EU AI Act

Comprehensive EU regulation establishing rules for artificial intelligence systems based on risk levels.

Entering into force on 1 August 2024, the EU AI Act is the world's first comprehensive legal framework for artificial intelligence. Rather than regulating AI as a single category, the Act introduces a risk-based classification system that assigns obligations proportional to the potential harm an AI system may cause. This tiered approach spans from minimal-risk AI with no specific requirements, through limited-risk systems subject to transparency obligations, up to high-risk and prohibited AI practices subject to the strictest controls.

Businesses developing, deploying, or distributing AI systems within the EU, or whose AI outputs affect EU residents, fall within scope. This includes technology providers, deployers across all sectors, importers, and distributors. The regulation designates certain AI practices as unacceptable and prohibits them outright, including social scoring systems, manipulative AI that exploits vulnerabilities, and certain forms of real-time biometric identification. High-risk AI systems, such as those used in recruitment, credit scoring, law enforcement, and critical infrastructure, face the most demanding compliance requirements.

For high-risk AI, obligations include establishing risk management systems, ensuring data quality and governance, maintaining technical documentation, enabling human oversight, and meeting standards for accuracy, robustness, and cybersecurity. Providers of general-purpose AI models, including large language models, must comply with transparency requirements and, for models posing systemic risk, must conduct model evaluations and adversarial testing. Deployers of high-risk systems must perform fundamental rights impact assessments and maintain logs.

The Act is being phased in over a staged timeline. Prohibitions on unacceptable AI practices apply from February 2025. Obligations for general-purpose AI models take effect in August 2025. The full set of requirements for high-risk AI systems becomes applicable in August 2026, with some extensions for high-risk systems embedded in products regulated under existing EU product legislation.

The AI Act connects with multiple existing regulations. It aligns with GDPR on data processing and automated decision-making, builds on the EU Machinery Regulation for AI-enabled machinery, and complements the Digital Services Act regarding algorithmic transparency on platforms. The Platform Workers Directive further intersects by requiring transparency in algorithmic management of gig workers. For businesses, the AI Act demands early investment in governance frameworks, technical compliance, and cross-functional coordination to meet obligations that will shape the future of AI innovation in Europe.

Select your company type for tailored compliance guidance.