The EU AI Act: What It Actually Says

The Four Risk Tiers in Detail

The EU AI Act's risk classification determines exactly what obligations fall on developers and deployers of AI systems.

Unacceptable risk (banned): Social scoring systems by governments that rank citizens based on behavior. Real-time remote biometric identification in public spaces by law enforcement, with narrow exceptions for finding missing children or preventing imminent terrorist attacks. AI systems that exploit vulnerable groups, such as toys that use voice assistants to encourage dangerous behavior in children. Emotion recognition systems in workplaces and schools.

High risk: AI used in critical infrastructure, education (admission and grading systems), employment (hiring and firing algorithms), access to essential services (credit scoring, insurance), law enforcement (predictive policing, evidence evaluation), border management (visa applications, asylum claims), and the justice system (legal research tools that assist judicial decisions). These systems must undergo conformity assessments before deployment.

Obligations for High-Risk AI

Developers of high-risk AI systems must implement a risk management system that identifies and mitigates foreseeable risks throughout the system's lifecycle. They must use representative training data and document data governance practices. The system must be transparent enough for deployers to understand its outputs and limitations. Human oversight mechanisms must allow a human to intervene, override, or shut down the system.

General-purpose AI models (like GPT-4 or Claude) that pose systemic risk face additional obligations: model evaluation, adversarial testing, cybersecurity protections, and reporting of serious incidents. The threshold for 'systemic risk' is tied to compute used in training (initially set at 10^25 FLOPs), though this threshold will be revisited as technology evolves.

Enforcement involves national authorities in each EU member state plus a new European AI Office. Fines scale with company size: up to 35 million euros or 7% of global annual turnover for the most serious violations, whichever is higher.

Implementation Timeline

The AI Act does not take effect all at once. Bans on unacceptable-risk AI apply first, six months after entry into force. Rules for general-purpose AI models follow at 12 months. High-risk system obligations phase in at 24 months for new systems and 36 months for existing systems already on the market. This phased approach gives organizations time to adapt but also means that full enforcement will not be in place until 2027 at the earliest.

Standards bodies (CEN, CENELEC) are developing the technical standards that will define how to comply with the Act's requirements. These standards will determine, for example, exactly what 'representative training data' means in practice, or what level of human oversight is sufficient. The standards process is technically dense and receives far less public attention than the legislation, but it will ultimately determine whether the AI Act has teeth.