EU Artificial Intelligence Act

What it is

Regulation (EU) 2024/1689, the Artificial Intelligence Act, is the EU's horizontal law on artificial intelligence. It takes a risk-based approach: some AI practices are banned, high-risk AI systems must meet requirements before and after they are placed on the market, certain systems carry transparency duties, and general-purpose AI models have their own obligations. Its aim is to ensure AI used in the EU is safe and respects fundamental rights while keeping a single market for AI.

Who it applies to

• Providers that develop AI systems or general-purpose AI models and place them on the EU market or put them into service, wherever they are established
• Deployers, meaning organisations that use AI systems under their authority in the course of a professional activity in the EU
• Importers, distributors and authorised representatives of AI systems
• Product manufacturers that integrate AI systems into regulated products
• Providers and deployers outside the EU when the output of the AI system is used in the EU
• Exclusions include AI used exclusively for military, defence or national security purposes, and AI developed and used solely for scientific research

Key points

• Certain practices are banned outright, such as social scoring, manipulative techniques that cause significant harm and untargeted scraping of facial images to build recognition databases
• High-risk AI systems include safety components of regulated products and the use cases in Annex III, such as recruitment, credit scoring, critical infrastructure, education and law enforcement
• Providers of high-risk systems need risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, and appropriate accuracy, robustness and cybersecurity (Articles 9 to 15), plus a quality management system and conformity assessment
• Deployers of high-risk systems must use them according to the instructions, assign human oversight, monitor operation and keep logs, and some must carry out a fundamental rights impact assessment
• Transparency duties require that people know when they interact with an AI system and that synthetic or manipulated content is marked or disclosed
• Providers of general-purpose AI models must keep technical documentation, respect EU copyright law and publish a training content summary, with extra duties such as evaluation, incident reporting and cybersecurity for models with systemic risk
• Organisations must take measures to ensure sufficient AI literacy among staff who operate or use AI systems (Article 4)

Where to start

1. 1Build an inventory of AI systems and models you develop, buy or use, and record your role for each (provider, deployer, importer or distributor)
2. 2Screen the inventory against the prohibited practices and the high-risk categories, and stop or redesign anything prohibited
3. 3Put an AI literacy programme in place and assign ownership of AI governance
4. 4For high-risk or transparency cases, plan the documentation, oversight and supplier information you will need before the relevant application date