Artificial Intelligence Act

• 1. Introduction

  ›

  On the 13th of March 2024, the Artificial Intelligence Act passed the European Parliament with 523 votes in favour, 46 against, and 49 abstaining. The EU Council approved it unanimously on the 21st of May 2024. The law had been nearly four years in the making. The European Commission first published a white paper on artificial intelligence in February 2020. Formal debate among EU leaders followed in October of that year, and the Commission's official proposal arrived on the 21st of April 2021. Between 2021 and 2023, a new generation of AI systems emerged that the original framework had not anticipated. The draft was substantially revised as a result. What exactly does this law ban? Who must comply, and who is exempt? And can a regulation written in Brussels actually govern AI systems built on the other side of the world? The Act entered into force on the 1st of August 2024, its various provisions phasing in over the following six to thirty-six months.

  46121442

• 2. The Risk Ladder

  ›

  Real-time facial recognition in public spaces is among the AI applications the Act bans outright. The "unacceptable risk" tier also includes systems that manipulate human behaviour and those used for social scoring. Social scoring ranks individuals by their personal characteristics, socio-economic status, or behaviour.

  Health, education, and recruitment are three of the sectors the Act classifies as high-risk. Law enforcement and justice are included too, along with critical infrastructure management. High-risk systems must meet obligations around quality, transparency, human oversight, and safety. In some cases they also require a Fundamental Rights Impact Assessment, an advance review designed to identify potential harms before deployment. Citizens affected by a high-risk AI decision have the right to submit complaints and to receive explanations. The list of high-risk applications can also be expanded over time without modifying the Act itself.

  Video games and spam filters sit in the "minimal risk" tier, where no regulation applies. Member states cannot impose additional rules here, and any existing national laws governing the design of such systems are overridden. The "limited risk" tier, sitting just above, applies to systems such as deepfakes. These carry transparency obligations only, requiring that users be told they are interacting with AI. Even at the top of the ladder, the bans carry exceptions. Real-time biometric surveillance is permitted when police can demonstrate a real and present or real and foreseeable threat of terrorist attack.

  271593119

• 3. The General-Purpose Problem

  ›

  ChatGPT's rise in popularity forced the Act's drafters to rethink the entire framework. The original design assumed each AI system had a defined purpose. ChatGPT's general-purpose capabilities did not fit that framework. After three days of "marathon" talks, EU negotiators reached an agreement on the 9th of December 2023. A new category was added for general-purpose AI.

  Open-source models carry lighter obligations under the general-purpose AI rules. If a provider makes the model's weights and design openly available, it must publish a training data summary and a copyright policy. Closed-source providers face broader transparency requirements. High-impact models form a third group: those requiring more than 10 to the power 25 floating-point operations to train are considered to pose systemic risks. Such models must undergo adversarial testing, assess and mitigate risks such as bias and security failures, report serious incidents, and maintain adequate cybersecurity.

  A General-Purpose AI Code of Practice, published on the 10th of July 2025, set out three main chapters covering transparency, copyright, and safety and security. Participation in the code is voluntary, designed to help providers demonstrate compliance with the Act's underlying obligations. Thirty-eight global creators' organisations have argued that the code falls short on intellectual property transparency. A joint statement reported by Le Monde described the outcome as a missed opportunity.

  232425554

• 4. Enforcement Architecture

  ›

  Four new bodies sit at the centre of the Act's governance structure. The AI Office, attached to the European Commission, coordinates implementation across all member states and oversees compliance among general-purpose AI providers. It can request information or open investigations when serious issues are suspected. The European Artificial Intelligence Board draws one representative from each member state and advises the Commission on consistent application. An Advisory Forum brings in a balanced selection of stakeholders, including industry, start-ups, civil society, and academia. A Scientific Panel of Independent Experts advises the AI Office and national authorities on technical matters. It can also launch what the Act calls "qualified alerts" of possible risks.

  CEN/CENELEC Joint Technical Committee 21 is responsible for drafting the harmonised technical standards that underpin the Act's requirements. Once those standards appear in the EU's Official Journal, compliant products are presumed to conform with the regulation. Conformity assessments verify whether individual AI systems meet those standards. Providers may conduct self-assessments, or a third-party notifying body may carry out the review. Each member state must also designate a national supervisory authority to monitor compliance and handle complaints.

  Violations of the Act's outright prohibitions carry fines of up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. Other violations may be fined up to 15 million euros or 3 percent of turnover. Providing incorrect or misleading information carries a cap of 7.5 million euros or 1 percent. For SMEs and start-ups, the applicable cap is whichever figure is lower, moderating the burden on smaller operators. Regulatory sandboxes allow developers to test AI systems under official supervision before going to market. Small and medium-sized enterprises may receive priority access to these testing environments.

  2829323143

• 5. A Contested Blueprint

  ›

  Anu Bradford at Columbia Law School has argued that the Act gives significant momentum to the worldwide movement to regulate AI. Legal commentators widely described it as the first comprehensive attempt to govern AI across multiple sectors. It has been called a likely reference point for regulators and companies beyond Europe. Like the General Data Protection Regulation, the Act can apply extraterritorially to providers based outside the EU if they have users within it.

  Amnesty International argued that the legislation fails to take basic human rights principles into account. The organisation said it does not ban what it calls "draconian AI technologies," and offers inadequate protection for migrants, refugees, and asylum seekers. La Quadrature du Net called the Act tailor-made for the tech industry and European police forces. The group pointed to the suspicion score used by France's Caisse d'allocations familiales as an example it says the Act's exemptions would permit. European Digital Rights, coordinating a broad coalition, concluded that the final law falls short on privacy, equality, non-discrimination, and the presumption of innocence.

  The American and Chinese startup ecosystems, some European founders argued, would face fewer compliance burdens under the Act. Others in the startup community welcomed the clarity it provides. Technology watchdogs warned of major loopholes that would allow large technology companies to entrench their advantage in AI.

  Legal scholars have described what they call the "Synthetic Outlaw" problem: a system can satisfy formal compliance requirements while still producing prohibited outcomes. Academic commentary has also described the Act as a "medley" of product-safety and fundamental-rights frameworks, with its product-safety approach relying heavily on provider self-assessment. Environmental scholars have raised a further concern: the Act's risk categories make no provision for the energy consumption and resource demands of large-scale AI training. Trained models store their learned patterns as parameters, a type of data typically classified as non-personal. This puts them outside the reach of the General Data Protection Regulation. Some scholars have criticised the Act for not adequately regulating how trained model parameters are reused.

  5450583953