EU AI Act

The EU AI Act is product-safety style legislation applied to AI. It sorts systems by risk: a short list of practices is prohibited outright; high-risk systems, such as those used in hiring, credit, education or critical infrastructure, must meet requirements on risk management, data governance, documentation, logging, transparency, human oversight, accuracy and robustness before entering the market; some systems carry specific transparency duties, such as chatbots and deepfakes; everything else remains largely unregulated by the Act. General-purpose AI models have their own set of obligations.

Obligations depend on the role an organization plays, mainly provider or deployer, and the Act reaches organizations outside the EU when their AI systems or outputs are used in the Union. Its application is phased and the schedule has been adjusted by later EU legislation, so dates should always be checked against the current text on EUR-Lex. The Act complements, and does not replace, the GDPR whenever personal data is processed.