EU AI Act: The Comprehensive Rules You Can't Ignore

The European Union's landmark AI Act is no longer a distant proposal; it's a rapidly unfolding reality that demands immediate attention from anyone developing or deploying artificial intelligence. With key provisions already in effect and more on the horizon, ignoring its comprehensive framework and strict deadlines is simply not an option, especially given the substantial penalties at stake. This regulation is a critical imperative for businesses globally, not just within the EU, shaping the future of AI development and deployment.

What's changing

The EU AI Act, formally known as Regulation (EU) 2024/1689, stands as the world's first comprehensive legal framework for artificial intelligence. Its core innovation is a risk-based approach, categorizing AI systems into four distinct tiers, each with its own set of obligations. This tiered system ensures that regulatory burdens are proportionate to the potential harm an AI system might pose.

At the top are unacceptable risk AI systems, which are outright banned. These include systems designed for social scoring, manipulative AI that exploits children or vulnerable individuals, untargeted scraping of facial images from the internet, and most real-time biometric identification systems in public spaces. The EU's stance here is clear: certain AI applications are fundamentally incompatible with fundamental rights and must not be used. These bans kicked in on 2 February 2025.

Next are high-risk AI systems, which face stringent requirements. This category encompasses AI used in critical areas such as hiring and worker management, educational grading, credit scoring, critical infrastructure management, medical devices, law enforcement, border control, and judicial decision-making. If you develop or deploy a high-risk AI system, you are obligated to establish a documented risk-management process, use high-quality training data, maintain detailed technical documentation, log the system's activities, ensure robust human oversight capabilities, and register the system in an EU public database before it can be placed on the market. The full rulebook for these high-risk systems applies from 2 August 2026.

Limited risk AI systems, such as chatbots, emotion-recognition systems, and deepfakes, are subject to transparency obligations. Users must be clearly informed when they are interacting with an AI system or viewing synthetic content. This ensures users are aware of the AI's presence and can make informed decisions.

Finally, minimal risk AI systems, which include common applications like spam filters or video game AI, face no specific rules under the Act. The vast majority of AI systems are expected to fall into this category, reflecting a pragmatic approach to regulation.

Beyond these tiers, the Act also introduces specific rules for 'general-purpose AI models' (GPAI), akin to large language models like ChatGPT. Developers of these models must publish a summary of their training data and adhere to EU copyright law. For GPAI models that are exceptionally powerful (exceeding 10^25 FLOPs of training compute), additional stringent rules apply, including mandatory red-teaming for safety, robust cybersecurity measures, and incident reporting. Rules for general-purpose AI started on 2 August 2025.

Non-compliance with the EU AI Act carries significant repercussions. The maximum fine can reach 7% of a company's worldwide annual turnover or €35 million, whichever amount is greater. This financial penalty underscores the EU's serious commitment to enforcing this landmark legislation.

Who is affected

The reach of the EU AI Act extends far beyond the geographical borders of the European Union. While it is an EU regulation, its impact is decidedly global. Any entity, regardless of its location, that develops, deploys, or provides AI systems whose outputs are intended to be used in the EU market will fall under its purview. This extraterritorial scope means that businesses in the United States, Asia, or anywhere else in the world cannot afford to ignore these rules if they wish to engage with the lucrative EU market.

In terms of sectors, the regulation casts a wide net, particularly for high-risk AI. This includes, but is not limited to, critical infrastructure (e.g., energy, transport), education (e.g., grading, access), employment (e.g., recruitment, worker monitoring), essential private and public services (e.g., credit scoring, emergency dispatch), law enforcement, migration and border control, and the administration of justice. Essentially, any sector where AI systems could pose a significant risk to health, safety, or fundamental rights is affected.

Crucially, the Act applies to companies of all sizes. From nimble startups innovating with AI to multinational corporations deploying complex AI solutions, every organization involved in the AI lifecycle must assess its systems against the Act's requirements. The emphasis is not just on AI developers but also on 'deployers' – businesses that integrate and use AI systems developed by others. This means even if you don't build AI, but use it in a high-risk context, you have compliance obligations.

Three things to do this week

Given the phased implementation and significant penalties, immediate action is non-negotiable. Here are three critical steps your organization should prioritize:

1. Classify your AI system into one of four risk tiers: unacceptable, high, limited, or minimal risk. This foundational step, mandated by Article 6 and Annex III, is paramount. You cannot begin to understand your obligations until you know which category your AI systems fall into. Conduct a thorough inventory of all AI systems currently in use or under development and assess their potential risks. This will dictate the entire scope of your compliance efforts.

2. Stop using prohibited AI practices. With bans on unacceptable risk AI systems effective since February 2, 2025, it is imperative to immediately cease any practices outlined in Article 5. This includes social scoring, manipulative subliminal techniques, exploitation of vulnerabilities (especially of children or vulnerable persons), and untargeted scraping of facial images from public sources. Continued use of these practices could lead to immediate enforcement action and severe fines.

3. Prepare to register your high-risk AI system in the EU public database before placing it on the market. For high-risk systems, Article 49 and 71 require registration. While the full high-risk rules apply from August 2, 2026, preparing for this now is crucial. This involves not only identifying your high-risk systems but also ensuring you have the necessary technical documentation, risk management systems, and human oversight mechanisms in place to meet all associated requirements before registration. Do not wait until the last minute to compile this extensive information.

Related context

The EU AI Act does not exist in a vacuum; it builds upon and interacts with other significant European regulations, most notably the General Data Protection Regulation (GDPR). Many of the AI Act's provisions, particularly those concerning data quality for training high-risk systems or the use of biometric data, directly intersect with GDPR's principles of data protection by design and default, and the lawful processing of personal data. Recent enforcement actions, such as the Italian Data Protection Authority's (Garante) temporary ban and subsequent €15M fine against OpenAI (ChatGPT) for data processing issues, and the Spanish Data Protection Agency's (AEPD) halt of Worldcoin's iris-scanning operations, highlight the EU's proactive stance on regulating AI and data privacy even before the full AI Act came into force. These cases serve as stark reminders of the regulatory scrutiny AI systems already face.

For further details on the core regulation, refer to the European Union - AI Regulation (2024/1689). Additionally, the EDPB-EDPS Joint Opinion on Digital Omnibus on AI offers insights into data protection aspects. It's also worth noting that similar regulatory discussions are emerging globally, with jurisdictions like the United Kingdom - Northern Ireland - AI Regulation (2024/1689) exploring their own frameworks, suggesting a global trend towards AI governance that businesses must monitor.

Note: this article was drafted by AI - Google Gemini