Eu AI Act
The EU AI Act is Regulation (EU) 2024/1689 of the European Parliament and of the Council, the first comprehensive horizontal law on artificial intelligence in a major jurisdiction. It entered into force on 1 August 2024 after publication in the Official Journal of the European Union, and it regulates AI systems according to the level of risk they pose, imposing the heaviest duties where harm to health, safety, or fundamental rights is most plausible. Because it applies to providers placing systems on the EU market regardless of where they are established, and to deployers using them in the Union, its reach is global in practice, a pattern often called the Brussels effect after the way the GDPR spread European data-protection norms.
The Act's organizing idea is a pyramid of four risk tiers: unacceptable, high, limited, and minimal. Unacceptable-risk practices are banned outright, and the list includes social scoring by public authorities, untargeted scraping of facial images to build recognition databases, manipulative techniques that materially distort behavior and cause harm, exploitation of vulnerabilities related to age or disability, and emotion recognition in workplaces and schools, with narrow exceptions mainly for law enforcement and safety. High-risk systems are permitted but heavily conditioned; limited-risk systems carry transparency duties; and minimal-risk systems, which cover most everyday applications such as spam filters or recommendation features in games, face no new obligations beyond voluntary codes of conduct.
High-risk status comes from two routes, and the obligations attach to the lifecycle of the system rather than to a single test. One route covers AI that is a safety component of products already regulated under EU product-safety law, such as medical devices or machinery; the other covers use cases listed in Annex III, including biometric identification, management of critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services such as credit scoring, law enforcement, migration and border control, and the administration of justice. Providers of these systems must operate a risk management system, use training and validation data subject to governance practices, keep technical documentation and logs, provide clear instructions to deployers, enable human oversight, achieve appropriate accuracy, robustness, and cybersecurity, and pass a conformity assessment before the system is placed on the market. Deployers carry their own duties, and for some uses, such as certain public-sector deployments, must assess fundamental-rights impact.
General-purpose AI models were added through a separate chapter after large language models arrived while the Act was being negotiated. All providers of such models must maintain technical documentation, give downstream providers the information they need, set out a policy for complying with EU copyright law, and publish a summary of the training content. Models judged to pose systemic risk, presumed when the cumulative compute used for training exceeds 10^25 floating-point operations or when designated by the Commission, face additional duties: model evaluations including adversarial testing, assessment and mitigation of systemic risks, serious-incident reporting, and adequate cybersecurity. The Commission's AI Office oversees this regime and facilitated a voluntary code of practice for general-purpose AI, which links the Act to the evaluation and safety-framework practices discussed under responsible scaling policy.
Application is staged rather than immediate, with bans first and most operational duties later. The prohibitions and the AI literacy requirement apply roughly six months after entry into force, the general-purpose AI obligations roughly a year after, and the bulk of the Act, including the Annex III high-risk rules, roughly two years after, with a longer transition for high-risk AI embedded in already regulated products. Exact dates and the detail of implementing guidance continue to be set through delegated acts, standards, and Commission guidelines, so any compliance plan should check the current official text. Penalties are tiered; the most serious, for prohibited practices, reach up to 7 percent of worldwide annual turnover or 35 million euros, whichever is higher.
Common misconceptions are that the Act bans most AI, that it regulates the technology itself rather than its use, and that it applies only to European companies. The structure is the opposite: most systems fall in the minimal tier, obligations track the use case, and a non-EU provider whose output is used in the Union is covered. Another pitfall is treating the Act as a technical standard; it sets legal requirements that harmonized standards, still being developed by European standardization bodies, are expected to translate into testable criteria.
Read the EU AI Act as risk-proportionate product regulation applied to software: the same underlying model can be unregulated in one use and tightly controlled in another, and what the law actually asks for is evidence of governance, documentation, and oversight in proportion to the harm a deployment could cause.