EU AI Act Takes Effect: What Changes Now

The European Union’s landmark Artificial Intelligence Act has entered a new phase. The first bans and duties are now in force, with broader requirements phasing in over the next two years. Lawmakers have described it as the “world’s first rules on AI,” a signal that Europe aims to set the global standard for safe and responsible systems. The law’s rollout is reshaping corporate compliance plans, government oversight, and the conversation about how AI should be built and used.

What the law does

The AI Act takes a risk-based approach. It classifies systems by the harm they can cause and tailors obligations to each level. The highest-risk uses face the strictest rules. Low-risk tools see fewer requirements.

• Unacceptable risk: A narrow set of practices is banned. These include social scoring by public authorities and certain forms of biometric surveillance in public spaces. Lawmakers say these uses are incompatible with fundamental rights.
• High risk: Systems used in sensitive domains must meet tight safeguards. Examples include AI in hiring and worker management, education, critical infrastructure, law enforcement, migration and border control, and access to essential services such as credit and health. Providers and deployers must manage risks, ensure quality datasets, log events, maintain documentation, and enable human oversight.
• Limited risk: Tools like chatbots face targeted duties, such as transparency about machine interaction. Users should know when they are dealing with AI.
• Minimal risk: Many applications, such as AI in video games or spam filters, face no new obligations beyond existing law.

The Act also addresses general-purpose AI (GPAI) models, including those that power chatbots and coding assistants. Developers must provide technical documentation, describe model capabilities and limitations, and share summaries of training data sources. Systems that pose systemic risks face extra scrutiny.

What changes now for companies

Compliance is staggered. Bans on certain practices took effect earlier this year. Additional obligations will arrive in stages through 2026 and 2027. Companies are moving from high-level principles to concrete checklists.

• Inventory and classify: Map all AI systems, where they run, and what data they use. Classify each system by risk level under the Act.
• Governance and accountability: Assign owners for model risk, security, and legal compliance. Build documentation trails so auditors can follow decisions.
• Data and testing: For high-risk uses, tighten data governance. Track provenance, reduce bias, and run pre-deployment and ongoing tests. Keep logs.
• Human oversight: Define how humans can intervene. Make escalation paths clear. Train staff on safe operation.
• Supplier management: Update contracts for third-party models and tools. Require technical documentation, intended-use statements, and support for incident response.
• Transparency: For customer-facing AI, disclose that users are interacting with a machine. Label AI-generated content when relevant.
• GPAI responsibilities: Model makers should publish technical details at an appropriate level, explain evaluation methods, and summarize training data sources. Deployers should understand model limits and monitor performance.
• Incident handling: Set up processes to report serious incidents to authorities and notify affected users when required.

Large firms are tending to centralize AI governance and invest in internal assurance teams. Smaller companies are looking to industry templates and regulatory sandboxes that the law encourages. The aim is to reduce burden while keeping guardrails in place.

Who polices compliance and what are the penalties

Enforcement is shared. National market surveillance authorities handle most oversight, including high-risk applications in their jurisdictions. The European Commission has created an AI Office to coordinate and to supervise general-purpose models and systemic risks. The law includes significant fines linked to a company’s global revenue for serious breaches, with lower caps for small and mid-sized firms. Regulators can demand information, order corrections, or ban a system if risks are not controlled.

Member states are also setting up regulatory sandboxes. These are supervised testbeds where companies can trial AI in real settings under the eye of authorities. The goal is to support innovation while surfacing risks early.

Global context and the race to regulate

Europe is not acting alone. Governments worldwide are shaping rules for AI safety and accountability, though approaches vary.

• United States: A 2023 executive order called for “safe, secure, and trustworthy” AI. Federal guidance is pushing agencies and contractors to assess risks and protect civil rights. The National Institute of Standards and Technology’s AI Risk Management Framework aims to help organizations “manage risks to individuals, organizations, and society.”
• United Kingdom: The UK has favored a sector-led approach. It hosted the AI Safety Summit in 2023, where countries and companies discussed frontier-model risks and evaluation methods.
• G7 and OECD: Democracies have backed non-binding principles on transparency, accountability, and human rights. Work continues on benchmarks for safety testing and watermarking.

Together, these efforts point toward a common vocabulary: evaluation, transparency, and human oversight. But enforcement power and timelines differ by region.

Supporters, critics, and what to watch

Supporters argue the EU’s approach gives clarity and trust. Companies now have a single, horizontal law with predictable duties. Consumer and civil-rights groups say the bans and guardrails are overdue. They warn that AI can amplify discrimination, enable intrusive surveillance, and erode accountability if left unchecked.

Critics worry about compliance costs and the risk of slower innovation. Startups, in particular, fear legal uncertainty during the transition. Some argue that risk classifications could be complex in practice. Others question whether enforcement capacity will keep pace with powerful general-purpose models.

• Enforcement capacity: Building skilled teams in national authorities and the AI Office will be critical. Expect guidance, codes of practice, and rulings to clarify grey areas.
• GPAI oversight: How regulators define and monitor “systemic risk” for large models will shape obligations on documentation, evaluation, and incident reporting.
• Testing and benchmarks: Independent evaluations of safety, robustness, and bias are likely to gain weight. Interoperable standards could lower costs and improve comparability.
• SME support: Watch for sandboxes, templates, and open tools that help smaller firms comply without stalling product roadmaps.
• Interplay with sector rules: Health, finance, transport, and product-safety regimes will interact with the AI Act. Alignment will matter to avoid duplication.

The EU Parliament’s description of the Act as the “world’s first rules on AI” captured the ambition. The test now is practical: turning principles into consistent results across 27 countries and a fast-moving industry. In the United States, the call for “safe, secure, and trustworthy” systems, and NIST’s focus on helping organizations “manage risks to individuals, organizations, and society,” show a parallel push. Together, these tracks hint at an emerging baseline for AI governance.

For businesses, the message is clear. Build an inventory, classify systems, and document decisions. Invest in testing, human oversight, and supplier controls. For the public, the promise is AI that is more transparent, fair, and accountable. Whether the rules deliver on that promise will depend on steady enforcement, pragmatic guidance, and continued technical progress on evaluation and safety.