EU AI Act

The EU AI Act is a law of the European Union for dealing with artificial intelligence, meaning computer programs that learn patterns from data and then generate decisions or texts. It was passed in 2024 and applies directly in all EU member states. The basic idea is simple: not every piece of software with AI is equally dangerous. A music recommendation service and a program that helps decide on job applications are therefore treated completely differently. The law divides applications into risk levels and attaches its own rules to each level. Some uses are banned entirely, others only require a notice to users.

The world’s first comprehensive AI law

The AI Act is the first broadly designed AI law of a major economic area. That makes it relevant beyond Europe as well. Anyone wanting to offer their products on the EU market must comply with it, regardless of whether the company is based in California or Shenzhen. Many companies therefore build their software just once—according to the European rules.

For investors and companies, the costs are of particular interest. Anyone offering a system in the highest regulated risk class must maintain documentation, demonstrate data quality, and ensure human oversight. Violations can result in fines reaching up to 35 million euros or seven percent of worldwide annual revenue. Such figures regularly appear in quarterly reports and risk disclosures.

There is criticism, too. Part of the European tech industry fears that the effort will hit small companies harder than large corporations with their own legal departments. Others consider clear rules an advantage because they build trust and avoid legal disputes.

The four risk levels

The top level is called unacceptable risk. These applications are banned. This includes, for example, the assessment of people according to their social behavior by authorities, or systems that deliberately manipulate people. Mass scraping of faces from the internet for recognition databases also falls under this category.

The second level is high risk. This concerns AI that helps decide on important matters in people’s lives: job applications, credit approval, exam grading, medical devices. Such systems remain permitted, but the provider must prove that risks have been assessed. They must also ensure that a human can monitor the results.

Below that is the level with transparency obligations. A chatbot must disclose that it is a machine. Artificially generated images or videos must be labeled as such. The fourth level covers everything else, such as spam filters or game recommendations, and remains practically unregulated. In addition, there are special rules for very large general-purpose models, such as those behind well-known chat programs.

What changes for users and companies

In everyday life, you notice the AI Act first through notices. If a website tells you that you are talking to an automated assistant, that is a consequence of this transparency obligation. The labeling of AI-generated images on social networks is also partly due to this. If a credit application is rejected, you also have a stronger right to find out that and how software was involved.

In business news, the term usually comes up in two contexts. First, regarding deadlines: the rules take effect in stages, the bans have applied since early 2025, and the obligations for high-risk systems follow later. Second, regarding disputes over whether Europe is holding itself back competitively with this law.

A common misconception is that the AI Act bans AI or certain models in general. That is not the case. What is regulated is the purpose of use, not the technology itself. The same image recognition model may be used to sort photos in a gallery, but is subject to strict requirements as soon as it is used for surveillance in public spaces.