After late-night and early-morning trilogue talks on December 8-9, negotiators from the European Parliament, Council and Commission have reached a political agreement on the Artificial Intelligence Act.

The deal cements a risk-based framework: AI systems deemed ‘unacceptable risk’ — including real-time remote biometric identification in public spaces, social scoring and certain predictive policing — are banned outright, with narrow exceptions for law enforcement. ‘High-risk’ systems in areas like employment, education and critical infrastructure face stringent obligations, including mandatory fundamental rights impact assessments. A new filter system lets some providers self-classify out of high-risk if their AI performs narrow procedural tasks.

Foundation models, or general-purpose AI (GPAI), were heavily debated. The compromise imposes tiered rules: all GPAI models must meet transparency and copyright requirements, while those trained with computing power exceeding 10^25 FLOPs face systemic-risk obligations akin to high-risk systems. Fines for non-compliance can reach EUR 35 million or, for companies, 7% of total worldwide annual turnover, whichever is higher.

The political deal now heads to formal adoption by Parliament and Council, with enforcement staggered through 2026. For now, the shape of the fight — between innovation and fundamental rights — is settled.