Redistributed

General

The EU AI Act Takes Effect: What's Actually Changing

Published March 11, 2026

the-wirepolicyregulationeugovernanceredistribution

What happened

The EU AI Act — the world's first comprehensive legal framework for artificial intelligence — is now in active enforcement. Passed in March 2024 after three years of negotiation, it didn't arrive as a single event. It arrived in phases, each one tightening a different set of screws.

The first prohibitions took effect in February 2025. These banned the practices the EU deemed unacceptably dangerous: social scoring systems that rank citizens by behavior, emotion recognition technology in workplaces and schools, untargeted scraping of facial images from the internet or CCTV to build recognition databases, and AI systems that exploit vulnerable groups or use subliminal manipulation. These are not hypothetical concerns. China's social credit experiments, Clearview AI's mass facial recognition database, and workplace emotion surveillance tools from companies like HireVue all provided the concrete evidence base for the bans. The research documented in Gender Shades and Automating Inequality was instrumental in building the case for these prohibitions.

In August 2025, obligations for general-purpose AI models kicked in. Any company providing a foundation model — whether it powers a chatbot, generates images, or underpins enterprise software — must now publish detailed technical documentation, comply with EU copyright law (including honoring opt-out requests from rights holders), and provide sufficiently detailed summaries of training data. Models assessed as posing "systemic risk" face additional requirements: adversarial testing, incident reporting to the European Commission, and cybersecurity assessments. (For context on what these model assessments involve, see What Model Cards Tell You and AI Benchmarks.)

The heaviest requirements arrive in 2026. AI systems classified as "high-risk" — those used in hiring, credit scoring, law enforcement, immigration, education, and critical infrastructure — must undergo conformity assessments before deployment. These assessments require documented risk management systems, human oversight mechanisms, data quality standards, and transparency measures that explain the system's logic to affected individuals. Providers must register these systems in a public EU database.

Enforcement sits with the newly established AI Office in Brussels, which coordinates with national authorities in each member state. Penalties are steep: up to 35 million euros or 7% of global annual turnover for prohibited practices, and up to 15 million euros or 3% of turnover for other violations.

Why it matters

The EU AI Act is the most significant attempt by any jurisdiction to answer a foundational redistribution question: who bears the costs when AI systems cause harm, and who is responsible for preventing that harm in the first place?

Before the Act, the answer was largely "the people affected by the system." If a hiring algorithm discriminated against you, the burden of proving harm fell on you. If an emotion recognition system in your workplace misclassified your expressions and flagged you for low engagement, there was no regulatory mechanism to challenge it. The Act attempts to shift that burden upstream — onto the companies that build and deploy these systems.

But the redistribution dynamics here are more complicated than "industry pays." The compliance costs are real, and they don't fall evenly.

Large companies — Microsoft, Google, Meta — can absorb the cost of conformity assessments, documentation requirements, and dedicated compliance teams. They have legal departments that already navigate GDPR. For them, regulatory compliance is a line item.

For startups, the picture is different. A 20-person company building an AI-powered medical imaging tool now faces the same conformity assessment requirements as Google Health. The documentation and risk management obligations alone can consume months of engineering time. Several European AI startups have publicly stated that the Act's requirements have delayed product launches by six to twelve months.

Open-source AI development sits in a particularly ambiguous position. The Act includes exemptions for open-source models — providers of freely available model weights are exempt from most transparency and documentation requirements, provided they don't pose systemic risk. But the boundaries are unclear. If a researcher releases an open model, and a company fine-tunes and deploys it in a high-risk context, who bears the compliance burden? The Act says the deployer does, but the practical chain of responsibility remains untested. Meredith Whittaker, president of Signal, has warned that vague open-source provisions could either chill open research or create loopholes that render the Act toothless — depending on how enforcement plays out.

This matters because it determines who can build AI in Europe. If compliance costs function as a barrier to entry, the Act could inadvertently consolidate the market — protecting citizens from harmful AI while handing more market power to the incumbents best positioned to navigate the rules. As Daron Acemoglu has argued, the direction of AI development is shaped by policy choices. Regulation that only large firms can satisfy produces one kind of AI ecosystem. Regulation paired with compliance support for smaller developers produces a different one.

The "Brussels effect" — the EU's documented tendency to set global regulatory standards through the sheer size of its market — adds another layer. GDPR reshaped global privacy practices not because every country adopted it, but because companies serving European customers had to comply regardless of where they were headquartered. The AI Act is designed to work the same way. Any AI system offered to EU users or affecting EU residents falls under its jurisdiction, regardless of where the provider is based. OpenAI, Anthropic, Google, and every other non-EU AI company serving European markets must comply.

This contrasts sharply with the US approach. The Biden-era executive order on AI from October 2023 established reporting requirements and safety testing for large models, but the Trump administration rescinded it in January 2025. What remains is a patchwork: state-level legislation (Colorado's AI Act on algorithmic discrimination, California's proposed SB 1047), sector-specific rules from agencies like the FDA and EEOC, and voluntary industry commitments. There is no comprehensive federal framework and no near-term prospect of one. The question of Who Regulates Foundation Models remains, in the US, functionally unanswered.

China has taken a third path — targeted regulations addressing specific AI applications (deepfakes, recommendation algorithms, generative AI) rather than a single comprehensive framework. The Chinese approach regulates outputs and applications rather than the underlying technology, and places content control obligations on providers that reflect state priorities rather than individual rights.

The result is a fragmenting global landscape. Companies building AI for global deployment must now navigate at least three distinct regulatory regimes. The EU's framework is the most prescriptive, and because it applies extraterritorially, it effectively sets the floor.

What to watch

The Act's real impact depends entirely on enforcement — and enforcement hasn't been tested yet. Three dynamics will determine whether this regulation redistributes power or merely redistributes paperwork.

  • The AI Office's first enforcement actions. The Brussels office is staffed but untested. Its first investigations — likely targeting prohibited practices like unauthorized facial recognition databases — will signal whether the Act has teeth or whether it becomes another directive honored more in documentation than in practice. The penalties are large enough to matter. Whether they're actually imposed is another question.

  • The compliance cost distribution. The European Commission has proposed "regulatory sandboxes" — controlled environments where startups can test AI systems with lighter requirements — and is developing standardized conformity assessment templates to reduce the burden on smaller firms. Whether these measures actually level the playing field or merely provide the appearance of doing so will become clear as high-risk system requirements take full effect in 2026. Watch for whether the European AI startup ecosystem grows or contracts relative to the US over the next two years.

  • The open-source boundary. The exemption for open-source models will be tested as open-weight models from Meta, Mistral, and others are deployed in high-risk settings across Europe. If the line between "open-source provider" and "responsible deployer" proves too blurry to enforce, it creates a gap. If it proves too rigid, it discourages the open development that many researchers argue is essential for safety and competition alike. Yochai Benkler's arguments about commons-based production as a counterweight to corporate concentration are directly relevant here — open AI development is one of the few forces that could prevent total market consolidation, and how the Act treats it will shape the field.

The EU AI Act is not the final word on AI governance. It is the first comprehensive attempt, and it will be amended, reinterpreted, and challenged in courts. But it has already established the principle that AI systems are not exempt from democratic accountability — that the question of who benefits and who bears risk is a public question, not a private one. Whether that principle translates into meaningful redistribution of power, or merely into a new compliance industry, depends on what happens next.

The Act also provides a template — imperfect, debatable, but concrete — that other jurisdictions can adapt. The AI Safety Summit Circuit has created forums for international coordination, and initiatives for Democratic AI Governance draw on the EU framework as a reference point. For all its flaws, the Act demonstrates that comprehensive AI regulation is possible, not merely theoretical. That demonstration may prove as consequential as any specific provision.

Where this fits

The EU AI Act is the regulatory anchor for several threads across Redistributed. It directly shapes the Europe's AI Paradox — the tension between wanting to regulate AI and wanting to build a competitive AI industry. Its copyright provisions intersect with the training data copyright fight. Its open-source exemptions connect to the Open Source vs Open Weights debate. And its extraterritorial reach makes it relevant to every company covered in the valuation race, OpenAI's For-Profit Conversion, and Nvidia's $3 Trillion Question stories — all of which involve companies that serve EU markets.

Sources

← Back to all articles
On this page