely follow this development which will offer crucial clarity regarding technical specifications, that companies could leverage to demonstrate compliance with the AI Act. Companies should also pay close attention to the liability rules for AI developers that will be introduced via the revised Product Liability Directive which entered into force on 9 December 2024. However, the directive will not apply to AI products until December 2026.
AI and GDPR
We are hoping for some additional certainty in other areas of AI law in 2025. The EDPB opinion on artificial intelligence, adopted on 17 December 2024, provides some clarity for developers on GDPR compliance. This includes guidance on the lawful basis for model training and deployment, when a model can be considered anonymous, and the consequences of unlawful personal data processing during AI model development. However, many questions remain unanswered.
The Opinion did not address issues such as:
- Special categories of data
- Automated decision making
- Compatibility of purposes under Article 6(4) GDPR
- Data protection impact assessments, or
- Data protection by design and default
It is likely that GDPR compliance concerning Al development and deployment will remain a high priority for supervisory authorities next year.
International alignment
The potential for enhanced global alignment in the regulation of AI is growing as multiple international initiatives converge over the coming year. If the EU’s Code of Practice on General Purpose AI Models achieves broad consensus within the sector, including participation by major industry players, it could set a baseline for voluntary compliance. Similarly, the CEN/CENELEC standards for addressing specific AI risks could play a pivotal role in harmonising safety and performance benchmarks for AI. These efforts are complemented by broader international initiatives, including collaborations between AI Safety Institutes and the Commission, such as the US AI Safety Institute. Additionally, the signing of the first ever international legally binding treaty on AI – the Council of Europe’s AI Convention – further supports these efforts. Together, these developments signal a trajectory toward more unified regulatory practices globally in 2025 and beyond.
EU AI Board / opinions
The AI Board comprises representatives from all EU Member States and operates with the support of the AI Office, which acts as the Board’s secretariat. The inaugural AI Board meeting was held on 10 September 2024, followed by its second meeting on 10 December. In its first meeting, the AI board adopted its sub-group planning, which was divided into phases based on priority areas, ensuring alignment with the staggered implementation of the AI Act’s provisions. Phase one, for 2024 consisted of sub-groups for “Innovation Ecosystem; Interplay with Medical & In-Vitro Diagnostic Device Regulation; AI Regulatory Sandboxes; Prohibitions; General-purpose AI; Standards.” Phase 2 in early 2025 will cover topics such as the “AI Act interplay with other Union legislation”, “Annex III High risk”, “Law Enforcement”, and “Financial Services”. Phase 3, starting from mid-2025, will consist of sub-groups focusing on “Market Surveillance Authorities (AdCo)” and “Notifying Authorities”. Therefore, we can potentially expect further guidance on some of these areas in 2025.
Conclusion
In 2025, companies operating in the AI space face a year of significant regulatory and internal operational transformations. The EU’s AI regulatory landscape, shaped in particular by the first enforcement of the AI Act, and privacy requirements under GDPR, will demand proactive compliance efforts. With the requirements under the AI Act related to prohibited AI, general purpose AI models, and AI literacy taking effect, businesses must be prepared to adapt their practices and strategies to meet these new obligations. Companies that proactively address these regulatory changes will be better positioned to navigate compliance efficiently and focus on growth in the AI space. Early preparation and staying informed about upcoming guidelines and deadlines will allow businesses to manage risks effectively while seizing new opportunities in the AI space.
For more information on the implications of integrating AI systems into your business, please contact a member of our Artificial Intelligence team.
The content of this article is provided for information purposes only and does not constitute legal or other advice.
Share this: