EU AI Act sets compliance duties by risk and role
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024, establishing a risk-based framework covering prohibited practices, high-risk systems, general-purpose models and minimal-risk applications. Its reach extends beyond Europe to organizations placing AI systems on the European market or whose AI outputs are used within Europe. Prohibited practices, enforced from 2 February 2025, include harmful manipulation, exploitation of vulnerabilities and certain biometric and emotion recognition uses.
High-risk systems span areas including employment, education, critical infrastructure, credit scoring and law enforcement, with an enforcement target of 2027/2028. Providers and deployers face requirements covering continuous risk management, data quality, technical documentation, human oversight, cybersecurity, conformity assessments and incident reporting. Deployers must also maintain operational oversight and logs, and conduct Fundamental Rights Impact Assessments where required. Minimal-risk applications, such as spam filters, face no additional mandatory requirements, although voluntary codes are encouraged.
General-purpose model obligations, enforced from 2 August 2025, include technical documentation, information for downstream deployers, training-content summaries and copyright policies. Models posing systemic risk face additional evaluation, testing and mitigation duties. Transparency requirements, enforced from 2 August 2026, require disclosure for specified AI interactions and synthetic content, alongside machine-readable markings and watermarking for AI-generated content. Organizations must also foster workforce AI literacy to support responsible deployment.