EU AI Act
The European Union's comprehensive law regulating artificial intelligence, which classifies systems by risk level and imposes obligations on developers and deployers accordingly.
The EU AI Act is the world’s first broad, binding legal framework for artificial intelligence. It entered into force in 2024 and is being phased in over several years, with obligations for different parts of the law taking effect at different times.
Its central idea is a risk pyramid:
- Prohibited practices: social scoring, manipulative techniques, certain biometric surveillance — banned outright.
- High-risk systems: for example, AI used in hiring, credit scoring, education, medical devices, and critical infrastructure. These require conformity assessments, risk management, data governance, human oversight, and detailed documentation.
- Limited-risk systems: mainly transparency duties — chatbots must disclose that users are talking to a machine, and AI-generated content must be machine-readable as such.
- Minimal risk: most applications, largely unregulated.
General-purpose AI models, including large foundation models, have their own obligations around documentation, copyright policy, and — for the most capable models — systemic-risk evaluations.
The Act applies to providers and deployers whose systems affect people in the EU, regardless of where the company is based, making it a de facto global standard. Penalties can reach into the tens of millions of euros or a percentage of global turnover.