Navigate the world's first comprehensive AI regulation

The EU AI Act is the world's first comprehensive legal framework for artificial intelligence. Adopted by the European Parliament in March 2024, it establishes harmonized rules for AI systems in the European Union. The regulation takes a risk-based approach, with stricter requirements for higher-risk applications. It covers AI providers, deployers, importers, and distributors operating in or affecting the EU market.

The EU AI Act applies to: providers (developers) of AI systems placed on the EU market or put into service in the EU, regardless of their location; deployers (users) of AI systems within the EU; providers and deployers outside the EU whose AI output is used in the EU; importers and distributors of AI systems in the EU. The specific obligations depend on the role and the risk classification of the AI system.

The EU AI Act classifies AI into four risk levels: Unacceptable Risk (prohibited practices like social scoring and subliminal manipulation), High Risk (systems affecting safety, rights, or critical decisions such as employment, education, and law enforcement), Limited Risk (transparency obligations for chatbots, deepfakes, and emotion recognition), and Minimal Risk (no specific requirements for spam filters, games, and general recommendations).

General-Purpose AI models like large language models have specific requirements including: technical documentation, transparency about training data, compliance with copyright law, and a summary of content used for training. GPAI models with systemic risk (trained with >10^25 FLOPs) face additional requirements including model evaluation, adversarial testing, incident tracking, and cybersecurity protections.

The EU AI Act establishes tiered penalties: up to 35 million euros or 7% of global annual turnover for violations involving prohibited AI practices; up to 15 million euros or 3% for violations of high-risk system requirements; up to 7.5 million euros or 1.5% for supplying incorrect or misleading information to authorities. SMEs and startups may receive proportionally reduced fines.

The EU AI Act complements GDPR rather than replacing it. While GDPR focuses on personal data protection, the AI Act addresses broader AI safety and rights concerns. Organizations must comply with both: GDPR for any personal data processing in AI systems, and the AI Act for the AI system itself. Data protection impact assessments under GDPR may inform AI Act risk assessments.

High-risk AI systems require comprehensive technical documentation including: general description and intended purpose, detailed design specifications, training and testing data information, development process documentation, risk management system details, quality management procedures, monitoring and post-market surveillance plans, and instructions for deployers.

US companies must comply with the EU AI Act if they: place AI systems on the EU market, provide AI services to EU users, deploy AI in the EU, or have AI outputs used in the EU. This extraterritorial scope means US-based AI developers serving EU customers or deploying systems affecting EU citizens must meet applicable requirements.