Artificial intelligence is no longer an emerging technology. It screens job applicants, approves loans, flags fraud, and powers the tools your teams use every day. For years, it did all of this without any binding legal framework governing how it should work, who was responsible when it didn't, or what rights the people affected by it had.
That changed in 2024. The EU AI Act, the world's first comprehensive legal framework for artificial intelligence, is now in force. If your organization develops, sells, or uses AI systems that affect people in the European Union, it applies to you.
How it works
The Act uses a risk-based approach: the higher the potential for harm, the stricter the rules. Every AI system that falls under the regulation is assigned to one of four risk tiers, and that tier determines what your organization needs to do.
-
Unacceptable risk: prohibited outright. These are AI practices the EU considers a fundamental threat to people's rights and safety. They are banned entirely. Examples include social scoring systems that rank citizens based on their behavior, AI that manipulates people psychologically to influence their decisions, and real-time facial recognition in public spaces.
-
High risk: permitted, but strictly regulated. This is the tier most organizations need to pay close attention to. High-risk AI systems are allowed, but they come with significant compliance obligations. This includes AI used in hiring and recruitment, credit scoring, healthcare, education, border control, and law enforcement. If you operate in any of these areas, you are almost certainly in scope.
-
Limited risk: transparency obligations only. These systems can operate freely, but users must be told they are interacting with AI. Chatbots are the most common example. AI-generated content (like text, images, video) must also be labeled.
-
Minimal risk: largely unregulated. Most everyday AI falls here: spam filters, recommendation engines, AI features in productivity tools. No specific obligations apply.
One additional category worth knowing about: general-purpose AI models, like ChatGPT or Claude. Using a third-party AI model does not exempt you from the regulation, but it does mean you are only responsible for how your application uses it, not for the model itself.
Who does the EU AI Act apply to
The Act applies to anyone in the AI supply chain: the companies that build AI systems, the companies that deploy them, and the companies that distribute them. In practice, that covers most organizations operating today.
If you build AI-powered products, use AI to make decisions about customers or employees, or sell AI systems built by someone else, you are likely in scope. A hospital using AI to support diagnoses, a bank using AI to assess loan applications, a retailer using AI to personalize offers, a recruitment platform screening CVs — all of these fall under the Act.
This includes organizations based outside the EU. Like GDPR, the Act has extraterritorial reach — if your AI systems affect people in the EU, the regulation applies to you regardless of where your company is based.
What it requires
The Act does not prescribe which AI tools to use or how to build them. What it does require is that organizations understand the AI they use, can demonstrate it is safe and appropriate for its purpose, and have accountable processes in place when things go wrong. In practice, this means:
-
Risk classification. Every organization must assess and categorize the AI systems they develop or use. This is not optional — the classification determines every other obligation that follows.
-
Conformity assessments. Providers of high-risk AI systems must demonstrate, before deployment, that their systems meet the Act's requirements. This includes data quality, technical documentation, and evidence of human oversight mechanisms.
-
Human oversight. High-risk AI systems must be designed so that humans can monitor, understand, and override their outputs. This means designated staff with the authority and capability to intervene.
-
Transparency. Users must be told when they are interacting with AI. AI-generated content must be labeled. Providers of high-risk systems must supply meaningful documentation about how their system works and what it should not be used for.
-
AI literacy. Organizations that deploy AI are required to ensure their staff understand the systems' capabilities, limitations, and the risks involved.
The exact obligations depend on your sector, your role in the supply chain, and the risk tier of your systems. But for any organization using AI today, the question is no longer whether the EU AI Act applies to you. It is how, and what you need to do to comply.