Key facts

• Name: Regulation (EU) 2024/1689 [...] laying down harmonised rules on artificial intelligence [...] (Artificial Intelligence Act).
• Tagline: “First-ever comprehensive legal framework on AI worldwide” (European Commission).
• Type: EU AI Act is a “Regulation”, meaning it directly applies to all EU Member States without requiring national implementation.
• Entry into Force: August 1, 2024
• Origin: Follows three years of discussion since the EU Commission's initial proposal in April 2021.

Who is caught? ^{(*simplified, check exact definitions)}

• Territorial reach: Applies to AI systems in the EU or affecting the EU, regardless of the company's location.
• Providers: who develops AI systems, or has an AI system developed and places it on the market or puts it into service under its own name or trademark.
• Deployers: who use AI systems in their business operations.
• “AI Systems” align with OECD's technology-neutral criteria, very broad but excludes simpler software and purely rule-based systems.
• Exclusions: military, personal non-professional, and certain research applications.

What does almost every company have to comply with?

Transparency obligations, like informing users about AI interactions (e.g., "This website uses AI for personalised recommendations") and ensuring staff handling AI systems are properly trained (e.g., understanding potential biases in AI-generated outputs).

What is prohibited?

Examples: Using subliminal or deceptive techniques to impair decision-making (e.g., manipulative advertising, hidden nudges); exploiting personal vulnerabilities (e.g., predatory lending, addictive games targeting children); creating or expanding facial recognition databases by scraping images without targeted consent (e.g., mass surveillance, unauthorized biometric data collection); infering emotions from individuals in workplace or educational settings (e.g., emotion-based performance monitoring, discriminatory hiring practices); categorising individuals based on biometric data to infer sensitive personal information (e.g., racial profiling, social scoring systems). Certain exceptions exist for law enforcement with strict safeguards.

What is not prohibited, but strictly regulated?

• High-risk AI systems fall into two categories: (i) AI systems used as a safety component of a product (or otherwise subject to EU health and safety harmonisation legislation); and (ii) AI systems deployed in specific areas, e.g., education, employment, access to essential services, law enforcement, migration, justice.
  ‍
• GPAI Models can be used as the technical foundation of various generative AI systems such as chatbots or image and video generators. They must maintain detailed technical documentation, share information with downstream providers, adopt a copyright compliance policy, and disseminate summaries of training content. Highly powerful GPAIs are subject to additional obligations.

Risk classification under the EU AI Act

Who is responsible for enforcement?

• National authorities (still to be identified): market surveillance, most enforcement work.
• EU AI Office: high-risk AI systems, GPAIs, oversight over and coordination of national authorities.
• European Commission: cross-border issues, policy guidance.

Consequences of non-compliance

Potentially very high penalties imposed by regulators; 3rd party damage claims.

When do the obligations start applying?

Full effect after transitional period (generally 2026, but certain obligations apply earlier).