The European Union's Artificial Intelligence Act, adopted in 2024, is the first broad legal framework dedicated to AI. Its reach extends beyond Europe: organisations that place AI systems on the EU market, or whose systems' outputs are used in the EU, can fall within scope.
A risk-based structure
Rather than regulating AI as a single technology, the Act groups systems according to the risk they pose.
- Unacceptable risk — certain practices, such as manipulative techniques that exploit vulnerabilities or social scoring by public authorities, are prohibited.
- High risk — systems used in sensitive areas such as employment, education, critical infrastructure and access to essential services must meet requirements on risk management, data governance, documentation, transparency, human oversight and accuracy.
- Limited risk — transparency duties, for example making clear when people are interacting with an AI system or viewing AI-generated content.
- Minimal risk — most everyday applications, with no specific new obligations.
General-purpose AI models
The Act also introduces obligations for providers of general-purpose AI models, including technical documentation and information for downstream developers, with additional duties for models considered to pose systemic risk.
Phased obligations
The requirements apply in stages rather than all at once, with prohibitions applying first and the fuller high-risk regime later. Teams should check the current official timeline for the provisions relevant to them, as guidance and implementation details continue to be published.
Compliance starts with a simple question most organisations still can't answer: where, exactly, are we using AI today?
Five actions to take now
- Build an inventory of AI systems in use, in development and procured from vendors.
- Classify each system against the Act's risk categories and record the rationale.
- Assign accountable owners for each high-risk or customer-facing system.
- Map existing controls to recognised frameworks such as the NIST AI RMF and ISO/IEC 42001.
- Invest in AI literacy so that staff who build, buy and use AI understand their responsibilities.
Key takeaways
- The Act is risk-based: obligations scale with the potential for harm.
- Some practices are prohibited outright; high-risk systems carry the heaviest duties.
- Obligations apply in phases, so timelines matter for planning.
- An AI inventory and clear ownership are the foundation for compliance.
