The EU AI Act is the world's first comprehensive AI regulation. It took effect in stages from 2024-2026 and serves as a template for global AI regulation.

Risk-Based Classification

The Act classifies AI systems into four risk tiers:

Unacceptable risk (banned):

• Social scoring by governments
• Real-time biometric surveillance in public spaces (with limited exceptions)
• Subliminal manipulation causing harm
• Exploitation of vulnerable groups

High risk (heavily regulated):

• Biometric identification systems
• Critical infrastructure management
• Education and vocational training (admissions, grading)
• Employment (recruitment, promotion, termination)
• Essential services access (credit scoring, insurance)
• Law enforcement and justice
• Immigration and border control

Limited risk (transparency obligations):

• Chatbots (must disclose AI nature)
• Deepfakes (must be labeled)
• Emotion recognition systems (must inform users)

Minimal risk (no requirements):

• AI-enabled video games
• Spam filters
• Most general-purpose AI applications

Requirements for High-Risk AI

Organizations deploying high-risk AI must:

1. Risk management system: Document risks, mitigation measures, and residual risks
2. Data governance: Ensure training data quality, relevance, and representativeness
3. Technical documentation: Detailed system description, design choices, and performance metrics
4. Record keeping: Automatic logging of system operation for traceability
5. Transparency: Clear user information about the system's capabilities and limitations
6. Human oversight: Meaningful human control over AI decisions
7. Accuracy & robustness: Testing for accuracy, security, and resilience
8. Conformity assessment: Third-party or self-assessment before market placement

General-Purpose AI (GPAI) Rules

Foundation models like GPT-4 and Gemini have specific obligations:

• Technical documentation and training data summaries
• Copyright compliance policies
• Models with "systemic risk" (>10^25 FLOPs training compute) face additional requirements: adversarial testing, incident reporting, cybersecurity measures

Penalties

• Up to €35 million or 7% of global turnover for using banned AI practices
• Up to €15 million or 3% for non-compliance with other provisions
• Up to €7.5 million or 1.5% for providing incorrect information