Europe's AI Act Comes into Force

The world's first comprehensive AI law begins reshaping how the technology is developed, sold, and used.

A Historic Moment for Technology Law

On 1 August 2024, the European Union's Artificial Intelligence Act came into force, becoming the world's first comprehensive law dedicated to regulating artificial intelligence. The legislation introduces a risk-based approach, classifying AI systems into four categories according to the level of threat they pose to fundamental rights. Officials have described the act as a historic attempt to balance innovation with the protection of citizens. Once fully applied, the rules will affect every company that develops, sells, or uses AI within the EU's single market.

A Risk-Based Framework

The new law sorts AI applications into four tiers. Systems considered to pose an unacceptable risk are banned outright. High-risk systems, such as those used in medical devices or recruitment, must meet strict requirements before they can be deployed. Limited-risk tools face lighter transparency duties, while minimal-risk systems, such as spam filters, are largely unregulated. Supporters argue this tiered structure offers clarity, while critics warn it may slow down smaller companies trying to launch new products.

What Gets Banned

The list of prohibited practices is the first to come into force in practice. Authorities have outlawed social scoring systems that rank citizens based on behaviour, as well as AI that exploits the vulnerabilities of children or disabled people. Real-time remote biometric identification in public spaces is forbidden, with narrow exceptions for serious crime. Emotion recognition software in schools and workplaces is also off the table, reflecting concerns about surveillance and manipulation in everyday environments.

High-Risk Territory

High-risk systems are expected to undergo rigorous testing, documentation, and human oversight. Companies must prove compliance through technical files, risk assessments, and quality management systems. If a product causes harm, the developer may face liability claims under EU product safety rules. The law also requires providers to register high-risk systems in a public database, giving regulators and researchers a clearer view of how the technology is being used across industries.

Rules for General AI Models

The Act introduces specific provisions for general-purpose AI models, including large language models such as the systems behind popular chatbots. Developers must provide summaries of training data, respect copyright law, and cooperate with national authorities. Firms whose models reach a certain computing threshold face additional duties, including reporting serious incidents and enforcing safeguards against systemic risks. The goal, officials say, is to ensure that the most powerful models cannot undermine elections, public health, or financial stability.

Enforcement and Global Reach

National market surveillance authorities in each EU country will handle day-to-day enforcement, while a new European AI Office will coordinate the phased rollout. Most rules will apply by mid-2026, with some stringent obligations kicking in later. Penalties for the most serious violations can reach €35 million or 7% of global annual turnover, whichever is higher. Many experts anticipate a strong Brussels Effect, as foreign companies may adopt EU standards to remain competitive in one of the world's largest markets.