EU AI Act and AI Regulation

The EU AI Act is the first broad law of a major economy dedicated to artificial intelligence. It entered into force on 1 August 2024 and applies in stages. It covers anyone placing AI systems on the EU market or using them in the EU.

Its core idea is risk-based regulation:

• Unacceptable risk (banned): for example social scoring by public authorities, manipulative systems that exploit vulnerabilities, emotion recognition at work and in schools, and, with narrow exceptions, real-time remote biometric identification in public spaces for law enforcement (see face recognition). These bans apply since 2 February 2025.
• High risk: AI used in areas like hiring, credit scoring, education, critical infrastructure, law enforcement and medical devices. Providers need risk management, data quality controls (bias and fairness), technical documentation, logging, human oversight and accuracy and robustness testing.
• Limited risk (transparency): chatbots must disclose that they are AI; deepfakes and generated content must be labeled.
• Minimal risk: most AI, such as spam filters or game AI, has no new obligations.

General-purpose AI models, such as the LLMs behind chat assistants, have their own rules since 2 August 2025: technical documentation, copyright policies and a summary of training content. The most capable models, deemed to carry systemic risk, must also run evaluations including adversarial testing (red teaming), report serious incidents and ensure cybersecurity.

Deadlines for the high-risk rules have been subject to later amendment proposals, so check the official sources for the current timeline. Other jurisdictions are taking different approaches, from sector-specific rules to voluntary frameworks.