Redistributed

The European Union's AI Act is the world's first comprehensive AI regulation. It matters beyond Europe because companies operating globally often adopt EU standards everywhere. Here's what it actually does.

The Core Idea: Risk-Based Regulation

The Act doesn't regulate "AI" as a single category. It classifies AI systems by risk level and applies different rules to each:

Unacceptable risk — Banned outright. Social scoring by governments. Real-time facial recognition in public spaces (with narrow exceptions). Manipulation of vulnerable groups. Emotion recognition in workplaces and schools.

High risk — Permitted but heavily regulated. Systems that affect safety, employment, education, credit, justice, or migration. Must meet conformity requirements, maintain documentation, allow human oversight, and undergo third-party audits (AI Act, Article 6).

Limited risk — Transparency obligations only. Chatbots must disclose they're not human. Deepfakes must be labeled. Emotion recognition systems must inform users.

Minimal risk — No specific requirements. Most AI applications fall here.

What "High Risk" Actually Means

A system is high-risk if it's used for:

Biometric identification
Critical infrastructure operation
Educational or vocational training decisions
Employment (hiring, evaluation, termination)
Access to essential services (credit, insurance, social benefits)
Law enforcement and border control
Administration of justice
Democratic processes

For these systems, providers must:

Implement risk management throughout the system lifecycle
Use high-quality training, validation, and testing data
Maintain detailed technical documentation
Log system operations automatically
Ensure human oversight with the ability to override
Meet accuracy, robustness, and cybersecurity standards
Allow audits by national authorities

The Foundation Model Layer

Large language models and other "general-purpose AI" (GPAI) get special treatment. Providers must:

Publish training data summaries (not the data itself)
Maintain technical documentation
Comply with EU copyright law
Demonstrate energy efficiency

Models with "systemic risk" — roughly, the frontier models — have additional requirements:

Model evaluation and testing
Risk assessment and mitigation
Incident reporting
Cybersecurity protections

"Systemic risk" is defined by compute threshold: training runs above 10^25 floating-point operations (AI Act, Article 51). This captures GPT-4-class models and above.

Who Enforces This

Each member state designates a national authority. A new EU AI Office coordinates cross-border enforcement and handles GPAI oversight directly.

Penalties scale with company size: up to €35 million or 7% of global turnover for the most serious violations. That's potentially billions for the largest companies.

What the Act Doesn't Do

It doesn't ban AI development. Even high-risk systems are permitted; they just face compliance requirements.

It doesn't address concentration. The Act regulates how AI is used, not who controls the infrastructure to build it. Compute concentration, data monopolies, and labor issues aren't covered.

It doesn't create positive rights. The Act tells companies what they can't do, not what they must do. There's no requirement to deploy AI for social benefit.

It exempts research and open source (partially). Research systems without direct deployment are mostly exempt. Open-source models have lighter obligations unless they're used in high-risk applications.

What Happens Next

The Act entered into force in August 2024. Requirements phase in over two years:

2025: Bans on prohibited practices
2025: GPAI provider obligations
2026: High-risk system requirements

Companies are already adapting. Many are restructuring their compliance programs to match the risk categories. Some are pulling certain products from the EU market. Others are redesigning systems to add the required human oversight.

What the Act Gets Right

Credit where it is due. The AI Act establishes several important precedents. It creates the world's first binding legal framework for AI systems — moving beyond voluntary commitments and industry self-governance. It bans the most harmful practices outright, including social scoring and untargeted facial recognition scraping. It requires transparency about AI-generated content. And its extraterritorial reach means that companies serving European customers must comply regardless of where they are headquartered — the "Brussels Effect" in action.

The risk-based approach, despite its limitations, provides a workable structure that other jurisdictions are studying. US state-level AI laws, including Colorado's AI Act, have drawn on the EU's categories. The Act demonstrates that democratic institutions can, in fact, regulate complex technology — slowly, imperfectly, but substantively.

The Deeper Question

Whether risk-based regulation is the right framework at all remains an open question. The Act assumes the problem is bad applications of neutral technology. Critics argue the problem is the technology itself — the concentration of power, the opacity of decision-making, the erosion of labor rights (Veale & Borgesius, 2021). Those problems don't fit neatly into risk categories.

Sources

European Union. "Regulation (EU) 2024/1689 (AI Act)." Official Journal, 2024. EUR-Lex
European Commission. "AI Act: Questions and Answers." 2024. EC
Future of Life Institute. "EU AI Act Summary." 2024. FLI
Veale, Michael & Zuiderveen Borgesius, Frederik. "Demystifying the Draft EU AI Act." Computer Law Review International, 2021. arXiv

General

The EU AI Act Explained