EU AI Act
What it means
What is the EU AI Act?
The EU AI Act is an EU regulation, in force since August 2024, that sorts AI systems into risk tiers and sets legal obligations that scale with the tier, heaviest for high-risk systems.
Formally Regulation (EU) 2024/1689, the Act entered into force on 1 August 2024. It sorts AI systems into a risk ladder, from banned practices, to a high-risk category, to a lighter set of transparency duties. High-risk covers things like hiring, credit and law enforcement. The lighter duties apply to systems such as chatbots. The Act leaves everything else largely unregulated.
Obligations scale with the tier. High-risk systems carry duties such as a conformity assessment, technical documentation, human oversight, and registration in an EU database. The Act applies to any company whose AI system is used in the EU, not only companies based there. That is why a US-based startup with European customers cannot treat this as someone else's problem.
In practice, the Act changes what "we did not think about that" costs. For a high-risk use case, a company now needs a documented risk assessment and a named point of human oversight. The company also needs evidence of both, ready before a regulator or a customer's legal team asks.
Published · Updated
In practice
Why it comes up
It comes up the moment a company has, or wants, a customer in the EU, regardless of where it is based. A customer’s legal team asks which risk tier your product falls into before they sign, because their own exposure depends on your answer. A board asks about it once a competitor gets fined, or a customer raises it at renewal. The Act follows the AI system’s users, not the provider’s registered address.
What to do about it
Work out which risk tier each AI system falls into. Most products used inside a normal business are not high-risk. A few categories, hiring and credit among them, almost always are high-risk and deserve a real legal read.
For anything near the high-risk category, start the paperwork now: a risk assessment, a named oversight point, and technical documentation. For everything else, keep the register entry current, so the answer is a lookup, not a scramble.
Sources and neighbours
Sources
- Regulation (EU) 2024/1689 (EU AI Act)
eur-lex.europa.eu
- EU AI Act, consolidated text
eur-lex.europa.eu