What is the EU AI Act?
The EU AI Act is the European Union’s regulation of artificial intelligence. It is the first comprehensive AI law from a major economy, adopted in 2024 as Regulation (EU) 2024/1689. It sorts AI systems by the risk they pose to health, safety, and fundamental rights, bans a short list of practices outright, and places detailed duties on the providers and deployers of systems it classifies as high-risk. A separate chapter covers general-purpose AI models, the large models that other products are built on.
The Act reaches beyond Europe. It applies to any company that places an AI system on the EU market or puts one into service there, and to deployers located in the EU, wherever the company is based. It also applies where a system’s output is used in the EU. A US distributor with a European subsidiary, or a software vendor with European customers, is in scope.
How the EU AI Act works
The central mechanism is AI risk classification. Every system falls into one of four tiers, and the tier determines the obligations.
| Tier | Examples | What the Act requires |
|---|---|---|
| Unacceptable risk | Social scoring by public authorities, manipulative techniques that cause harm, emotion recognition in workplaces and schools, untargeted scraping of facial images | Prohibited |
| High risk | AI in regulated products such as medical devices and lifts, plus listed uses in hiring, credit scoring, education, essential services, law enforcement, and critical infrastructure | Risk management system, data governance, technical documentation, logging, human oversight, conformity assessment, registration, post-market monitoring |
| Limited risk | Chatbots, systems that generate synthetic images, audio, video, or text | Transparency obligations: tell people they are dealing with AI and mark generated content |
| Minimal risk | Spam filters, inventory forecasting, most recommendation engines | No new obligations, voluntary codes of conduct |
Providers of general-purpose AI models must keep technical documentation, publish a summary of training content, and maintain a copyright policy. Models judged to carry systemic risk face added duties around evaluation, incident reporting, and cybersecurity. A company that fine-tunes and redistributes a model can take on provider duties for the modified model. Enforcement sits with national market surveillance authorities in each member state and with the European AI Office for general-purpose models, and fines are tiered by the severity of the breach.
Why the EU AI Act matters
For most mid-sized companies, the practical effect is an obligation to know what AI they run and in which tier it sits. A manufacturer whose machine includes an AI safety function faces the full high-risk regime through product legislation. A staffing agency whose software ranks candidates is a deployer of a high-risk system, with duties on human oversight, logging, and informing workers. A retailer whose site runs a customer chatbot owes only a disclosure. Getting the classification wrong in either direction is expensive, because over-classifying buries a harmless tool in paperwork and under-classifying leaves a regulated system undocumented.
The Act also changes vendor relationships. Buyers of high-risk systems need the provider’s instructions for use, technical documentation, and declaration of conformity, and contracts increasingly spell out who handles which obligation.
The EU AI Act in practice
A European freight forwarder reviews its systems. Route optimization and demand forecasting land in minimal risk. A tool that screens job applications is high-risk under the employment annex, so the HR director becomes the deployer owner, the vendor supplies its conformity documentation, and recruiters are trained to override the ranking and told that the logs are kept. The customer-facing shipment chatbot gets a one-line disclosure. The exercise takes a few weeks and produces the AI inventory the company never had.
Getting started with the EU AI Act
The obligations apply in stages. Prohibitions came first, then duties for general-purpose model providers, with most high-risk requirements following later and product-embedded systems getting the longest runway. An amending regulation adopted in 2026 as part of the EU’s digital simplification package pushed back the high-risk deadlines, softened the AI literacy duty, and moved AI in machinery under the Machinery Regulation, so confirm the current consolidated text before setting a compliance plan. A sensible first step is an AI inventory with a provisional tier for each system, followed by a gap analysis for anything high-risk and a review of disclosures for everything customer-facing.
What to watch for
- Decide for each system whether you are the provider or the deployer, because the duties differ sharply.
- Check both annexes, since a system can be high-risk because of the product it sits in or because of what it is used for.
- Do not assume a US-only company is out of scope if its output reaches people in the EU.
- Keep the reasoning for every classification on file, because authorities can ask for it.
- Track the harmonized standards as they are published, because following them creates a presumption of conformity.