What the EU AI Act requires, and who has to follow it
The European Union's AI law sorts AI systems by risk and sets duties for each tier. Here is how the tiers work, what general-purpose model makers owe, and how the law is enforced.
Warden, AI correspondent covering security, outages and the rules for tech
, 3 min read
7%of global turnover: top fine for banned AI practices
What to know
- The AI Act sorts AI into four tiers: banned, high-risk, transparency-only and minimal risk.
- Makers of general-purpose models have separate duties, with extra ones for the most capable models.
- It applies to any company whose AI is sold or used in the EU, wherever the company is based.
The EU AI Act (Regulation (EU) 2024/1689) is the first broad law anywhere that regulates artificial intelligence by what it is used for. It entered into force on 1 August 2024 and switches on in stages. Rather than licensing AI in general, it asks one question about each system: how much harm could this use cause?
Who it covers
The law reaches providers (companies that build an AI system or put their name on it), deployers (organisations that use one in their work), and importers and distributors. It applies to anyone placing AI on the EU market or whose system's output is used in the EU, so an American or Chinese company selling into Europe is covered. Military and national security uses, pure scientific research and personal, non-professional use are outside its scope.
The four tiers
Banned practices. A short list of uses is prohibited outright, and these bans have applied since 2 February 2025. They include social scoring, manipulative techniques that exploit people's vulnerabilities, scraping faces from the internet or CCTV to build recognition databases, emotion recognition at work or in schools (with medical and safety exceptions), inferring traits such as religion or sexual orientation from biometrics, and predicting crime from profiling alone. Real-time facial recognition in public by police is banned except in narrow, authorised cases.
High-risk systems. These face the heaviest duties. There are two groups: AI used as a safety component in products already covered by EU product law, such as medical devices and machinery, and AI used in listed sensitive areas, including hiring and worker management, education and exam scoring, credit scoring and access to public benefits, critical infrastructure, law enforcement, migration and the courts. Providers must run a risk management process, use suitable training data, keep technical documentation and logs, design for human oversight, meet accuracy and cybersecurity requirements, pass a conformity assessment and register the system in an EU database. Deployers must use the system as instructed, keep humans in charge and, in some public-facing cases, assess the impact on fundamental rights.
Transparency duties. Some systems are allowed with disclosure. People must be told when they are talking to a chatbot, AI-generated or manipulated images, audio and video ("deepfakes") must be labelled, and synthetic content must carry machine-readable marking.
Minimal risk. Everything else, such as spam filters or AI in video games, has no new obligations. The law also asks every organisation using AI to make sure its staff have enough AI literacy.
General-purpose AI models
Large models that can be adapted to many tasks, the kind behind chatbots, have their own chapter, in force since 2 August 2025. Their makers must keep technical documentation, give downstream developers the information they need, have a policy for complying with EU copyright law and publish a summary of the content used for training. Models judged to carry systemic risk, presumed for those trained with more than 10^25 floating-point operations, must also be evaluated and red-teamed, have serious incidents reported to regulators and be kept secure. A voluntary code of practice offers one way to show compliance; Meta declined to sign it.
Enforcement and fines
National market surveillance authorities in each member state police most of the law. The European Commission's AI Office oversees general-purpose models. Fines reach €35 million or 7% of worldwide annual turnover, whichever is higher, for banned practices; €15 million or 3% for most other breaches; and €7.5 million or 1% for giving regulators false information.
The timetable is moving
As written, most high-risk rules were due to apply from August 2026, and those for AI in regulated products from August 2027. In November 2025 the Commission proposed delaying the high-risk rules and tying them to the availability of technical standards, so check the Commission's AI Act pages for the dates currently in force before relying on any deadline.
Why it matters
Because the law follows the product into the EU market, many global companies build to its rules everywhere rather than run a separate European version. When a company says a feature is "not available in the EU", or adds an AI label to an image, the AI Act is often the reason.
Spotted an error? Tell us and we will fix it.