The European Union’s Artificial Intelligence Act (REGULATION (EU) 2024/1689) introduces a structured regulatory framework aimed at managing risks associated with AI technologies while allowing innovation. Unlike a general AI law, this regulation applies specifically to AI systems placed on the EU market and follows a risk-based approach. Companies developing or using AI within the EU need to understand the key rules, particularly those on high-risk AI systems, transparency requirements, and compliance obligations.
Defining AI Under the Regulation
The AI Act relies on a broad definition of AI, covering systems that operate with a degree of autonomy, process input data, and adapt over time. It includes both traditional rule-based algorithms and machine learning models. Essentially, if a system can learn patterns or make decisions without human intervention, it falls under the regulation. The definition is outlined in Article 3, Paragraph 1, with additional clarifications provided in recent EU guidelines from February 6, 2025.
What AI Practices Are Prohibited?
Certain AI applications are outright banned in the EU due to their high potential for harm to individuals or democracy. Article 5 explicitly forbids:
- AI-based social scoring systems, where personal data is collected throughout a person’s life to assess their “worthiness.”
- Real-time biometric identification in public spaces, except for very limited law enforcement scenarios, such as preventing imminent terrorist attacks or locating missing persons.
- AI that manipulates human behavior in ways that significantly distort free will.
- Mass facial recognition data collection from publicly available images or videos, unless there is explicit consent.
These prohibitions aim to safeguard privacy and prevent potential abuses of AI technology.
High-Risk AI: Extra Compliance Burdens
AI systems classified as high-risk must meet stricter requirements. These include:
- AI used in employment and HR, such as recruitment screening tools.
- AI in justice and democratic processes, like systems assisting in judicial decision-making.
- AI that affects critical infrastructure, including energy, water supply, and digital networks.
- AI models used in healthcare, financial services, and law enforcement.
High-risk AI systems must undergo independent audits, ensuring their accuracy, reliability, and cybersecurity standards. The AI provider must also maintain extensive technical documentation and guarantee human oversight.
Transparency and Explainability
The regulation emphasizes that AI-generated outputs must be understandable, especially for users interacting with chatbots, image generators, or other generative AI tools. Companies must clearly disclose when content is AI-generated and explain how decisions were reached. Reverse engineering of AI outputs should be possible, allowing users and regulators to trace how the AI arrived at a given response.
Who Needs to Comply?
Compliance obligations depend on the role a company plays in the AI supply chain:
- Developers and providers of high-risk AI systems must meet strict documentation, accuracy, and cybersecurity standards.
- Importers and distributors serve as gatekeepers, making sure that AI systems from non-EU countries comply with EU standards before entering the market.
- End users (businesses using AI tools) have fewer obligations but may still be required to monitor and document AI performance.
For companies integrating AI into their operations, it’s advisable to start reviewing their AI usage and assess whether their systems fall under high-risk or prohibited categories. Some AI models, classified as general-purpose AI, are not inherently high-risk. However, if these systems scale up or exert significant influence, additional obligations may apply. The regulation introduces systemic risk requirements for large-scale AI models, ensuring their potential impact is monitored and assessed.
Final Thoughts
The AI Act sets clear boundaries on AI development and use within the EU. It is not a ban on AI but rather a structured approach to balancing innovation with risk mitigation. Companies should stay informed about these regulations, especially if they are developing or integrating AI into their workflows. While there are compliance requirements, they are not insurmountable and will help build trust in AI technologies moving forward.
By assessing AI systems for potential risks and ensuring adherence to EU standards, companies can reduce exposure to legal and reputational risks. With the proper guidance, AI implementation can open doors to innovation and growth, all while keeping within the regulatory framework.
Through our contact form, we are readily available to provide you with the required assistance in this field and guide you through the complexities of AI regulation.
