What Is the EU AI Act?
The EU AI Act is the world's first comprehensive legal framework for artificial intelligence. Adopted in 2024, it establishes requirements for AI systems based on their risk level, with the strictest rules applying to high-risk applications.
The Act applies to any organization that places AI systems on the EU market or uses AI systems in the EU, regardless of where the organization is based. This means US, UK, and other non-EU companies may need to comply.
Understanding the Risk Classification
Unacceptable Risk (Prohibited)
These AI systems are banned entirely:
- Social scoring by governments
- Exploitation of vulnerable groups
- Real-time biometric identification in public spaces (with exceptions)
- Manipulation techniques that cause harm
High Risk
These systems face the strictest requirements:
- Critical infrastructure management
- Educational and vocational training
- Employment and worker management
- Access to essential services (credit, insurance)
- Law enforcement and border control
- Administration of justice
Limited Risk
These systems have transparency obligations:
- Chatbots (must disclose AI interaction)
- Emotion recognition systems
- Deepfakes (must be labeled)
Minimal Risk
Most AI systems fall here with no specific requirements, though voluntary codes of conduct are encouraged.
Requirements for High-Risk AI Systems
Risk Management System
Implement a risk management system throughout the AI system's lifecycle, including:
- Identification and analysis of known risks
- Estimation and evaluation of risks
- Adoption of risk management measures
Data Governance
Training, validation, and testing data must be:
- Relevant and representative
- Free from errors and complete
- Subject to appropriate data governance
Technical Documentation
Maintain documentation that demonstrates conformity, including:
- System description and intended purpose
- Design specifications
- Monitoring and testing procedures
Record Keeping
Automatic logging of events (logs) to ensure traceability:
- Recording relevant events
- Identifying when and how decisions are made
- Enabling post-market monitoring
Transparency
Information for users including:
- Identity of the provider
- Intended purpose and limitations
- Accuracy and known risks
Human Oversight
Enable human oversight through:
- Understanding system capabilities and limitations
- Ability to interpret outputs
- Ability to override or stop the system
Accuracy, Robustness, and Cybersecurity
Ensure appropriate levels of:
- Accuracy for the intended purpose
- Robustness against errors and inconsistencies
- Cybersecurity throughout the lifecycle
Timeline and Deadlines
- 2024: Act enters into force
- 6 months: Prohibited practices apply
- 12 months: GPAI rules apply
- 24 months: Most provisions apply
- 36 months: High-risk systems in Annex III apply
How to Prepare
Step 1: Inventory Your AI Systems
Document all AI systems in use and their purposes.
Step 2: Classify Risk Levels
Determine which of your systems fall into each risk category.
Step 3: Gap Analysis
Compare current practices against requirements for each risk level.
Step 4: Implementation Plan
Create a prioritized plan to address gaps before deadlines.
Next Steps
Get your free AI Accountability Score to understand your current governance posture. For organizations subject to the EU AI Act, the Documentation System provides templates aligned with regulatory requirements.