What is the EU AI Act?

Definition

The EU AI Act is a European Union regulation (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) that governs the development, placing on the market, and use of artificial intelligence systems using a risk-based framework.

Background

The EU AI Act sorts AI by risk. A small set of practices deemed an unacceptable risk are prohibited. High-risk systems (for example, certain uses in employment, education, or critical infrastructure) must meet requirements such as risk management, data governance, technical documentation, human oversight, and accuracy and robustness. Some systems that interact with people carry transparency obligations. Separately, providers of general-purpose AI (GPAI) models have their own set of obligations. The regulation entered into force in 2024, with its obligations applying in stages. Regulation (EU) 2026/1744, the Digital Omnibus on AI, amended it, and the amendment entered into force on 27 July 2026. It adds two prohibited practices from 2 December 2026: AI that generates or manipulates intimate or sexually explicit material of an identifiable person without their consent, and AI that generates or manipulates child sexual abuse material. It replaces the AI literacy duty in Article 4, which binds every provider and deployer whatever the risk tier. It also adds Article 4a, which sets strict conditions under which providers and deployers may process special categories of personal data to detect and correct bias. Its short title is the Artificial Intelligence Act, and it is often called the European AI Act. The prohibited practices include social scoring, untargeted scraping of facial images to build facial recognition databases, emotion recognition in workplaces and schools (except for medical or safety reasons), and real-time remote biometric identification in public spaces for law enforcement outside narrow exceptions. The original Article 5 prohibitions have applied since 2 February 2025.

Why it matters

The AI Act has extraterritorial reach: it can apply to providers and deployers outside the EU when their AI systems are used in the EU. For any company building or deploying AI that touches the EU market, it is becoming a core compliance consideration, with meaningful penalties for non-compliance. Enforcement is split. Each member state designates national authorities, including market surveillance authorities, to supervise AI systems on its market. The European Commission’s AI Office supervises general-purpose AI models, and a General-Purpose AI Code of Practice published in 2025 gives their providers a voluntary way to show how they meet those obligations. The highest fines are reserved for prohibited practices.

Step by step

1. Inventory the AI systems you build or use and where they are used.
2. Classify each by the Act’s risk tiers (prohibited, high-risk, transparency, or minimal).
3. Work out your role for each system: provider, deployer, importer or distributor. Most obligations attach to a role, and one company can hold different roles for different systems.
4. Check whether a use falls in a high-risk area listed in Annex III, such as employment, education, access to essential services, law enforcement or migration, or whether the AI is a safety component of a product covered by the legislation listed in Annex I.
5. For high-risk systems, implement the required controls (risk management, data governance, documentation, human oversight).
6. Meet transparency duties where systems interact with people or generate content.
7. Take measures to support AI literacy among staff and anyone else who operates or uses AI systems for you.
8. Track the staged application dates that apply to your systems, using the Act as amended in 2026 rather than the original 2024 text.

Examples

• A vendor whose AI is used by EU customers assesses whether any use is high-risk and prepares the required documentation and oversight.
• A provider of a general-purpose AI model reviews the GPAI obligations that apply to it.
• An HR software company sells a CV-screening feature to employers in the EU. Recruitment is a listed high-risk use, so the company prepares as the provider of a high-risk system, and each employer using it takes on deployer duties such as human oversight and monitoring.

Common mistakes

• Assuming it only applies to EU-based companies; it can reach providers and deployers outside the EU when AI is used in the EU.
• Treating all AI as high-risk; the Act is tiered, and most systems are not high-risk.
• Confusing the AI Act (law) with ISO 42001 (a voluntary certifiable standard).
• Ignoring a customer-facing chatbot because it is not high-risk. The Article 50 duty to tell people they are interacting with an AI system can still apply.

FAQ