The EU AI Act: The World's First Comprehensive AI Regulation

The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive legal framework specifically governing artificial intelligence. Adopted by the European Parliament in March 2024 and entering into force in August 2024, it applies to any AI system offered in or affecting people within the EU, regardless of where the provider is based. ## Risk-Based Classification The Act categorizes AI systems into four risk tiers: **Unacceptable risk (banned):** Social scoring systems (rating citizens based on behavior), real-time remote biometric identification in public spaces (with narrow law enforcement exceptions), emotion recognition in workplaces and schools, and AI that exploits vulnerabilities of specific groups (children, disabled persons). **High risk (regulated):** AI used in hiring and recruitment, credit scoring, education grading, law enforcement, migration/asylum decisions, and critical infrastructure management. These systems must meet requirements for risk management, data governance, technical documentation, transparency, human oversight, and accuracy/robustness. **Limited risk (transparency required):** Chatbots and AI-generated content must be clearly labeled as AI-produced. Deepfakes must be disclosed. **Minimal risk (unregulated):** Most AI applications — spam filters, AI-powered games, inventory management. No additional requirements beyond existing law. ## General-Purpose AI Models Foundation models and general-purpose AI (including GPT, Claude, Gemini) face specific obligations: maintaining technical documentation, providing information to downstream deployers, complying with EU copyright law, and publishing a summary of training data. Models with "systemic risk" (generally those trained with more than 10^25 FLOPs) face additional requirements including adversarial testing, incident reporting, and cybersecurity measures. ## Implementation Timeline Phased rollout: bans on unacceptable-risk AI took effect February 2025. General-purpose AI model obligations apply from August 2025. High-risk system requirements apply from August 2026, with some extensions to August 2027. ## Global Impact The Act establishes the "Brussels Effect" for AI regulation — companies serving EU customers must comply regardless of headquarters location, effectively setting a global standard. The approach contrasts with the US (primarily voluntary commitments and sector-specific regulation) and China (focused on content control and algorithmic transparency requirements). Two Revolutions Stacking: The Internet Plus AI Regulation Dilemma