EU Artificial Intelligence Act

The EU AI Act is the world's first comprehensive, horizontal legal framework for regulating artificial intelligence. It entered into force on August 1, 2024 and applies to any organization — regardless of where it is headquartered — that places AI systems on the EU market, uses AI systems within the EU, or produces AI-generated outputs consumed by EU users.

​

The framework regulates based on risk. The highest tier, unacceptable-risk AI, has been prohibited since February 2, 2025. This covers practices such as manipulative subliminal techniques, social scoring by public authorities, and real-time biometric surveillance in public spaces. General-purpose AI (GPAI) model obligations — including technical documentation requirements, transparency duties, and copyright compliance — took effect August 2, 2025. High-risk AI systems (defined in Annex III and covering areas such as employment decisions, critical infrastructure, education, and access to essential services) must be fully compliant by August 2, 2026.

 

For companies deploying AI in hiring, performance management, customer scoring, procurement, or any process affecting access to essential services, this deadline is binding and the penalty structure is severe: up to €35 million or 7% of global annual turnover for prohibited practices, and up to €15 million or 3% for high-risk violations. The Act has full extraterritorial scope — identical to the GDPR model.

 

Businesses should conduct an AI inventory mapping every system they develop, deploy, or procure; classify each against the risk tiers; and implement the governance, documentation, and human oversight requirements before August 2026.