EU Ethics Guidelines for Trustworthy AI vs EU AI Act: How 7 Voluntary Requirements Became Law

Before the EU AI Act, there were the Ethics Guidelines for Trustworthy AI. Published on 8 April 2019 by the Commission's independent High-Level Expert Group on AI, they set out seven key requirements that trustworthy AI should meet: human agency and oversight; technical robustness and safety; privacy and data governance; transparency; diversity, non-discrimination and fairness; societal and environmental well-being; and accountability. They were voluntary, principles-based and addressed to anyone who builds or uses AI.

Five years later, most of those ideas became binding law. The AI Act explicitly names the 2019 guidelines and their seven principles in Recital 27, and turns many of them into enforceable duties: human oversight, robustness, data governance, transparency, bias controls and accountability for high-risk AI. But not everything made the jump. Environmental well-being and broader fairness remain largely voluntary.

This guide traces how each of the seven requirements moved from ethics to law, what was strengthened, what was narrowed, and why the guidelines still matter for organisations in 2026.

The short answer

The Ethics Guidelines describe what trustworthy AI looks like for any AI system. The AI Act decides which parts of that picture are legally required, for whom and when. It made the seven requirements mandatory mostly for high-risk AI, set specific obligations and deadlines, and backed them with conformity assessment, supervision and fines. For everything else, it kept the guidelines' voluntary spirit through codes of conduct.

Where the Ethics Guidelines came from

The Commission published its European approach to AI in April 2018 and set up the High-Level Expert Group in June 2018. The group released a draft of the guidelines on 18 December 2018. The consultation closed on 1 February 2019 with more than 500 comments, and the final guidelines followed on 8 April 2019.

The guidelines rest on a simple idea: trustworthy AI should be lawful, ethical and robust. They derived four ethical principles from fundamental rights, namely respect for human autonomy, prevention of harm, fairness and explicability, and turned them into seven key requirements. An assessment list was piloted with stakeholders in the second half of 2019 and finalised as ALTAI in July 2020.

The guidelines then fed directly into policy: the Commission's White Paper on AI in February 2020, and the AI Act proposal of 21 April 2021.

How the 7 requirements became law

The table below maps each requirement to its main AI Act counterparts. The assessment of how fully each one converted is an analytical guide, not part of either text.

1. Human agency and oversight

The guidelines asked that AI support human autonomy and decision-making, with oversight approaches such as human-in-the-loop, human-on-the-loop and human-in-command. The AI Act made this a design requirement. Under Article 14, high-risk AI must let people understand its capabilities and limits, interpret its output, avoid over-relying on it, and override or stop it. Deployers must assign oversight to people with the right competence and authority. The Act's bans on subliminal and manipulative AI protect the "agency" half of the requirement.

2. Technical robustness and safety

The guidelines called for resilience to attack, fallback plans, accuracy, reliability and reproducibility. Article 15 now requires high-risk AI to achieve appropriate accuracy, robustness and cybersecurity throughout its life cycle, explicitly including defences against data poisoning, model poisoning and adversarial examples. Article 9 requires a continuous risk management system. For the most capable general-purpose models, Article 55 adds adversarial testing and systemic-risk mitigation.

3. Privacy and data governance

The guidelines linked trustworthy AI to privacy, data quality and integrity, and controlled access to data. Article 10 of the AI Act sets specific data governance duties for high-risk AI: relevant, representative and as far as possible error-free and complete training, validation and test data, with documented collection and preparation. Privacy itself stays with the GDPR, which applies alongside the AI Act in full.

4. Transparency

The guidelines grouped traceability, explainability and communication under transparency. The AI Act splits these into several binding duties: technical documentation and logging for traceability (Articles 11 and 12), instructions for deployers (Article 13), disclosure of chatbots and labelling of deepfakes (Article 50), documentation for general-purpose AI models (Article 53), and a right to an explanation of certain decisions made with high-risk AI (Article 86).

5. Diversity, non-discrimination and fairness

The guidelines asked organisations to avoid unfair bias, ensure accessibility and universal design, and involve stakeholders. The AI Act translated this only partly. Article 10(2) requires examining training data for possible biases and taking measures to detect, prevent and mitigate them, and Article 27 requires certain deployers to assess fundamental rights impacts. But there is no general fairness obligation, and the guidelines' calls for diverse teams and stakeholder participation remain voluntary. Equality law outside the AI Act carries much of the weight.

6. Societal and environmental well-being

This is the requirement that converted least. The guidelines asked that AI be sustainable and environmentally friendly, consider its social impact, and protect democracy. The AI Act addresses parts of this indirectly: AI literacy (Article 4), systemic risks from general-purpose AI, energy-consumption information in GPAI technical documentation, and standardisation work on resource performance. There is no binding environmental duty for most AI systems. Article 95 instead encourages voluntary codes covering environmental sustainability.

7. Accountability

The guidelines called for auditability, minimising and reporting negative impacts, trade-offs and redress. The AI Act built a full accountability architecture: defined roles for providers, deployers, importers and distributors, quality management systems, conformity assessment and CE marking, registration, post-market monitoring, serious-incident reporting, complaints to authorities and fines.

If you are using the 2019 guidelines alongside AI Act compliance, I post practical breakdowns of the AI Act, ISO 42001 and responsible AI frameworks regularly on LinkedIn. Feel free to connect with me there and tell me which requirement your team finds hardest to put into practice.

Ethics Guidelines vs AI Act: side by side

What the AI Act changed from the original vision

From "all AI" to "risk-based"

The guidelines applied the seven requirements to every AI system. The AI Act concentrates binding duties where risk is highest. A recommendation engine for films or an internal document classifier has few AI Act obligations, but the guidelines would still ask that it be fair, transparent and overseen.

From self-assessment to proof

ALTAI was a reflective checklist. The AI Act requires evidence: technical documentation, quality management systems, logs, conformity assessments and, for some systems, notified bodies. Trustworthiness moved from a claim to something you must demonstrate.

From principles to prohibitions

The guidelines described what to aim for. The AI Act also defines what is never allowed, such as social scoring, manipulative AI that causes significant harm, untargeted scraping of facial images and emotion recognition in workplaces and schools.

How the timelines fit together

• Apr 2018

  Commission publishes its European approach to AI.

• Jun 2018

  High-Level Expert Group on AI appointed, with 52 members.

• 18 Dec 2018

  Draft Ethics Guidelines published for consultation.

• 1 Feb 2019

  Consultation closes with more than 500 comments.

• 8 Apr 2019

  Final Ethics Guidelines for Trustworthy AI published.

• 26 Jun 2019

  Piloting of the assessment list begins.

• 19 Feb 2020

  Commission White Paper on AI.

• 17 Jul 2020

  Final ALTAI assessment list published.

• 21 Apr 2021

  Commission proposes the AI Act.

• 1 Aug 2024

  AI Act enters into force.

• 2 Feb 2025

  Prohibitions and AI literacy duties apply.

• 2 Aug 2026

  Article 50 transparency duties apply.

• 2 Dec 2027

  High-risk duties apply to Annex III systems.

Why the Ethics Guidelines still matter in 2026

• Codes of conduct: Recital 27 and Article 95 point to the seven principles as a basis for voluntary codes, especially for AI that isn't high-risk.
• Interpretation: the guidelines explain the thinking behind many AI Act duties, which helps when applying vague terms such as "appropriate" human oversight.
• The gaps: environmental impact, inclusive design and stakeholder participation are covered far better by the guidelines than by the Act.
• Global reach: the guidelines influenced the OECD AI Principles, ISO/IEC standards and many corporate AI principles worldwide.
• Management systems: the seven requirements map well onto ISO/IEC 42001 objectives and controls, so they can structure an AI governance programme.

A 6-step plan to use both together

1. Classify every AI system under the AI Act

   Identify prohibited, high-risk, transparency-relevant and general-purpose AI. This tells you where the seven requirements are legally binding and where they are voluntary.

2. Meet the binding duties first

   For high-risk AI, implement Articles 9 to 15, quality management, documentation and oversight. These cover most of requirements 1, 2, 3, 4 and 7.

3. Close the fairness gap

   Go beyond Article 10 bias checks: test outcomes across groups, involve affected stakeholders, check accessibility and document trade-offs, as the guidelines recommend.

4. Add environmental and societal measures

   Measure the energy use of training and inference, set efficiency targets, and assess wider social impact for significant AI systems, even where the law doesn't require it.

5. Use ALTAI for AI that isn't high-risk

   Run a lightweight ALTAI-style self-assessment for minimal and limited-risk AI, so the seven requirements guide all of your AI, not just the regulated part.

6. Write it into a code of conduct

   Turn your approach into an internal or sector code of conduct under Article 95, and anchor it in an AI management system such as ISO/IEC 42001.

Common mistakes to avoid

• Treating the 2019 guidelines as obsolete now that the AI Act exists
• Assuming the AI Act requires all seven requirements for every AI system
• Relying on Article 10 bias checks as a complete fairness programme
• Ignoring environmental impact because the law barely mentions it
• Claiming "trustworthy AI" based on minimum legal compliance alone

A prompt to map your AI to the 7 requirements and the AI Act

Paste in your AI system details to get a first-draft gap analysis. Your AI governance lead should review it.

You are an AI governance specialist with deep knowledge of the
2019 EU Ethics Guidelines for Trustworthy AI, the ALTAI assessment
list, the EU AI Act (Regulation (EU) 2024/1689) as amended by the
Digital Omnibus on AI, and ISO/IEC 42001.

Our AI system:
[purpose; who it affects; provider or deployer role; model type;
data sources; human oversight in place; documentation and
logging; bias testing done; energy use if known; stakeholder
involvement so far]

Produce:
1. The system's AI Act classification (prohibited, high-risk,
   transparency-relevant, GPAI, or minimal risk).
2. A table of the 7 trustworthy AI requirements showing, for each:
   the binding AI Act duty (if any), our current status, and the
   gap.
3. Where the guidelines ask for more than the AI Act, and
   whether we should go further.
4. A short ALTAI-style self-assessment for this system.
5. Controls to add, mapped to ISO/IEC 42001 where useful.
6. A one-page summary we could use in a voluntary code of
   conduct.

Use only what I provide and mark uncertain points UNKNOWN.

In 2019, Europe described what trustworthy AI should be. In 2024, it decided which parts must be proven. The organisations that lead will treat the law as the floor and the guidelines as the goal. — Kumail Mehdi

Frequently asked questions

Turning trustworthy AI principles into practice? Let's connect on LinkedIn. I'm always glad to compare notes on responsible AI governance.

Sources

• European Commission — Ethics Guidelines for Trustworthy AI
• AI Act Service Desk — Recital 27
• Springlex — Article 95 codes of conduct and Recital 165
• EUR-Lex — Regulation (EU) 2024/1689 (AI Act)
• Hunton — Commission releases final Ethics Guidelines for Trustworthy AI
• Futurium — Over 500 comments on the draft Ethics Guidelines
• ALTAI — Assessment List for Trustworthy AI
• eucrim — AI HLEG publishes ethics checklist (ALTAI)
• The Lawyer — ALTAI and stakeholder consultation
• VerifyWise — Ethics Guidelines and their mapping to the AI Act